{ "Event": { "published": true, "date": "2022-03-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-03-29", "timestamp": 1648598581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b0f311bc-96f6-414d-aeed-49ee9fd8fa58", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f225b80e-af75-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648568165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568165, "uuid": "6069e49d-9d8b-45a7-8d38-33739cb7f653", "comment": "Malware payload (Formbook)", "value": "0013ed29deca9b86928b96bb4c77b2c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568165, "uuid": "bfa8de16-2c5c-435e-a1a3-0cc81b53bf25", "comment": "Malware payload (Formbook)", "value": "0082123fa15fb43d060c2f764bdd9f31a19e53b185e5f6de37d1dfec2f59504f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568165, "uuid": "f427baa3-94a7-4fa9-bf66-6097414feb57", "comment": "Malware payload (Formbook)", "value": "2204f60387bb069b764141187a76555effa6f929", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568165, "uuid": "368633b3-2608-4ff3-b409-ea72393ade2b", "comment": "Malware payload (Formbook)", "value": "b25bbccdb122dd8b8f940a336ddd5c93f9886475ae57ccb74f24ecfbd576772164f755b774c9692f2c6e3aed4c88a801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568165, "uuid": "0921f9c5-2d1f-4c08-b3b3-59e74e35f42e", "value": "T1D035011273DAC903CABD97B788FB910057B53D964623D60EB9C837FD0E22782594A71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568165, "uuid": "f912b186-2a62-47ac-8d8d-97e093ad77c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568165, "uuid": "ae5598d7-09eb-4da1-880a-527cfbc292cc", "value": "24576:giFyaPWd2VIJIKHnlr1BFTv/9YjAJzKMvzadsW0ZFoLYXFBAStO:maOd2VICKFr3FT9YjAJzKMvmdsW033Xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648568165, "uuid": "d7bbdce2-c2fd-41d7-8530-3fbb6c157795", "value": 1157120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648568165, "uuid": "c59505c4-c6e3-46c0-b3f5-a0eb995dd97d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568165, "uuid": "333053e5-ce04-4592-9c39-5455db6a2ef8", "value": "Biochemservice Co Ltd-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ac5982-afa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648586558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586558, "uuid": "d744dbe6-50ab-43ce-9353-0633e514897c", "comment": "Malware payload (SilentBuilder)", "value": "67cdb91303929a344b5c9be0459340af", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586558, "uuid": "511fd499-b560-42e1-ac01-efe4a75e4fb4", "comment": "Malware payload (SilentBuilder)", "value": "00ef19a9999d66a0a2fd269dc716bb6380d844c95ddb36138c4ed1beed22a55b", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586558, "uuid": "c131923d-bc60-40c5-8c9f-3febe92568c2", "comment": "Malware payload (SilentBuilder)", "value": "c389488afae46d893877e5705f28927007d4730a", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586558, "uuid": "63702f7a-3aec-40fc-ad3d-a0c693fd4380", "comment": "Malware payload (SilentBuilder)", "value": "e649a5386631a45721f8806e196b421e6a8072698ea8422890a53837d83778f981937ea048cb9ad7a64b810652ad7b39", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586558, "uuid": "a5b05dee-c18c-4156-8802-4dbfec65bb24", "value": "T18EB39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586558, "uuid": "225ae2e8-639f-45ea-89c6-cd58bde09274", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMi:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648586558, "uuid": "cbe8c83b-f64c-4dbe-bcbb-52c2d3e744a6", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648586558, "uuid": "0d75358a-f9cb-4def-ae6f-1afd18ea09b1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586558, "uuid": "ec76aafa-12b5-41da-808f-ed3ffb3fd6aa", "value": "67cdb91303929a344b5c9be0459340af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4380c0e-af1a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529057, "uuid": "329ba199-df57-42a1-9bac-d5f206e480f6", "comment": "Malware payload (Stop)", "value": "55704d905e5a21dfe8488991b269b6ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529057, "uuid": "f0dc3f32-d72d-438f-a6e1-379aed85f42d", "comment": "Malware payload (Stop)", "value": "00f34e84ff75283bed87c60a481ebb17f1909b94b0fb16009ae6b8bd30e9d446", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529057, "uuid": "b81a6ea8-93ee-46a2-8559-c097c2b451e1", "comment": "Malware payload (Stop)", "value": "04f9c7e88b78057073eec3eb71e99803673d0d72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529057, "uuid": "3fa80a21-bb55-4c2b-95c9-6012ead3315a", "comment": "Malware payload (Stop)", "value": "37851e4c79cfdecda033d8a9f079d1ec1ad29bc454b1878f5367259441a771596e3f48714656e7f5e7e175aea277e7a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529057, "uuid": "7490bf0f-390f-4ad0-9860-1582f3725f0c", "value": "T1C705F100B6A0D035E2F726F0497A93A8BA2E7DE19B3491C763D52AEE56356D4FC30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529057, "uuid": "1618d38d-0954-482a-9c9e-d6f6e764ff6a", "value": "c5abd0d249bf5319619ab44b6b97960d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529057, "uuid": "383909bc-8b55-4b9b-b22c-4afda69ed5e4", "value": "24576:N/mMqe92TgC9ucI38RVPSCrLyt+v3Nc3t2xDJHtkZQDOum:Nb9YZCC8Ep/bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529057, "uuid": "f27b5eca-a8cf-4c33-90ef-31b6e123e5ec", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529057, "uuid": "b92418ae-8964-4605-a066-5ebc6b9094b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529057, "uuid": "89701dad-0b84-4965-8eea-4cf7e4e9dc3c", "value": "00f34e84ff75283bed87c60a481ebb17f1909b94b0fb16009ae6b8bd30e9d446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcbc55a-af07-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648520564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648520564, "uuid": "b3f28b92-47fa-43de-91f7-681991a28469", "comment": "Malware payload (AgentTesla)", "value": "8016e284bd22a559d2d25496e60e90a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648520564, "uuid": "f69fa6fa-4b19-45d1-93c8-b2baf5ef6d83", "comment": "Malware payload (AgentTesla)", "value": "0122106035e38c8269d608e049e6f09f3d3839f3c2026ee17736a8ca25eae3bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648520564, "uuid": "ca59826e-5a7c-4136-814e-1ea9c67ada3a", "comment": "Malware payload (AgentTesla)", "value": "a81eaca5cdba751b59dc2ced3b4ae1d30320130b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648520564, "uuid": "362a8393-604f-481d-a7d4-dd2e0bcc5129", "comment": "Malware payload (AgentTesla)", "value": "1c5e1ad771058bff58e36b305472990a19b65962358aec9cb62b4d55e5b6e4918b9f5d902ea21a0341c52a10b366a37c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648520564, "uuid": "a11e1da8-bbe5-4bf5-9082-2aa227b30207", "value": "T1DBF4B4ADF2F076EFC857C0729EA81C68BA5075BB931F4103902715ADDA1D987CF14AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648520564, "uuid": "efdc594a-3ede-4058-aae5-1d16f6529dd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648520564, "uuid": "0fd2352e-c881-4830-98da-1a2c9492b19d", "value": "12288:1KSorcLK3CfDjqu65n92zrn89s0TWAGgzzdvg06qSgVSoKfwkiTd5Lgjj1sYDWxY:hUr5LgjjIxAHWiFIZQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648520564, "uuid": "8379bcca-9d46-43a5-9b97-3f1d426ccaf0", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648520564, "uuid": "f3d3046e-0d18-4460-8e0d-c729563c5f00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648520564, "uuid": "f2389f0c-e431-485b-8aef-595d24363731", "value": "JKG8FWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca70ceb6-af55-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648554354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554354, "uuid": "18dfea59-6035-4e75-a87d-9800be16ec6e", "comment": "Malware payload (RedLineStealer)", "value": "b963bfa54595ba3df398a59b62d2b706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554354, "uuid": "97b4ac4a-f7e3-49f1-b735-ac380bd89b3b", "comment": "Malware payload (RedLineStealer)", "value": "017118612816b95f23b39dbb5a82ea128aaf3afe315ce0314c020a9848dd6d80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554354, "uuid": "3ef6a7b2-fcb7-4651-be41-7362b68dfde6", "comment": "Malware payload (RedLineStealer)", "value": "1835cedfee6af4bc44ff1a1f3b7db95afe739c46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554354, "uuid": "b4f04492-71e6-41c8-a4c3-1786b2839b57", "comment": "Malware payload (RedLineStealer)", "value": "55b13c91a38b0d839d189d4095c8ae4c7abd529dc1befd9be754deb84b381538a35f557f590618f2ab1697fb1198b431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554354, "uuid": "102f50f5-f0d1-45d2-a89b-703d1ca3c52a", "value": "T19AE40130BA98D824F093163C44268EAD632DBDB195E1564336947B4E2E33E9F26E135F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554354, "uuid": "833bf282-7ce0-4633-81e6-bce9ab828671", "value": "224a3deb95ca6706e4bcbf2a455a41b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554354, "uuid": "850f6cd9-89a0-4e9e-a02e-32307e9bc586", "value": "12288:sXRf8TWc05ZnLT60jK6r5LC28wUobo+i9d0/SNIfuAuVunnbGAyFi8Q:IR9cQZLTr5L/8ns27IfTbGAMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554354, "uuid": "270c8b41-54ee-4628-8d70-ff558ac65132", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554354, "uuid": "af807c80-15df-428b-8d9d-f72561f996f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554354, "uuid": "3bd96b11-7207-4841-a5ae-aacfad3e7ee5", "value": "rolle.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca437203-af71-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648566380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566380, "uuid": "ecc73db8-31b9-48aa-bd31-8e69c2f6c9f0", "comment": "Malware payload (Formbook)", "value": "377a5011120cc593432c7ea70f0c971e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566380, "uuid": "926f3342-d7a1-431a-b7f5-88e5b0949e12", "comment": "Malware payload (Formbook)", "value": "0175afd6567f7f1169e3d702827f4f85761072e608f074d20292a45539300a85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566380, "uuid": "af2522e8-647c-4d33-a0a5-0d4a7d1ff233", "comment": "Malware payload (Formbook)", "value": "51aace34e6998d7d89bfb63baecb3d5a69337c11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566380, "uuid": "cb6b2491-6d8e-4978-91f1-ce0e79cfd762", "comment": "Malware payload (Formbook)", "value": "da34f4144170c862693d249cd6ef31cd98813b010897c57caf89b6d6fe58747e7aae81bf8cbdd305f21f1d8efafef47f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566380, "uuid": "80fc225b-c272-45dc-be86-6c76bef7647f", "value": "T1ED859DE033A45E55F9DE0E72B0B44A1661F2A857EFA7D67E7600D3E9182FB40C12D362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566380, "uuid": "a2be7694-11c4-4c6f-9a1a-5613abd23c72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566380, "uuid": "08d1739a-30e2-456e-8aae-12c2844339a5", "value": "24576:m91WFwAAasGfSEpUvl6JUj+6J/ypNt9Tl+zzIm8zWCs1Hd1lWp:OWRf1Ud6CjNM+zzI596di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648566380, "uuid": "3ae3d75c-d7c8-49a0-8710-80b2e6b00e4f", "value": 1806336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648566380, "uuid": "f787877f-9bc1-42e8-9350-b0ae6f1d152e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566380, "uuid": "f26cf44b-14f2-42cb-b569-34b58ccdfb4e", "value": "order confirmation 1000037106_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd5e7a2-af62-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648559645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559645, "uuid": "260d16b8-11b5-48d3-81cf-ade434e8e7cf", "comment": "Malware payload (Formbook)", "value": "2a5f0a1e6f03b69f23e8f882a4d19818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559645, "uuid": "6965a350-c004-4037-8f00-6e95b933e6cd", "comment": "Malware payload (Formbook)", "value": "019ae0f277bc8b7feb08ea23b8e78b405a025e6ee319848bceaf18bb013d6893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559645, "uuid": "cf05d03f-81dd-4daa-a7d5-3f3cbfd05db3", "comment": "Malware payload (Formbook)", "value": "bbbf73726b9a9ccf28bb73588a898e716c6424b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559645, "uuid": "e8b788b7-f810-4fb7-8b58-662ab25dd444", "comment": "Malware payload (Formbook)", "value": "411140ab758fb73515102641c2c76af2a67b103a7a17709eed8a042b22a1ac1533b700f5348a954f5ac3e397f21c355c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559645, "uuid": "d237e50c-6e42-47f0-b4ec-45acbd60e774", "value": "T18E058D7651D9A0CFE8E2F971212C213E7253FCDA9A50AF09E6ED354F1B286444126F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559645, "uuid": "c54d2def-50c6-450b-9b15-2b88c597d7c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559645, "uuid": "c575a6ba-2fbb-4e15-a680-751c7cad76e7", "value": "12288:CnfdHCwweyhwE+Z4xbU0G1E6VakXV8tF5fDtWNfTRCQL6:hkzEQ11ZFwkCQL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648559645, "uuid": "68e11a68-4366-4bbe-a54d-410dace019dd", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648559645, "uuid": "6bea713c-3f4e-4e0c-beda-0dbe8ea9c7ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559645, "uuid": "d362cd4b-9634-4de1-977b-ba8b2c2362ee", "value": "20220328-00942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922304e1-af4e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648551253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551253, "uuid": "31925bf9-8150-4d01-895e-221142b6a428", "comment": "Malware payload (Heodo)", "value": "8ae7d4cd18a09af16cf6ce1e86dca5b6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551253, "uuid": "d1a765af-c893-4dc3-9746-5c620bfcb0bc", "comment": "Malware payload (Heodo)", "value": "03121866275d14443652c87203b178a027fdaccb7fbf15c980caddb5deaa29b3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551253, "uuid": "5d443a98-a8a3-40d3-a0c8-304794913a76", "comment": "Malware payload (Heodo)", "value": "ce380d54b8af9a4b2d619edce1bc8dea43acda42", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551253, "uuid": "8d419c68-b68f-4dc3-adea-7e02f0c4c9cf", "comment": "Malware payload (Heodo)", "value": "f07ff74dd04e06aa59efd5c65a46f0d22238449c8905076af2e98d8822c64d769815f8cf5143d2a6b664db384a04c90e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551253, "uuid": "616b8d03-e081-45f8-aff5-3c03d62726b8", "value": "T1D2C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551253, "uuid": "1d0a4925-91c2-44dc-8ac6-f1f1b82fbd7f", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551253, "uuid": "21f7ae32-2d0d-4fc2-953a-f6f1c92a23a8", "value": "12288:iUV7ciwHX3ew9aYU3ptc9inFijaQeL+nZBb:UiMX9IXky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648551253, "uuid": "e4cfb6bc-92c9-4e7d-94fe-68e3c2c2b577", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648551253, "uuid": "742eca38-b040-45f2-9387-d7a6b680ee76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551253, "uuid": "4c6eebab-d812-410d-9e6f-de68f4056201", "value": "dw9fvUUqUG7Lrljp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc8f249-af3d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648543995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543995, "uuid": "14e549b9-a303-4608-b4a4-7899b0ee112c", "comment": "Malware payload", "value": "eb63d3cb3e5beae9e6c60b0c0df6d2c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543995, "uuid": "71968ea9-475f-4815-b4be-1843da27a6e4", "comment": "Malware payload", "value": "0314ab87f9a1c63d288d22d4f72317e7679d7b1f0165ca635ce3aee30e14f845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543995, "uuid": "479ff2be-550a-4d77-8d2e-32bd6cba9325", "comment": "Malware payload", "value": "67b7ada93b51d1874a37fa9c43d5591886148ade", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543995, "uuid": "987fe58b-4870-470c-8c5e-6adc0977cf92", "comment": "Malware payload", "value": "03fddc7bac4f52b39b5d3b30a60d654c2881a7182fafb21578a08b4b7a951fcbbcd9f26be6332c18b9fe86de426c5571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543995, "uuid": "b29cd947-07bb-49b6-844b-2c6067838b2a", "value": "T1E444C0D4B7FE8A92C989F7BA55C1149C02B1D14A3E57D78974F0062C8CD23DF2A81E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543995, "uuid": "1993c627-5231-4eff-b305-b54101c3ea22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543995, "uuid": "3612a219-5791-4b0d-945b-dec3b36a23a2", "value": "6144:z5qatmqmvvnthwrZXOAB4dL8SqxTDfnFo8Of1epAP5RyYYSTiGMYJssEbH:5mvvthy+BLAne8W1eIRyY9iN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543995, "uuid": "471a0525-1ecc-41be-9f5a-01a47cd0aac9", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543995, "uuid": "0144eef3-8546-4f61-84fb-6f43b43a3315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543995, "uuid": "756c5d0f-00c0-4698-9bb2-9e32793eba34", "value": "PO-#NT00100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703116e7-afae-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648592428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592428, "uuid": "f3f0e1e7-505e-41eb-b7b4-7d0fb498651d", "comment": "Malware payload (SilentBuilder)", "value": "d6902fee455a10dfd8b61039ac9435e7", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592428, "uuid": "6ba422e2-8a48-4c09-9239-bfda9e80202f", "comment": "Malware payload (SilentBuilder)", "value": "038dcd8d86a9585f7566a7f256aa93867e3ebddd46837d16dd29a8d866fbccf5", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592428, "uuid": "dc1c74e2-8333-4efd-b04f-1c9108f3a74a", "comment": "Malware payload (SilentBuilder)", "value": "1ff5b77020b6e0fb2216fc0bf19361edc276d676", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592428, "uuid": "ec58cdd4-d400-49ea-9484-cdbae5ec05e5", "comment": "Malware payload (SilentBuilder)", "value": "b19787f14d52ee12b37d2aaf6041499e9d01a7526cf68b808b8940087939a789f7814e935346300b085563f6a34f8beb", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592428, "uuid": "ad1fc61d-31cd-45b8-9fd8-99353a797009", "value": "T167B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592428, "uuid": "bc094a4e-34db-4514-9b04-8d8cda48afee", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMe:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648592428, "uuid": "e5b3863e-1f04-43b7-8996-dc9f4123a44f", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648592428, "uuid": "e83b598f-2434-4503-91bf-f00638feb193", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592428, "uuid": "dc47eba4-f64d-410b-b1e6-a0a5b02c8b07", "value": "d6902fee455a10dfd8b61039ac9435e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc92aeba-af24-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648533285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533285, "uuid": "80e47a9a-8a16-470a-8cbd-cf5672d6159c", "comment": "Malware payload (Heodo)", "value": "bdc4406bbdb2ec52df12bb1b723f93c0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533285, "uuid": "e610df9f-7dd2-44a1-8038-03357155aa1f", "comment": "Malware payload (Heodo)", "value": "03a108708fe932b26279dc01105f226058dd8d7d3965842c99d7e2f765757b8d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533285, "uuid": "84cbc132-e8fc-464e-bc6f-5eb3d168f227", "comment": "Malware payload (Heodo)", "value": "2695c6bd92b549b28d93d00e70f1c0300c25a008", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533285, "uuid": "8a56b43e-37fb-4564-b207-c76c538c22cd", "comment": "Malware payload (Heodo)", "value": "feab7b4435c86aab2fa959b97c1042a5bb7c3f610b3ca7541a19d048841063afa5eff98ccfb56b21fa1d162c2a418008", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533285, "uuid": "f9acfdd3-43f5-4616-9dd9-1084f7bd39ea", "value": "T16473BF0F25E4C9BAD98486720EFBA638A2FDBC7378615A5357D0FE4E0C31A118D5361E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533285, "uuid": "ff85f0c3-0331-4e36-9393-eb27361d6a12", "value": "90cf95ecd64949f490339642872dda87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533285, "uuid": "8cf67758-6cb2-41a0-b8e6-a101cedda610", "value": "1536:wAOKQywBCX2OSmSGQqR6XYj0G6pzboBlpAvaLO:wZKyBK2OSCQlG6pAlAaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533285, "uuid": "f3568ca0-a1d1-43df-bc77-6d608de9407b", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533285, "uuid": "171a046d-3e7d-4c35-8eba-956cee5bffa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533285, "uuid": "ef97c048-bdbc-456d-acf2-a2169ddf7382", "value": "cmdcmxcfg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba22ee8e-af73-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648567212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567212, "uuid": "4398f124-0b17-44c8-b378-2008f651eb89", "comment": "Malware payload (SilentBuilder)", "value": "1930d958721d2ea5e08bf26589a99697", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567212, "uuid": "d133ec7c-81dc-4eff-879a-52094da4acab", "comment": "Malware payload (SilentBuilder)", "value": "04105cdda442f56451fd6e3c92dab0327d64bb9901b3087f3f7fdd81c03fe3a1", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567212, "uuid": "507eb9ae-bd09-4481-bb3b-a926ea034c4a", "comment": "Malware payload (SilentBuilder)", "value": "a7b3b19bfa460e4b3ea47efa802a38f90508015b", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567212, "uuid": "4340bfac-2b32-43c1-9570-5e1e34ee5784", "comment": "Malware payload (SilentBuilder)", "value": "037f91622f1d1cdb56644423ebbef9d6fbea6ced83aa22a3e2238a302e26c1e80b9e3a284bcfb8b8609b089d5e060431", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567212, "uuid": "1f5c5618-47fc-4f2a-8fab-e3b7878f0030", "value": "T17FC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567212, "uuid": "ae1b1507-9640-4fab-8fb7-14c76f9789fa", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648567212, "uuid": "69c0bf98-b2bd-459d-b584-1c9f4c360539", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648567212, "uuid": "bd33c047-914d-4734-8395-4fdc1689b4e6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567212, "uuid": "699eed75-c356-46eb-84a6-6c804dd24cbc", "value": "1930d958721d2ea5e08bf26589a99697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e22cf20-af24-11ec-8e58-42010a9c0032", "comment": "Malware payload (Socelars)", "timestamp": 1648533127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533127, "uuid": "3726dd82-587b-4856-93cf-46c76443c109", "comment": "Malware payload (Socelars)", "value": "c44daf4109f794c312ac6fcb95afcfed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533127, "uuid": "55efebf3-d638-4458-aed2-0241100acf34", "comment": "Malware payload (Socelars)", "value": "0474bbcdd9e06596c4c83f9d5c17bbbebc831f5687a166a24509b9b79a3b79f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533127, "uuid": "79ec04e1-16a7-4c67-a12e-0524a9d13ab4", "comment": "Malware payload (Socelars)", "value": "35ac39823656e396eb9fde580cd3c73d24aba881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533127, "uuid": "47eef98b-738b-4a5f-82b7-a0e0d0a08ae1", "comment": "Malware payload (Socelars)", "value": "093c8ad0f7e51654e898cbac14b205a674df8dc229eb179ac3923f8780040345d83510092d1dfb5da81ed03b7e9f9a18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533127, "uuid": "0600193e-49fe-47c3-ba18-c7cd9adcb528", "value": "T17D659F11F6429036ECE300B282FF4AFE8D68B621071894D7E3C46DA95E715E37637A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533127, "uuid": "57638b45-e335-45f7-8de2-57b8eb5023fb", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533127, "uuid": "44b128c6-0d82-46ac-bc96-af55caca4fce", "value": "24576:hKAgpBGV2HpWHuREjDnI2AuADZ8KvqC75H2dtDPc/EZKFEIg:JgpG57R8InDPcsZKyIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533127, "uuid": "365efc0e-e1d5-49b5-834c-1c3f461c1364", "value": 1489920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533127, "uuid": "8cdb5d2f-3924-42e1-80d4-c46dd50c08c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533127, "uuid": "21636dac-7467-42a0-b36d-855ac1c90331", "value": "tvstream11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275f44b3-af44-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648546779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546779, "uuid": "4110f29c-9921-4731-909c-59b9fb7e546b", "comment": "Malware payload (AveMariaRAT)", "value": "aeadcd456a8205f4e8c1bb920c516c5a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546779, "uuid": "ef4dfc43-9797-42ae-93b1-df857f57d580", "comment": "Malware payload (AveMariaRAT)", "value": "05327abec8fa207cfda4ea7d28c60a825d3b9f46eb13b72958b2c79c3c318637", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546779, "uuid": "37d6dc1c-dd87-465c-b3eb-85a6a37b7267", "comment": "Malware payload (AveMariaRAT)", "value": "4aa07c2d013950c3d2933f78d420eb24ba6f02be", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546779, "uuid": "a8ab9a74-6a1a-44b4-8634-991fa2b31e06", "comment": "Malware payload (AveMariaRAT)", "value": "7948cbd03f19d813648066598f28db6249cb202aa5adb657877793d7f56e26a5ad5b240176cbe8cd360e106e5e11b585", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546779, "uuid": "1bc2e341-ee7d-4163-88f8-c96709006ec5", "value": "T16EC40253F084B2E1D164DCF36E09D6E6972EBC2B05845667728EBBAB0AF05374772603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546779, "uuid": "a148c19d-80b4-4474-aca6-bc4ef7fb6d38", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546779, "uuid": "cba5c549-2332-4c28-b854-7a2bb41b1d4d", "value": "12288:3afq+BhI7Vfl1HZmScS3KcZomBy01uknn0q:qC+X8VfZmSI4Nn0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648546779, "uuid": "bacb6f84-25cb-478f-be09-f3e19d80e477", "value": 557383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648546779, "uuid": "564c2fe5-dc6c-4e44-b13c-99a745497906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546779, "uuid": "b87e84bc-27bf-443d-a7ad-ee36c901337c", "value": "\u65b0\u8ba2\u5355POWT230812 Order LPG Marina 40ft hc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03465502-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648536840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536840, "uuid": "0fdf9169-a8d9-4755-9cad-d69830d31619", "comment": "Malware payload", "value": "613442dbbdad80393a09af637749cb39", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536840, "uuid": "203003c6-482d-475c-8e62-728c197e1cda", "comment": "Malware payload", "value": "055535c6770bb412dc296d6905d6dc5a57aae900592cd3fd80a8c8e527f4f97e", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536840, "uuid": "7b2fa282-ccfb-4e99-bf0c-1b9c18c97895", "comment": "Malware payload", "value": "9b55fecfe4a3b1abeabded85d5ea8df4c4d5c219", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536840, "uuid": "bae8ebd4-966b-4b3e-8a0e-f198d57632ce", "comment": "Malware payload", "value": "08cdbc3fe9f9cb2ba8356668740999d6d000dc56598bff1dae8e0170911bd44b1c86fb0f1c35a595ac4ff786ff4759c8", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536840, "uuid": "5236d296-e773-41e5-bbbe-0a1e0837dd8d", "value": "T19714020E7EBB4B64C71377759427B7AA4209DD48C978972E232E320D3D325ADA4E612C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536840, "uuid": "17de2862-b37e-4a0a-9c38-686c28df828a", "value": "3072:BtdiT8DtvcoWPeoIEx95wLwRyhamGqMWfsIrjI2b7kUgJznisTroMUZA2NCQ:hLhLoJ9w/ampHrjlglisobA2NCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536840, "uuid": "b949aafa-8ef1-46d3-ad2d-ec764dbcfaaa", "value": 194264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536840, "uuid": "a67607c8-1e2d-4440-af5f-3c9d37c30a15", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536840, "uuid": "03519f5c-7310-43c6-8abf-91276d778e6c", "value": "022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba26218-aefa-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1648515164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648515164, "uuid": "a0b45edb-0ed5-4a9a-9dba-fa680ff5abdf", "comment": "Malware payload (DCRat)", "value": "1ec63dff58c74f1fe19750a7437ecf66", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648515164, "uuid": "0d6db0e0-1964-4349-92c7-7cd206255eaf", "comment": "Malware payload (DCRat)", "value": "05670108cebf88fefd256c49f96012d1d065aab879d47e98bf0bca383b44fb08", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648515164, "uuid": "3d57ae7a-215f-45bb-8e6a-4f792d2d9b80", "comment": "Malware payload (DCRat)", "value": "e4fe65ae5a3f5aa202b75d9b74a2c2ca38b8bf43", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648515164, "uuid": "0e1650b4-89bc-49bb-bf9e-dcc1888b1191", "comment": "Malware payload (DCRat)", "value": "d00c81afe23c194fbca40001ecfe3349f5e1b8cbf027dde85866ed66afc9a606ab8126702bf919b3c04f35c53395849c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648515164, "uuid": "679b396b-4a1e-4c93-8e3b-77bbc0dcc51f", "value": "T133559D127A45CD27C0661B33DADF801847A9BD02AA27DB1E7E9A375E16013B79D0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648515164, "uuid": "ac7536c6-47df-4dc8-b207-933a2fd72fcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648515164, "uuid": "3f5da0dd-d105-4150-a980-eab86d09e157", "value": "24576:/HQxd1DXodUpZ5NHrmmN62X7s2s16qSXQjE2US0vqvg1T/ByO/yF50:YxYUPPrdLsjRSXQjEnqGNrY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648515164, "uuid": "9224394a-ac61-4cab-909a-f4f14fb44b5b", "value": 1372672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648515164, "uuid": "f3fe9c33-e16e-4e64-9804-49a61668c68c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648515164, "uuid": "eed81f89-6cac-441e-94e9-927c10d12f43", "value": "1ec63dff58c74f1fe19750a7437ecf66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9b210e-af7a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648570328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570328, "uuid": "31ec760c-22e6-41e0-996a-6299d0a11c50", "comment": "Malware payload (Heodo)", "value": "6d93e6cb8005252373b727efd1ce28e3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570328, "uuid": "17f86bdf-b723-4cf7-95b5-c0e3a95a480f", "comment": "Malware payload (Heodo)", "value": "058d0ab49a6716e173581badccc121c9ed0ed63e27df00adbf6a8a549dc88c78", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570328, "uuid": "0f0aaff2-2bea-4897-9831-0cd1a5167a82", "comment": "Malware payload (Heodo)", "value": "1c5acbfe9c8d39ee786f0f465b250b6b30cc24de", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570328, "uuid": "abbe6836-380b-4387-8cc9-e534c5dfa3e4", "comment": "Malware payload (Heodo)", "value": "10c0e504c616848da1086ee25c3c15efc29e5a009c13bd819d0244372feee37bd3e428200870c432fb0fb3752c199470", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570328, "uuid": "5a9be070-cfc3-4b6d-b055-aed178ef087f", "value": "T127C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570328, "uuid": "a4c100d1-c001-4c47-bfbd-5d4457f08258", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648570328, "uuid": "c4ece311-2394-430f-86c5-0a0efb153936", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648570328, "uuid": "18ac6e95-769f-4dd8-93e3-9e2f766ce639", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570328, "uuid": "3836aa54-e9fa-49f4-93f2-f24580a37771", "value": "6d93e6cb8005252373b727efd1ce28e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d52e5f-af5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648556326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556326, "uuid": "66e839d2-930c-4f84-981a-0fb50a6a5fff", "comment": "Malware payload (Heodo)", "value": "73fb3383cf6f7a5a620d3817598a6862", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556326, "uuid": "d18271f0-7649-4ae3-bcae-d9865db7d1f6", "comment": "Malware payload (Heodo)", "value": "05e8b2ee5ed29fa14d1c7b36adf334b881b6f045c070b369897d029feb9ded04", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556326, "uuid": "27d1c13f-ed18-4b9d-a872-33afd2a1a566", "comment": "Malware payload (Heodo)", "value": "c523bfe478ce8858207d4c76e322771451b79339", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556326, "uuid": "167f9c8e-9ce5-4517-ac92-e1190d5562b6", "comment": "Malware payload (Heodo)", "value": "03edf85bf0a689128b7690d9e84bd35b6571198005c62eace0d214fac03420c6f82420ca9adb300eab54f58ab60c550b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556326, "uuid": "90ffb557-aa9d-4af0-864c-e8d5952a74c0", "value": "T196D45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556326, "uuid": "fae17532-0f40-4a72-a39f-f0fb1adc56dd", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556326, "uuid": "0f811d37-2adf-4e81-8a36-ff08308db4ea", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzLipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+w0ooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648556326, "uuid": "1adf806a-0406-46b6-ba23-732bf9037803", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648556326, "uuid": "02164508-5736-43c5-8f72-e859493e98fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556326, "uuid": "0784e214-78be-4b05-b3a4-63bfadfafc52", "value": "emotet_exe_e4_05e8b2ee5ed29fa14d1c7b36adf334b881b6f045c070b369897d029feb9ded04_2022-03-29__121839.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed49c61-af2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648536833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536833, "uuid": "2c1253df-f688-425c-82fe-e051dce42afa", "comment": "Malware payload (AgentTesla)", "value": "a0fd881e52e9e2272a3e251b56e846be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536833, "uuid": "f26b4911-5328-4a40-a5b5-a8f6b2b63da5", "comment": "Malware payload (AgentTesla)", "value": "06082eb111cfb7c0c36de7f09bcff7fe10164b14385749292548a53d8b5bc78a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536833, "uuid": "75730366-1b6b-46c2-be76-c70fbdac24e7", "comment": "Malware payload (AgentTesla)", "value": "3de64db20562dc0449f1ad1103659cc8b023656c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536833, "uuid": "c96393ff-b69e-46f3-a4cf-e306cd8d93b1", "comment": "Malware payload (AgentTesla)", "value": "c49a90350b898c397b1c3fc03e7493371fe7adf6ae475ffeb28d08aa690697930c86acd2a75d1c1a66369c0b38bb6584", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536833, "uuid": "73ff09af-ade1-461e-a75d-db78e4b6ddd0", "value": "T15B1412253AB4759ECA01EFBD2F3AD9348268EFF48854E65462207712363D8A70573F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536833, "uuid": "0fd51aad-d956-4f13-b30b-1df82c3a493b", "value": "3072:kgVl8rPGHs/qKQKEFwlpy3LVJb/V9Umf7RdhvENNZuIfRLTYhjtr9LxXLE:BfOPGHZKQEyBJb/V9Ugl7vEPZuIZLTiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536833, "uuid": "232e7ada-95b0-4af0-8c2d-fbfc60821473", "value": 193592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536833, "uuid": "0dad4986-9134-4664-95c0-a0857b2333aa", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536833, "uuid": "3e5171cf-ac70-48e9-8636-09d27401878a", "value": "Shipping Documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1e304f-af71-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648566462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566462, "uuid": "9a88e45d-89f1-41c9-b068-9d317a2e6f66", "comment": "Malware payload (SilentBuilder)", "value": "1733c444a284565f628734d9cdf74651", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566462, "uuid": "c8f93501-5f25-4859-921e-ab896572fbd7", "comment": "Malware payload (SilentBuilder)", "value": "061e17e2d439a3a3345414a01c54208e9ca6e4fb189542b8124668e6dd9659b7", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566462, "uuid": "03ef2619-a9c4-4277-bf0a-9e491dcf8de1", "comment": "Malware payload (SilentBuilder)", "value": "f1cacc39a6476841855a28298ef8fe1ae4f0a78a", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566462, "uuid": "6e287996-a38c-434e-b24c-1efd9998d797", "comment": "Malware payload (SilentBuilder)", "value": "fed0ba322ab4ae16687b2102103d7478a3d3c00ca7bd4206099360ffbd1ddcf0dc7143927550f292bbbec9fbf4431d7c", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566462, "uuid": "71ebc07b-feea-4153-8cec-646617840363", "value": "T1A3C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566462, "uuid": "d10a11dc-bd1c-43af-bba4-5b057a82ef66", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCs:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648566462, "uuid": "249c2dd9-8ea1-4016-b983-a2afebcdf8dc", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648566462, "uuid": "4d802441-d4a3-4923-b846-d9f426b295ea", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566462, "uuid": "db68f917-82b2-4f15-95bc-1a3cf253e006", "value": "1733c444a284565f628734d9cdf74651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef668b91-af6a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648563435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563435, "uuid": "d3d51248-6d16-42d2-b74d-f6dc0e6d7222", "comment": "Malware payload", "value": "b885e069d5e530fcd048d40f424c4ddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563435, "uuid": "5f9482f3-c2ff-4286-ab5d-25905d1a30fe", "comment": "Malware payload", "value": "0633ed30adde146a82f4e99278d699ac974182f29ad63a4fedb119b94462eff2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563435, "uuid": "660dfe85-44c8-4864-90c3-d9f5a1c05ec8", "comment": "Malware payload", "value": "007a9e970e896730345918b270498baf7b1d3b75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563435, "uuid": "309273b0-0bb6-47c5-89fc-f7b387accadd", "comment": "Malware payload", "value": "9f780d7d6f387c0e992af9a648694a3c0e31b2417b61ee65b6745165162c6cd68aa25d4ed12679372dd04a44ac610cfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563435, "uuid": "cf9b0696-ac5e-44b3-bcb7-5fa8a39a95b3", "value": "T1A717AC2C7A0E5A72FDDD993489063A08BB670F0323E0A9D2679B15CB874F5F56D05F88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563435, "uuid": "dc29782e-02c4-4b3d-b9ae-1376b3fafe1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563435, "uuid": "7f5a17d0-6c1d-4e0f-aeb3-5afc78148ccc", "value": "49152:I4QuiC2jRE21piOkoZQgjQ7FJCQ4M629ecptWjFFww2:I40d9yhsRjQ7FJ4M6eecptOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648563435, "uuid": "05562a3b-cd69-4b79-80bf-ca646b320b7c", "value": 20000000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648563435, "uuid": "cf0cef7d-92e7-465e-82d9-7eef99efbedf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563435, "uuid": "41801271-ca74-499e-bf78-dcdfabadb459", "value": "h63m90m45b_money_slim2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340c152b-af28-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648534774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534774, "uuid": "7a20aad1-4662-4dc2-b4c1-7e3f6b090446", "comment": "Malware payload (AgentTesla)", "value": "68b8c61ae0f641e0350f7605d6ba3357", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534774, "uuid": "112e1903-b063-4b07-9735-161d79356677", "comment": "Malware payload (AgentTesla)", "value": "0642c5187699005775072bd82be543ffa028fa184debcb4055846021d836b3fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534774, "uuid": "6968d02e-08c0-40bd-a0de-b49126b07cb9", "comment": "Malware payload (AgentTesla)", "value": "6a9596846edfdaa6c17d67bc62241e2257eef0e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534774, "uuid": "35c0c810-0824-4819-bd6b-38294d2ff220", "comment": "Malware payload (AgentTesla)", "value": "ab6008c8303174f1e08ef2db749d0c68b4cf8d54f072c6cede1949b625207909baf35b4accff8547c81867d19d9e1575", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534774, "uuid": "a34af052-06d3-4f49-bcf4-cd695bde25a5", "value": "T1FFB423E56C64B33655CCBD6AFE3202792E2E089CC466C532B3F162F6D93A95DC88444F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534774, "uuid": "67aff032-f9e4-41c8-ad5d-53f314cb6186", "value": "12288:xkZ9r6Z9RS1H0csJ1qZ/xlLpcPk9Op/N8D9:+B6Zn+suZ5dRONNk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534774, "uuid": "b20d0c99-5160-4dfb-81e7-4dee5bce6dca", "value": 522720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534774, "uuid": "8d8cec4d-1724-4b55-9989-a9f4f55be924", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534774, "uuid": "0c23593f-7813-4b5f-8855-1dc6d66fe072", "value": "Marketer Global Harvest.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc06e561-af38-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648541928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541928, "uuid": "3561f037-de42-4dcd-b5ad-79571736bcf5", "comment": "Malware payload (AsyncRAT)", "value": "947d1d87caa83fe0eaf0818ce999366d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541928, "uuid": "81369d06-bac7-479d-88b9-4140859c28f8", "comment": "Malware payload (AsyncRAT)", "value": "080eff3ceefca287dc59d176676559ae1aa3f1faec807805114bae214a11f586", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541928, "uuid": "ff45dae0-a37f-46f9-93e4-0c53693d4382", "comment": "Malware payload (AsyncRAT)", "value": "d5cc8db6e945f4b7915d1bd22566886fdc056752", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541928, "uuid": "a2b48c27-90d5-4f14-a4a0-b10d8e62b5ca", "comment": "Malware payload (AsyncRAT)", "value": "2564b80c62697661952facf04891562db3fc016f00c8e0e8f17511f479fa02d6c45d7b4e72bdfeeb199758cfb821684f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541928, "uuid": "dacb4b94-2ea7-4b8b-acdf-c17ff9e1deee", "value": "T1D025E053778A8802CABE57B654EF80004BB57E955633D70D78C837FC0E763825A1A7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541928, "uuid": "27fd2c47-de8c-4c6f-8e34-4a3b27e69a03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541928, "uuid": "c0c2b827-d7ef-410d-9f6a-48cf46e7b287", "value": "24576:vpbjLuCHqwkg4OFsc4neMN4l9LOf852i4D1ENX:1LuCHLkg4S4nxSDLy8Qi4D1ENX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648541928, "uuid": "34912bf4-e0e2-4b17-a1d4-6aab02e59b2c", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648541928, "uuid": "67290dd3-cdbe-419b-9ec9-b2a353adf7c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541928, "uuid": "e8d2408d-76d9-4b10-80e2-1a17a9c0560e", "value": "PO90381.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13df2db-af4e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648551413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551413, "uuid": "50e82220-96d5-4098-8c74-26b81a37430d", "comment": "Malware payload (AgentTesla)", "value": "8cf65b10293a71470520508d102fff6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551413, "uuid": "0b9f2a45-a627-4528-a2c3-174678be56a9", "comment": "Malware payload (AgentTesla)", "value": "08414d720fdfe8dfa2e1a35ac8ff979df7968a1c3d1694ea6220b1e4ea84fe98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551413, "uuid": "b2e41ff5-fe45-451d-af59-c0f58884199e", "comment": "Malware payload (AgentTesla)", "value": "a8b12cd576cc544f6f25675b2ca68f179894fc4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551413, "uuid": "e66c3756-b341-4880-8e49-4dc96b030ce0", "comment": "Malware payload (AgentTesla)", "value": "6a3c203c3ca3413f7d39c8266547968ac8b9a399255a7e62641397178940223425c29ef1495018228e6a48834d0d6f33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551413, "uuid": "c74cae5e-4365-4f4d-9dbc-caf77c9add69", "value": "T109C423C9FD615C6B8C610F75B7FF74A406F2F2DC6FC88036E58C23D92A872541A6162A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551413, "uuid": "490f6803-3253-4bb7-af1d-4155cd3a97e9", "value": "12288:mbpcLoMP/JQkKmVWg/yfG+41qPKPtCt2z4DdZPSjMAC7IYHjTCURf7:AzMP/C0Vpy41QKl22z8nK7YDTCURf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648551413, "uuid": "58b3b20f-5b9a-4a74-bf41-3ab0cb5bef6f", "value": 544526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648551413, "uuid": "633fc810-bbad-462a-b239-5cbd5ad1d13f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551413, "uuid": "413508bc-8092-4f85-a813-98fafe11b91d", "value": "SE PO- 216238068.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9581414c-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648536226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536226, "uuid": "18828ff2-05d1-4e66-a44f-ca422538f239", "comment": "Malware payload (Mirai)", "value": "66c089d034759bfbcfba676ab7f8c785", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536226, "uuid": "7d177e89-0be8-4ccf-b9f4-274572357b0c", "comment": "Malware payload (Mirai)", "value": "0902291bfd4afc1d56756a0f5feea447847437b2e928c108a73d29a3df0cb3ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536226, "uuid": "fb18ad0a-12d2-45fa-96fc-3cee6753e56c", "comment": "Malware payload (Mirai)", "value": "3805f38357df2b82837b661e984b1f9c7206babc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536226, "uuid": "e8fbbccc-2bb9-456d-9fd4-1a09afe16eaf", "comment": "Malware payload (Mirai)", "value": "f8ac0a12334e01047b55b39c356e9af375a44d6fe1f9050ad7079beb1a1455d0cf32d62f8d3c81a6d530fce3f012354c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536226, "uuid": "2d4bb820-76ee-4cf0-ab00-923511d93bf4", "value": "T154F2F178E256B476E533B0F40D6A56E23FEE078C26D6C6127F98E900DDC4732AE249D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536226, "uuid": "0460262f-793c-43cd-a274-68c23bb68396", "value": "768:TUbePnMOf0bDlRq2K2kjfGV5TXmXflMW2P+wnDYFsft1d6N4fl+4uVcqgw0RTWXi:TEoMjD/d1kraiXdM13ZftZl+4u+qgw0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536226, "uuid": "853443dc-2e33-47bb-8029-803689c2e8b1", "value": 36644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536226, "uuid": "2fa7f227-b648-45de-9774-6b22b44349f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536226, "uuid": "9fdee4f5-554d-4efa-a714-237068e699fb", "value": "66c089d034759bfbcfba676ab7f8c785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01af892-af58-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648555598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555598, "uuid": "03918050-c610-49d4-9a3e-b30649347471", "comment": "Malware payload (Heodo)", "value": "59479be235bd2a922947a20cc20c9fa0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555598, "uuid": "2cdef1a9-e544-4053-b166-4a2b0f1ea443", "comment": "Malware payload (Heodo)", "value": "0922ec16b2644c0d36db28a2585d21dca1aad06681138efde1953678da7711c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555598, "uuid": "48d38f9a-0cbe-405a-9622-3300e451af81", "comment": "Malware payload (Heodo)", "value": "509b853aa0272c207a7f04c1cb6abcddf795dcbf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555598, "uuid": "d6de1263-dca7-4df8-a3d1-afe285ef822f", "comment": "Malware payload (Heodo)", "value": "fbfe7f1310f48d5c387feb639e55e86cb8e0d795c55f2907f09da8689c9538d1960fe7976a3f66bb6b192796503d534e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555598, "uuid": "eec0383c-ccca-45fc-9116-0a9480f64620", "value": "T1CFC48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555598, "uuid": "ad674d26-963e-4cd5-91ae-df64e9f6590d", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555598, "uuid": "99201680-fd22-4bcd-8255-7a4c37210593", "value": "12288:iUV7ciwHX3ew9aYU3pqc9inFijaQeL+nZBb:UiMX9IQky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648555598, "uuid": "0d47efc8-3a00-4bdd-a8a7-ce278452a429", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648555598, "uuid": "7b05a206-dd5b-4dcd-8675-b74811cdcb94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555598, "uuid": "50e1303b-26fb-49b7-80c9-e42a66466cfe", "value": "59479be235bd2a922947a20cc20c9fa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa8a166-af6c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648564045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564045, "uuid": "ff6908bb-c42c-4445-8760-154f15bd9c6e", "comment": "Malware payload", "value": "239c1679cd24e48ce6d2c2326042ef38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564045, "uuid": "d72f839a-c822-44df-bc0b-e97f2a8b873d", "comment": "Malware payload", "value": "09e10d6e7d4745804ef69895329fe82ce878d7d5faca934e8e8caf45d0bb54ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564045, "uuid": "e2667fa4-568f-4f0e-831a-774a020a0c33", "comment": "Malware payload", "value": "42cd6d58fb0577ac7ba5326df8fb82e387fa5fd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564045, "uuid": "681c4af9-e602-461f-8afd-16013a498ea4", "comment": "Malware payload", "value": "b010faf4c4cda4fafdab9ce9f9111782e81f8d7fa2810ae5046758b2248ca091907ebbd1d062cec2fb53a0a651e7b62f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564045, "uuid": "117e339a-6d8a-4dd7-9e88-97f67200413e", "value": "T1C035F11637AEDA12C6BE477688EB80004BB97E521537D60D79C933FD0E32382995639F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564045, "uuid": "d50cdd5f-026c-4b03-b3f0-ba0f3396da47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564045, "uuid": "792037d2-ae99-4d61-b60c-ef4de53664cc", "value": "24576:HrUUL8A39v9dnRb5HtCcn1qCoi2TLr5p3a4x+/JtrZPs54/:JL8A39vbBBtCyo9XK429PZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648564045, "uuid": "95497508-a0a1-4db3-8a00-1ee7ad865625", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648564045, "uuid": "2146c960-fbc2-4050-b3af-9e429dec9cce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564045, "uuid": "50b68d35-fcaa-4bc2-a82c-a3450d4da62d", "value": "2022.03.29_83992773299,XLSX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7da044d-af1a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529063, "uuid": "2627e2d6-c0ef-468b-91ba-8a6ec4e9f0c3", "comment": "Malware payload (Stop)", "value": "4324211c63969d501aea99308e01d6d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529063, "uuid": "dfec0dd7-6aa0-471a-a122-322f39e5910f", "comment": "Malware payload (Stop)", "value": "0a04531f67450f23732ef2d41e6ac507ea10cdc39d513f1a379e9b3e0508e4f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529063, "uuid": "565c3ac1-8c51-4515-b929-d48db72d1a3b", "comment": "Malware payload (Stop)", "value": "acf3317a65be1aa51fe330379b80bea0a3bce3ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529063, "uuid": "7fe8bdf4-a61f-415a-aa7f-eaaecaf68424", "comment": "Malware payload (Stop)", "value": "4a88f3f3888b4037407d4498ce88097cac84ba834015a7260c30389d4dcd47612f8ca9c22c051a128e0214ff9f4d891d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529063, "uuid": "a59e487d-f4bc-4311-9a76-37dbd8ba40dc", "value": "T1F4050210BB90C030F5B716F48D7AA3ADB92E79A19F2581CB62D52ADB47342D4EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529063, "uuid": "d957076c-2065-4d92-885e-d438a1c0d68d", "value": "5b781a7e94da324fe985d05bb125d645", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529063, "uuid": "b8700d2f-525c-4c4f-b733-f1faef2e1cb8", "value": "12288:TOj01xwdqrWRKI8zxAnk+her81R1CdCvP/SMat5i/UWJRI58+GuWbMPgNC:f2sE38NGk+hZeKK7tuL+C7fIINC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529063, "uuid": "26ea91a9-49b6-4ea8-8fa7-3c1842b30d7d", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529063, "uuid": "552a2361-6000-4672-ae0f-4f9fa73d97be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529063, "uuid": "8d334f24-3a39-4c52-bcbc-33a04b3e74ae", "value": "0a04531f67450f23732ef2d41e6ac507ea10cdc39d513f1a379e9b3e0508e4f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30b5761-af3e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648544490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544490, "uuid": "08a8a2ec-26c1-438f-bd2b-cb25c3066ab3", "comment": "Malware payload (Formbook)", "value": "52352e2a92e0f413f7d97051580823c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544490, "uuid": "f86860e3-7737-4dd9-ad26-26880c823e7b", "comment": "Malware payload (Formbook)", "value": "0a08e1464585333f5b4cb67d2150a488119fa971a878ad87c277197dbb453b93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544490, "uuid": "9fa7472d-f847-409c-809e-28fc8da4a5b9", "comment": "Malware payload (Formbook)", "value": "e97c2bcedeec4a255e4dc3a2727c0702b368293c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544490, "uuid": "f8dc5ef7-fb80-4ff2-a6d8-40a37b8f6be1", "comment": "Malware payload (Formbook)", "value": "b3442e987074bfcfd26180aa5a595f93a1c9fc76882574b38aac0266239cf6748ef202eadd13e56b625314f10ab06b2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544490, "uuid": "390abb4c-fddf-4876-b9b1-7a6196dcf06b", "value": "T1E9F4C4ADF2F076EFC857D0728EA81C68BA5175AB531F4103A02715ADDA1C987CF14AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544490, "uuid": "deabdcc5-beb5-4eb4-8b43-de890b8dfcb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544490, "uuid": "5be3e9b7-8e9a-4f3b-8086-a2e97487d132", "value": "12288:Ek1OnaiJYCanaBF+hHKKiBDbljZC7UsxKlQJU/7Xv0i9/sZtAeuvaZqdHHgjjkEN:OHHgjjkEve8MPSZCk5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648544490, "uuid": "52bab91f-e189-4d62-bfba-cfa9264c135c", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648544490, "uuid": "ce4dc91f-2715-49ac-a354-6427b7b14946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544490, "uuid": "02c545aa-b690-42cd-9d1d-dd69bdf9fef6", "value": "52352e2a92e0f413f7d97051580823c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4561e451-af29-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648535233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535233, "uuid": "0d355d4a-d199-454b-8bcb-0fa74018c2df", "comment": "Malware payload (RedLineStealer)", "value": "df03371757ca65ad23cfb3087f749a88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535233, "uuid": "abfdd1c5-540c-4629-96ee-64942d58eddc", "comment": "Malware payload (RedLineStealer)", "value": "0bf185fa3d723dce94aeacefc28f763b15687725444b4532ef934d0ac7b90f45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535233, "uuid": "3c232c48-acab-44ed-8349-5472ce893ee2", "comment": "Malware payload (RedLineStealer)", "value": "8a948e8117602368a78436697c083b71b46358e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535233, "uuid": "c15147ee-3f8d-42fb-9407-2e09a10f3368", "comment": "Malware payload (RedLineStealer)", "value": "5d48158907ee7764510fc64c146cf272081ada08228625a404aa5d002b52217001376a998ea2a2b37ac3acaa91bc29b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535233, "uuid": "12f922c3-17ba-4a64-91ce-345948a2d35c", "value": "T110644A2439FA5029F1B3EFA58BE479D6DAAFB7733703A45D1052034B4B13A81DE8153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535233, "uuid": "83974b38-e755-4697-bdc4-9ced480ec3db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535233, "uuid": "164e0d04-b4ab-4ee6-84d0-101ee45f0a11", "value": "6144:9lEXoQWp51U8zOAbBxlHChf1YiLoIyJ+3QIlm:v9QWq8zOANxM7YcoIyJ+gIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648535233, "uuid": "fbfa06b9-06f5-4d4c-adf9-fd012e20382c", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648535233, "uuid": "1c076525-a87d-4bc8-a121-3d4889ae484d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535233, "uuid": "edf89a1b-7e02-4a9d-9368-d1a78794c278", "value": "red1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb01fd7-af31-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648538898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538898, "uuid": "afa42ff1-10b2-4299-82ce-47fb2cca0367", "comment": "Malware payload", "value": "113b508573ab49ce079d4371a4ff8356", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538898, "uuid": "4f7011e7-f320-4162-9a6b-ebcb4d30ac46", "comment": "Malware payload", "value": "0cb598f391d5e4d524ccb2835fa90895198db447bdcacce3ad4e9f1bd52a813f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538898, "uuid": "33c51757-c7a3-402e-8940-9b0c99e2e15c", "comment": "Malware payload", "value": "ce3872f01c68a531bb80395507b16f11274fb8f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538898, "uuid": "750de5fa-8103-4bd2-98e5-7773eef842bc", "comment": "Malware payload", "value": "750c0f46942f1d2b8596e8e4cb339afc6229a1e5eb2e82a8f5b8758fab163b46e43cb21ed9114b07c6af739f84a907d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538898, "uuid": "ed67b576-d23b-451c-a0f6-d272026c4d8d", "value": "T17F5633AB52CE0F6CCB5389F51255AB0CF15D2F8F005B6130D656B8AABC2916560FFE38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538898, "uuid": "1fc89125-6c62-4bbb-a956-15131e9110a0", "value": "31023d5744de3370464ffe7b77a57d1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538898, "uuid": "2f6b2304-2c1b-4057-97fc-0bb1317a05e4", "value": "196608:LHF3rgAAosQJdKNRLTK/tKyDlO96K8bog:VNsQmHK/cJgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538898, "uuid": "a25baeb4-c3e6-400a-907c-33cf1f91ab38", "value": 6367794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538898, "uuid": "bf6e6f53-8baa-423d-a7bd-4c0544bb29b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538898, "uuid": "936e0784-ae15-4c30-b588-7fce408e0942", "value": "113b508573ab49ce079d4371a4ff8356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a884aa-af2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648536762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536762, "uuid": "e3c709ec-60dd-4e4b-bfb0-03632cd6e5ab", "comment": "Malware payload (Loki)", "value": "d199ff83bf9d0be6a74158c2b0d78ccc", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536762, "uuid": "9b59228c-6fb0-4f03-9320-12d976dbe9a0", "comment": "Malware payload (Loki)", "value": "0cd6a26152a6b364694df0eb2c36e85ecd6fbd46a38c1b3bc9582e576fb4a40e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536762, "uuid": "70293867-7aaf-49d8-a35c-7a56ab91a4da", "comment": "Malware payload (Loki)", "value": "ae0259c5d8c59ce3408e691ab394e1a354f1e1bd", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536762, "uuid": "81be7c5a-58e9-4552-bf9e-7b9d79dfe4f1", "comment": "Malware payload (Loki)", "value": "42d4e17713339ebabebbd27791abf81883805a950a88a5f6f14ce2e9f2b22aa321ec122ae447363858aa22edfba60bb1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536762, "uuid": "805c29c3-cd66-46c8-8472-33854b2060ae", "value": "T1D41402EB29FA88D5E5A257708B37A3E406C1CFB7A193F58E32F5720A11B1D42570EB14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536762, "uuid": "31304baf-db5d-4eb0-9975-7faf8f9de6b1", "value": "3072:pLZGABhb6ynO5OQWK8hsuvUe+6LbNEHpeG/42QKBSmoJkLJPsE+F7iEMJB+oqa:9QABhHWGBLB6hgHMJekLCE+wJcoqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536762, "uuid": "453fee03-235e-48f8-b23d-35ed5a7ded2b", "value": 193640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536762, "uuid": "c3eaa8cf-749e-436c-b6f8-0259f9d786ea", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536762, "uuid": "db2c2b5b-20e4-438c-ae3b-758c2b39f165", "value": "MV MEGA SEA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e5dfa8-af33-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1648539535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539535, "uuid": "43b3fd20-db2b-4e78-b962-35889c952c8f", "comment": "Malware payload (AZORult)", "value": "777a6c80c57815c6cc36b88a800dbf9b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539535, "uuid": "170821eb-63eb-4f02-a175-521f01f58ba5", "comment": "Malware payload (AZORult)", "value": "0cfed7414451e0cbb7cdcd1cbaab3f3b234f90609ed4c1b555395265944f6ede", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539535, "uuid": "48b5ac19-021b-479a-a3c2-cf06c905685d", "comment": "Malware payload (AZORult)", "value": "bb045c66e142bcbcfd9a76b44d9346d095515c3f", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539535, "uuid": "0fcb1376-8418-470a-85fd-e5d86ca680bb", "comment": "Malware payload (AZORult)", "value": "75b40b6354a39cbb8623cd8838befe172dcfb499bc0189ae4f9d7b6c98f3877e6fc4e0c32b3ff44a46ea07f45f04d156", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539535, "uuid": "0424c35d-2250-4099-9f39-a1ca40473307", "value": "T10A51319D744B75A45B236FBADD1F144EC5331393A27446943A16CEC9CE3A06CD28A81E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539535, "uuid": "46f156a1-955d-4ebf-b81b-3a8db9231638", "value": "48:7VkpVko2bOStxJ51rSR0yfWVHRpIwG/KPD90BdisbO:7zoy5J51rSRg53G/SJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648539535, "uuid": "9914e040-31a6-4096-ad52-0e61f1bc037b", "value": 2724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648539535, "uuid": "528d5d86-a130-46cf-840c-9daa2edfb9ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539535, "uuid": "6fd50cb1-0992-4cc4-8fa6-89104521df83", "value": "nuevo pedidopdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6bf10b-af66-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648561736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561736, "uuid": "71dcf5f8-40b4-4f2c-b4e5-7c0458438589", "comment": "Malware payload (Mirai)", "value": "c48ac77e9bd5c8a7749587c1e4213c3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561736, "uuid": "e77763c9-fdc6-41d5-941c-8eff1738c627", "comment": "Malware payload (Mirai)", "value": "0d44adba55276e9bcd37a6ed6fd4983559d64e36a2fd0c9cd71cadc95cf3c976", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561736, "uuid": "5981f9c3-8d53-4b28-a5b6-073430c1362a", "comment": "Malware payload (Mirai)", "value": "bf00015cf97a22502b7196b4783ca1496cef1205", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561736, "uuid": "31f35d14-8fc2-4b42-9c13-034811ada90b", "comment": "Malware payload (Mirai)", "value": "e8178664c9d67a8d63879579ebc7728e6a3e58f1f6156256e5a827165873bb215ccb22880205eaa80211f63258619f78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561736, "uuid": "6cdccf28-9f9d-416d-b6d4-802db206f9ba", "value": "T106B2E118441A351EC322B4B7A29E103730116C97ECC529BB39B6DBAC4D9FE5637634E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561736, "uuid": "c915eb95-c8e8-4cc1-b512-c9f9afbd7c6d", "value": "768:A/0gumcETfRidZudWLTKIR99OOBx+/16jr:A/0vmtTfycW/B46L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561736, "uuid": "1a7d4fb9-55f7-477f-8a1a-600ac54793d4", "value": 25368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561736, "uuid": "d4182a42-32dd-4b3b-ae01-b69cd17134a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561736, "uuid": "06ff7fe7-25d0-48eb-b3a1-f913757f97c0", "value": "c48ac77e9bd5c8a7749587c1e4213c3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0981d05f-af57-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648554889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554889, "uuid": "b85ae152-9abe-4108-a147-cd251f1b4dd1", "comment": "Malware payload (Heodo)", "value": "b56cb97b72dfca38262cdeb0107b65e7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554889, "uuid": "cfa8efb0-ee05-4f1e-8f54-808135c35018", "comment": "Malware payload (Heodo)", "value": "0d63b2653502ee13703d806f52a66b05e86768985be197a636d8090612b3b7ed", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554889, "uuid": "964edd49-9766-4a2a-9e1a-665b2009cf82", "comment": "Malware payload (Heodo)", "value": "ea65337b8b77616b8e116eb5af77fb9b32d60e7e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554889, "uuid": "d6c98d39-5ee1-4571-9a83-45f2e70d9cd9", "comment": "Malware payload (Heodo)", "value": "5d9e10a217ef876080fec789a6a0ebd6d8422308c5453403c0a929c77767afc697a3b8e8ffd11c9319940c6bfbc0df4e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554889, "uuid": "cad8b5bf-7733-449f-b8ac-31cfa907dcbd", "value": "T1DAC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554889, "uuid": "8045a213-e0e4-4e39-a883-fe5c78ca12cb", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCs:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554889, "uuid": "60f7adc6-4bbc-41a9-822f-da29eb701e06", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554889, "uuid": "573bb5b2-4b7a-418f-a44c-a5f72d41edae", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554889, "uuid": "7e25e5f6-42b2-417b-a727-5cea5880af80", "value": "Transfer info_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51942fbd-afa2-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648587222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587222, "uuid": "9f9cd8cc-db65-4652-99bb-2e2b1e9258d4", "comment": "Malware payload (SilentBuilder)", "value": "29e067bc8fc1b7218d2c169eb104fbed", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587222, "uuid": "5f0ae74d-6f54-47e3-8fd6-f283c55aa32d", "comment": "Malware payload (SilentBuilder)", "value": "0dca383a7c005e49bfe63645a4b6bbacc67d2d55c78fe74382391a09a747ae1d", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587222, "uuid": "fd9163db-08e1-49c0-acb8-c0ef5e091486", "comment": "Malware payload (SilentBuilder)", "value": "69b19dcfd51c70beb806b83be59cc9729e990e28", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587222, "uuid": "829f060c-9249-47c9-9020-fdbe39d8db08", "comment": "Malware payload (SilentBuilder)", "value": "41e436a7c1de859bc407b28d9ba453c1d1bcaa78a3b02d37439233ac74aa4976de331672d40c140000c9f68b80cf5d97", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587222, "uuid": "97004ccf-49b2-4b73-9234-4dd3629d208c", "value": "T1F6B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587222, "uuid": "8914ab1e-40b7-41e7-b05f-72e19e792a39", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMO:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648587222, "uuid": "17494c2d-8e12-485b-b5bc-0c680b756bed", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648587222, "uuid": "c9a38bc6-803f-440a-8da2-e790532e1b47", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587222, "uuid": "394fc17e-1c52-4ba6-bd09-7eb14864df18", "value": "29e067bc8fc1b7218d2c169eb104fbed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141daec8-af5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648557484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557484, "uuid": "ba027b58-b4aa-494b-8172-a754c0e70cce", "comment": "Malware payload (SilentBuilder)", "value": "9e3ff83b3d7e5e6269e5f49a2b8bf826", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557484, "uuid": "39ee857b-6a58-453e-98d6-15c0680f59b9", "comment": "Malware payload (SilentBuilder)", "value": "0e1412e13109cf3daf6d5af2a6cbcb27a390d04e75716231da14f98bf705945c", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557484, "uuid": "b5a1b273-8531-473c-a934-f8ad30e8bfdf", "comment": "Malware payload (SilentBuilder)", "value": "0e8030415f21d4915c35521bb29ec70e9f13c8bf", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557484, "uuid": "05d1ddd0-2a59-47ce-b358-a16c0ca32dcc", "comment": "Malware payload (SilentBuilder)", "value": "b45ad324fa019892c079ada4e340e3015086dae9c77b15fa282d9f1c067859174b93f42390228e293f77b13eda608c39", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557484, "uuid": "0a1a89ec-a01d-47e5-b5ce-42ddd8bf0f7b", "value": "T1EBC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557484, "uuid": "97c143d6-602a-43f2-8076-d220487adfa0", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC8:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648557484, "uuid": "0c53d394-4819-445a-a44a-5d2d0b39cc01", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648557484, "uuid": "7eb2c97f-e7c2-4be7-85e3-6285de1a8003", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557484, "uuid": "4bc6a8d2-34a2-4bbc-90d5-38da0a32091d", "value": "SA-6843 report_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e18e30b-af6e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648564990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564990, "uuid": "65ed09a9-c275-4891-9b76-22be8759b747", "comment": "Malware payload", "value": "0b33a10c0b286c6ffa1d45b261d8a338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564990, "uuid": "949930d7-7c2c-4fba-86bd-1bff9af5ad72", "comment": "Malware payload", "value": "0e6b6b2949d36f3a8357e3d1ca44d81cd9e866647555b5465c2947a0ff7c4097", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564990, "uuid": "956fead6-cc9d-40a7-be30-8a4f07c8c4ce", "comment": "Malware payload", "value": "bc926594f333f052630781f2530d438a8be0d6cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564990, "uuid": "a377b1eb-2691-49c2-a61f-ef650b5c5b50", "comment": "Malware payload", "value": "7b6bf2322baf759c420048d52949fdaab8f4371dea5c19322c0f53902e6cdf018d9ba59bd9d9e1ddddc2bd7087182372", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564990, "uuid": "2a08cb85-2945-4c71-a78f-2abb1ede3a4c", "value": "T12B837D02F5D180B1E873063248BD9E5246BEFD291B71DD277798068F4DB50D19A3ABB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564990, "uuid": "3131eae4-40af-459c-968f-da7223e0d18d", "value": "1463807fca8295dd9048a39c3ab6ad5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564990, "uuid": "0b05cf50-ec65-4ecd-9af7-652bfa42956a", "value": "1536:SQ/UHJoIebjqvRPWGOs1xaj6kxe9Mc5eksWjcdns7p:SBJMkpt1kceLnsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648564990, "uuid": "ac74d3c5-788a-4236-a5ad-43db896f36b1", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648564990, "uuid": "53e727fc-545c-4caf-9447-7b2f2e480c76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564990, "uuid": "a27be0d4-6a67-4609-9fc2-15526f0ea52d", "value": "0b33a10c0b286c6ffa1d45b261d8a338", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65fa59d8-af26-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648533999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533999, "uuid": "9cd80cb6-4e68-4594-a4cc-9c230948bb68", "comment": "Malware payload", "value": "f69e618351fe745d1ca75d7509a23d5d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533999, "uuid": "fd951e6e-75fc-4228-8f0f-70445c70634d", "comment": "Malware payload", "value": "0ef26e8d7f2b9108282f7fb70e8e9273d7755907ea841d7fff937d64a37df791", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533999, "uuid": "6c36c4c0-4510-4af2-9bde-b64068d10534", "comment": "Malware payload", "value": "24cfdc58dcef6e9ffe6946ff0bd185f6f9d55127", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533999, "uuid": "1fc1c3d1-0022-4ebc-8082-e82a22e9af0f", "comment": "Malware payload", "value": "0a73c1837934f807363421b8ad8abb42bbf3ac910cca2abf126ed2628034b082e5e28aceb85ab15e9733615a49d0aa81", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533999, "uuid": "a90c702f-656e-435b-83e6-6fb9028cfd5d", "value": "T1A5158C423BC4C0B7D36211735A93A25E63A2BD248F318AC76BD41BADDE345C2BB76344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533999, "uuid": "26c39898-b27f-491c-b865-462a730c7d7b", "value": "78a3c307bcdb5955fefde2169f849777", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533999, "uuid": "478aaa6c-bd68-4961-838f-f65ee14b15dc", "value": "12288:O/J+NC0xu2rPcHKeNmcZvF/SZGYzZ5Q/a:0J8R6mcVF/mGY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533999, "uuid": "78c7b287-8328-4230-97c3-fc2ede74017a", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533999, "uuid": "7c240ec1-5b0e-4c94-bfd3-dd8f18cb946c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533999, "uuid": "df781acf-d44e-441c-9125-1cfb92f1bfee", "value": "g89uarj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93f03a7-af2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1648536689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536689, "uuid": "e5fdf734-0e59-4a18-8c2f-ce7b7eed1429", "comment": "Malware payload (BitRAT)", "value": "ae7ccd86e12da971c8c10089214d55f1", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536689, "uuid": "762e94a1-08cf-4220-8b4e-630ad1c09524", "comment": "Malware payload (BitRAT)", "value": "0f4afd8a769fb12de45c789baba15308619ca700c05afaf2c28c4f75dd3bdaca", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536689, "uuid": "89c0d615-d424-4dca-9e3f-46e7839be323", "comment": "Malware payload (BitRAT)", "value": "9d596b0087e3b0f16ab3915d3b8c3a1085492927", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536689, "uuid": "aa1f5806-7d2e-4ad2-981d-212276eeef92", "comment": "Malware payload (BitRAT)", "value": "64c4684446519ab67e51ef343bbdb7bfb93f46b17edc586ff1ee9f2cc6db34fbc5e017ac4de2fa97ef3ba1ab124e18ae", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536689, "uuid": "28b24d92-5028-43df-b8d7-df385d6b9415", "value": "T16D64B426D682C0CAFBF23D78512CA1B4B74EC980DB676608F59D3B89F678D913854D83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536689, "uuid": "7567345c-4af3-446f-825a-1ab07a812478", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536689, "uuid": "1f58dca8-98bb-403b-966f-1d767650943c", "value": "3072:GbnD6pFFFFFFFFFFFFjFFFFFFFFFFFF7Fz9LFjuFFFFFFFFFFFFFFaFFFFFFFFFl:GbI9LFjqbh5Lh5f2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536689, "uuid": "187860f0-dcc8-4423-a8b0-b674972cf23c", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536689, "uuid": "68ff9802-efaa-49a1-a15a-5456646b894c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536689, "uuid": "bbdf752d-7516-425f-a25f-cea78ca6fa85", "value": "ae7ccd86e12da971c8c10089214d55f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f753b564-af27-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648534672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534672, "uuid": "157163dc-1dfd-47f4-b80c-d2f49c0ebd9f", "comment": "Malware payload (Loki)", "value": "6b348f9bfa46990cff38dfe9ba3adbda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534672, "uuid": "b0f16da4-d840-49e9-9fe8-f7aebf3cdd9d", "comment": "Malware payload (Loki)", "value": "1022465d4d09527fd8713111a11ab5810d87d79bf988187e0db0cfc4f8571023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534672, "uuid": "9e51460d-f321-43ed-b8f1-abafa25146f9", "comment": "Malware payload (Loki)", "value": "8a17622970775aeb9ce16af601210076901598dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534672, "uuid": "4be9fc78-fd6a-4636-bf26-aeb530c01bba", "comment": "Malware payload (Loki)", "value": "62354b757b61070255eac4997178eb9e94689fac953e346801d64bb68ff8c6f7a7f667be17337197e34aa01911f30be1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534672, "uuid": "8842a803-7513-4e9a-a83c-2e175bbe733f", "value": "T16334121430B1C077D8F206301DFE2E66ABE6B6222764859F27606FCD7A323D1EA1E355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534672, "uuid": "1483e980-6878-4e4b-aaa4-dab2d8312e92", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534672, "uuid": "ad09a358-79fb-4924-9d91-f57fb6b457ee", "value": "6144:HNeZm69FuneOlD+SvvUIkRDJgUkMKHt0WK1Qn:HNlxFSSvvUIktiMKN0WKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534672, "uuid": "2c703c35-a1c7-445d-94aa-fa53cdf5b1c2", "value": 239924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534672, "uuid": "34db0336-f8e0-4f6c-86a2-9ddc38d0a329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534672, "uuid": "7849c13b-1fd9-4b81-9cf5-a08e4128bfa7", "value": "PO# P104634795 R013358001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4fcc08-af2f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648538014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538014, "uuid": "9623f97a-f31f-448f-9776-3eb3f1f790cc", "comment": "Malware payload", "value": "9ad7440ca947836e43f9d3f145c66cd9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538014, "uuid": "446534fd-f7fa-40e5-bf18-11a79ceef559", "comment": "Malware payload", "value": "10739e10ade7c613243c067f5e516c1f9bd8d9402c8508e1726c76d902cac5cd", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538014, "uuid": "598d7aa8-a61c-4289-92c1-5fb25fc5e491", "comment": "Malware payload", "value": "dddcab5442eeb8ab5702c5ac67e3b9a524da274d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538014, "uuid": "661f5cb7-caf6-4d6a-b480-6650b90268e2", "comment": "Malware payload", "value": "1139c8661c4f6b79e9a224f30697bdbcb628c0ad5c679be572659181ca801e774c1ecc1116b3c9bf32853e24f312d708", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538014, "uuid": "0ac16618-6a2b-4e3b-a76f-b4410ae58f81", "value": "T10D466B23B284663ED46F0A3E8637EA149D3F7B6279128C5667F04C8C8F39481767B647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538014, "uuid": "bdd3ffa9-629e-47fe-8539-1183a37e37c6", "value": "49152:KJxFTBT1ptv3ycUZISFzBPhGYBF5hhMYU4uMlGpVneXgEMdY3MG9TqVwjaqbi39i:4FTBTPb85hhMpTVeXOGmcaqcOY3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538014, "uuid": "3bb9c8ba-711c-4f02-bd21-13b8f0551d77", "value": 5365248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538014, "uuid": "cdf7354c-dc8b-49ba-be46-8d214ac56eaa", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538014, "uuid": "af6b2359-ac95-4ee6-93c7-423fad259daf", "value": "_^^ysgt.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e854121-af30-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1648538228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538228, "uuid": "57e4d5f6-a7a7-4fe9-a7b1-25e28c431b8b", "comment": "Malware payload (ArkeiStealer)", "value": "1b28a890f243870fe2292db97e0dc6a8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538228, "uuid": "3e59023a-c771-41dc-9446-f5c2680edae7", "comment": "Malware payload (ArkeiStealer)", "value": "11587581475665ef687e599105d575955833613e6e57d3d120aead70cddb0918", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538228, "uuid": "ce063e73-ed52-4194-b17a-5cad3884d087", "comment": "Malware payload (ArkeiStealer)", "value": "d8b96c8545b34e29e371a189694ceb0d3757ac28", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538228, "uuid": "bfb43d37-b03d-4ec9-aede-e0530049dded", "comment": "Malware payload (ArkeiStealer)", "value": "b9456de21aa3361238ae3a5ab992aed88f7d1ea0c1f6b1086bbbee8799a0432fb060fc8f1ef450a960fae5e152d7f349", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538228, "uuid": "7db8a158-56fc-4356-9008-03aaaabab247", "value": "T12AD4E010B690D039F5B716F0587AD3A8792ABDA15B2591CB23C56BEF5238BE1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538228, "uuid": "66b520d0-8e5a-479c-a63c-90d51ab8aec2", "value": "699070d0802ac292c6d967d0195e7ff3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538228, "uuid": "de19ef9d-9632-48af-8c5e-138713a2bed9", "value": "12288:QYR5FKXNTD0ZDOGJivgdrvEY2VBEN7AXlSvpqDFo:QWFyDMiGEFEHvpaFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538228, "uuid": "6849b77d-8d00-4d34-98ac-9f783b0c6457", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538228, "uuid": "a16fb4f3-9f49-425e-9318-d48007e0c487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538228, "uuid": "2ade90ce-6736-4e57-8062-980ca877622e", "value": "1b28a890f243870fe2292db97e0dc6a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05333340-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648561754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561754, "uuid": "e328e710-7292-42a1-a931-08da67eaef28", "comment": "Malware payload (Mirai)", "value": "b64cc00cbe5b60142c9b470a443b026f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561754, "uuid": "de5c86e7-1f0c-4a4d-8f52-fa99e80b3088", "comment": "Malware payload (Mirai)", "value": "12112670d33b0cf62b1deafec59ce6bbb60083ade14e02a31b611db0692ca1e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561754, "uuid": "c4a98223-5045-445a-add7-52d7e2a556c3", "comment": "Malware payload (Mirai)", "value": "ba8c126d50292d0c40e46a8f666d90e4f7d5d2bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561754, "uuid": "0483dcfa-715b-437c-8699-ca4d83c1c150", "comment": "Malware payload (Mirai)", "value": "a173b366faa623382873dba4306586bb38be8531d5c17a3f463a5c143524265604491275011251acd1ece0e6262bf666", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561754, "uuid": "338a72c8-4670-4af4-9275-90de20233219", "value": "T192D2E04EB4084214D2657532579FC70C88BA36AE9B306F4EA39A4D6F50D234A1E3EDCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561754, "uuid": "d3c76c17-7f39-4e22-8f23-4997f73aa2b0", "value": "768:KvW9NOjnGX22n8E7gpJ1Xl94PdPra2Z7sBDy+w/ao9rgO:8WCbGX228EkliX+Be+oao1gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561754, "uuid": "7e63cb46-d829-476d-b7a5-d1da1d85f7b5", "value": 31104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561754, "uuid": "ea3a5444-7e00-4ecc-98a8-ef31b9ef72bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561754, "uuid": "5b118cc2-8e32-4eb7-a90e-1d14941876ad", "value": "b64cc00cbe5b60142c9b470a443b026f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a30134-afae-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648592432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592432, "uuid": "8015aa9a-a6e0-477e-851f-f5838631c9ec", "comment": "Malware payload (SilentBuilder)", "value": "f7d40c817363aa69f6bb6e61385ad80a", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592432, "uuid": "5c1bf964-a7c7-44c8-9a5a-4648a0c4a78e", "comment": "Malware payload (SilentBuilder)", "value": "128f6a72de574b87f0371942fb8483185ac96a6c601d88a99f8fd017bc4b182d", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592432, "uuid": "e68e06c9-e842-45f0-801d-34f6a6dfa622", "comment": "Malware payload (SilentBuilder)", "value": "330b237d7f52e661ff5d8f673325d0fcfa21c1aa", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592432, "uuid": "d375303c-ce6f-46be-a2f8-ac101b619ca7", "comment": "Malware payload (SilentBuilder)", "value": "0ce71c1943940db485a46b75218cafd2cbc4b4d66bbad9152fddad8033757bfdd07f06fbc5c565c4ba3cb5685d9acd32", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592432, "uuid": "509eae5a-2351-486a-8dc9-121ff02acc76", "value": "T131B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592432, "uuid": "2b769fa6-246b-46ae-ad80-440eb654c375", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsM+:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648592432, "uuid": "97aa1c97-5c78-4a8c-ad90-bdc0ea5a0a20", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648592432, "uuid": "28a74c23-33f8-4fba-9690-f7dcb7dfcf2c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592432, "uuid": "eee710d3-f0f1-4b2a-b74d-8cd285646b5c", "value": "f7d40c817363aa69f6bb6e61385ad80a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27ce745-af56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648554743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554743, "uuid": "b613f331-7e64-4f0b-9af1-0a0fcce2438b", "comment": "Malware payload (SilentBuilder)", "value": "b44af3cf8e30df574ad7adfc5d1675f3", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554743, "uuid": "1c665cfb-85c8-4d90-81e9-af2a676f9bbb", "comment": "Malware payload (SilentBuilder)", "value": "135c9b87b29ac48e7217e75ff57f2a5c3b51abb3231a86c7549dbe994760c8c7", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554743, "uuid": "add5f175-d6ec-464a-9f6e-26152ee59c40", "comment": "Malware payload (SilentBuilder)", "value": "a86a163740188f48e135ed7357534ba62e7ae4a2", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554743, "uuid": "d474dd33-3040-471e-9249-dc1ef06eb254", "comment": "Malware payload (SilentBuilder)", "value": "00b589a2defbdee47e29af97d3fff12bbe15f8abeff623ef86315dc0daf01599d2f7b5aa36fda225eb45f0a266a98628", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554743, "uuid": "4c8f47a9-3716-49a4-b5f4-e5566cc9fcbb", "value": "T12AC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554743, "uuid": "5ebef134-565f-4c06-b907-24b7e90d3c2b", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC8:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554743, "uuid": "be303df9-e6b4-4aae-bee2-72d5c14446f4", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554743, "uuid": "55a89c04-e8f7-4081-997a-13dc04bc4ff3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554743, "uuid": "4651fdea-9d93-48dd-99ce-977c3402e9e6", "value": "b44af3cf8e30df574ad7adfc5d1675f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7198aa-af31-11ec-8e58-42010a9c0032", "comment": "Malware payload (LoaderBot)", "timestamp": 1648538901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538901, "uuid": "3fd4a3a3-4a6d-4d67-9414-317d5f6ffeb5", "comment": "Malware payload (LoaderBot)", "value": "3bba9e271c496801e281bf968bf77ee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538901, "uuid": "24bae13e-e870-4112-9947-bb3298dc199f", "comment": "Malware payload (LoaderBot)", "value": "13684bae5dce6207995b4dbd719c65e9eab8d831e083aeaa27fbf9e857dc346e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538901, "uuid": "d5a227d1-48d8-42b0-bac2-b3492533324b", "comment": "Malware payload (LoaderBot)", "value": "03ca0271e7ca4adb1e472f951fa7e85724369607", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538901, "uuid": "b0e8db2a-40ba-486d-beb0-100546a3756e", "comment": "Malware payload (LoaderBot)", "value": "031862882915ce51924f6dace54eccfdbe48949fce753123c05df4971d51d9df50b5aed3a70c668320afb17f5418d866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538901, "uuid": "285ca92d-8d55-4260-ba0d-ab563eb82ce3", "value": "T19406AD02BFD58F2BC5564B388AE783647379DC904B43575BA34AB1293DB23E42B871D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538901, "uuid": "5ff4374f-99c3-49ff-b59b-f16b82bad2c4", "value": "49152:kHNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC:ktzP88fBsnZTgOtqB3m1RC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538901, "uuid": "3656c2bb-beec-47b1-93b7-cce021032feb", "value": 3984633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538901, "uuid": "c0c45d2b-399a-4bae-99fe-49ad49724cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538901, "uuid": "0f310968-79be-4809-856a-d1e4a42731d2", "value": "3bba9e271c496801e281bf968bf77ee8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b31330-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648561856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561856, "uuid": "3e808013-684a-44e3-8776-0574ca79f1c0", "comment": "Malware payload (SilentBuilder)", "value": "14bd7e307429a6142bd40cc2f1003010", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561856, "uuid": "11108852-011a-4bbe-a084-210a74ce1b12", "comment": "Malware payload (SilentBuilder)", "value": "14c8a6301eecdf81c86c943ec60004581163d093e32ff6acefc2d600b5064a81", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561856, "uuid": "c86ad7d4-8d12-4500-b52e-bc51ce9fc632", "comment": "Malware payload (SilentBuilder)", "value": "7246857ca8dc9c725fbe77a34d6cda1b7de926b9", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561856, "uuid": "90d263f9-5904-45b5-a7c3-50425d966e07", "comment": "Malware payload (SilentBuilder)", "value": "b018fcda9ab920630f9023419cbeb908daca6d133803a3dd8e6380ad055c7581ff3f4d970d9c85be27935890bbf3d025", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561856, "uuid": "b86b8c79-605f-4ef6-bee8-6686d5680a7b", "value": "T130C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561856, "uuid": "ad5be1aa-8943-4277-8130-cec7c93785cb", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCI:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561856, "uuid": "c27ea37b-edb3-4f60-baa8-b267054268e4", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561856, "uuid": "af700e48-3e84-4352-9aa5-1ecf9e0e4bf4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561856, "uuid": "954182ae-cbbd-41c8-b12c-eba0b965c918", "value": "SecuriteInfo.com.Heur.12814.30331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd765cc1-af56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648554869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554869, "uuid": "391d2097-0894-46fb-85fe-6163249c9726", "comment": "Malware payload (Heodo)", "value": "38623cf1a9bdbc2a6408bf07b7c65f38", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554869, "uuid": "4680a83d-b814-4bdc-9475-48cd47f390a4", "comment": "Malware payload (Heodo)", "value": "14e8db56fca9ef89953aa6a21f61ebbccfe2782c5fdd241c5ad63eecc3c4279e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554869, "uuid": "67e573f0-9dc9-4055-b153-6fb86a1b05ac", "comment": "Malware payload (Heodo)", "value": "fb4ca39b161f6808beb92484f783b069facf8f65", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554869, "uuid": "c2f1a061-b19d-4c86-a2e4-230c81866b3d", "comment": "Malware payload (Heodo)", "value": "2fec7aa5c0865f52a3d7205cf97f757830ffdf370624e9f0b2b6eee3cb4bc24804b6ad83a9fa227a5d739bab59331afd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554869, "uuid": "04f8b9bd-2b8f-472b-93fb-37fb091c3500", "value": "T1A1C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554869, "uuid": "008913e2-fccf-431b-9163-b6dd6868ba9c", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCI:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554869, "uuid": "68b3b9d0-22a9-40fe-9439-4fc188fc2a50", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554869, "uuid": "3355f7bd-ded0-4df7-bb7b-89b91bad3039", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554869, "uuid": "f3a28948-68db-43ba-913e-1bf114cdac12", "value": "Insight Medical Publishing_2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60d72f8-af56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648554857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554857, "uuid": "ea818f2b-a8d6-4bbc-b69f-60b1e58a88ce", "comment": "Malware payload (SilentBuilder)", "value": "6be95217b1f1a1afec30728c2126ea4b", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554857, "uuid": "cc715444-f1d8-4f17-bab4-3ad433df4907", "comment": "Malware payload (SilentBuilder)", "value": "1536a3478353151aa7c8890864b43e755ae10ee6076d47d004366527cbfb5bfa", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554857, "uuid": "46068aa6-2cc9-476c-a08c-a5c05cb35881", "comment": "Malware payload (SilentBuilder)", "value": "d200d9c3c6ea27f7e709f98e3bd16ab9d40fa817", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554857, "uuid": "fd65eafe-20cd-4d0d-9b29-2d19ef5fd61e", "comment": "Malware payload (SilentBuilder)", "value": "772d0341f69098efc29c83590ac13f91039f55290d5f0538f863bd127f5b489d65802cd15cbc7a3d8140a6dbaae8c132", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554857, "uuid": "199724fc-edfe-4443-9f48-c54d58748e1d", "value": "T1F9C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554857, "uuid": "20c0a40b-1d87-4d7a-b814-be6bcbd37bc6", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCM:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554857, "uuid": "39d0d7c4-c0a4-4008-bcb0-b87aad39dd22", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554857, "uuid": "9d676190-d856-4d39-84d5-cbe3ea47e03b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554857, "uuid": "6d2d2826-552b-4553-972a-e9aa480e5963", "value": "Change of Address, NY.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc6c95d-af96-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648582060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582060, "uuid": "71c6cfe3-3e37-4314-b769-dea3ed10f0d8", "comment": "Malware payload (SilentBuilder)", "value": "4da088bbf0f72df342fd9350c9af78c8", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582060, "uuid": "fe54e41f-5cc8-459a-a755-93d996811e0e", "comment": "Malware payload (SilentBuilder)", "value": "156f09d75f7a1624cd6e8afb1b18294b2d75aa07453ca84841b257c0a056e76f", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582060, "uuid": "285f7e08-8b21-4d73-828e-8b3eafacbf38", "comment": "Malware payload (SilentBuilder)", "value": "5e1f6f6f6960d499d8b11a8396b6fe44708ed1df", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582060, "uuid": "8e00bc2e-c747-4b91-9339-a120420c01ac", "comment": "Malware payload (SilentBuilder)", "value": "0b668f1c4321328b9bc969956a9ad79d947587165a93d650ee11e68e7972b34d7d4aa33e56817af104fe45e68a7d85d9", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582060, "uuid": "aa4decd3-225a-45a6-9231-ce1db4abfad5", "value": "T115B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582060, "uuid": "3c5170cf-40dc-4b05-ba50-2d1cc4e6669d", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMx:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648582060, "uuid": "eeb575cc-0a21-4581-aaef-21497196439d", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648582060, "uuid": "8ce3c43e-7b84-4d4b-b946-28e5ba14a630", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582060, "uuid": "f0b1b591-c14f-4c70-820a-24466ac67602", "value": "4da088bbf0f72df342fd9350c9af78c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026592d1-af57-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648554877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554877, "uuid": "22d0874d-2430-4720-9b3a-b0e7c11b716f", "comment": "Malware payload (SilentBuilder)", "value": "a5a2760fcff175a205c4aaeafee092f0", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554877, "uuid": "14d1e06b-baed-40cb-8edd-05c7e0d7d2be", "comment": "Malware payload (SilentBuilder)", "value": "15dd2ea75c5a907a440ffa86ad649c1f86a187606f0fa35c2f13830b72bb1237", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554877, "uuid": "dcbf5d7f-7147-4944-b5b4-2598345dce67", "comment": "Malware payload (SilentBuilder)", "value": "feac764da054d8856769bf48d8d14ad74e39cca9", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554877, "uuid": "ba04b929-9c7f-4ce4-b33b-1fe96049ddca", "comment": "Malware payload (SilentBuilder)", "value": "d15376aa1b186858e6bf282443287a47d034de423d381e24193a623f6d46520dd18c26d6f957dca36ceb446f9f03b9a4", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554877, "uuid": "3a407ce7-d362-45cc-a454-d0bfc05fde73", "value": "T16FC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554877, "uuid": "ee1b5417-adc0-484f-bdd2-d6511d1527d0", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCM:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554877, "uuid": "9b38d985-5171-4ea6-9b65-f65502d32ae6", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554877, "uuid": "4afe3626-8dc0-425d-b3b0-b52285371bc8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554877, "uuid": "cb99ac45-03fa-4116-9c75-fd5db558bd94", "value": "OMICS Group.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fc1b47-afa9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648590183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590183, "uuid": "ee54f19d-646b-481c-905a-9599457a8c2a", "comment": "Malware payload (SilentBuilder)", "value": "41cda50995cb9810a289b0ceb51f4a81", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590183, "uuid": "929282db-5ca3-4542-91c6-64dc3ef25c1a", "comment": "Malware payload (SilentBuilder)", "value": "16052f1099f0c7f1bc76d0ae8f4d850c1b6803d731c526c0e6f3fd5c8965287e", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590183, "uuid": "5e131ea2-b164-4961-9500-e8cb3b8f28d3", "comment": "Malware payload (SilentBuilder)", "value": "b4712436931a7a64df91d1e5c270a6754c35b47e", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590183, "uuid": "3ec04c6a-266b-430f-83f8-70f03cf6628e", "comment": "Malware payload (SilentBuilder)", "value": "9978dd73f973ad1bbb2afb8d895502178b13513410dc95aed524fb208aad9d1e37168e6044458fa66b90d7cae979682d", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590183, "uuid": "442f3a66-7a82-4b6c-916f-87e088b1d3ee", "value": "T1E2E3CF5AB419D81CF506CB3448CB4BAB6623FC344F5A4A872368F3A57FF9C90960325B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590183, "uuid": "ca2d52e0-8986-4c56-bfd7-d0089292115e", "value": "3072:zOKpbdrHYrMue8q7QPX+5xtekE86W8UM+5/c/mrWmngyYXnMJelsSKThsdskl4Wp:CKpbdrHYrMue8q7QPX+5xtFE86W8UM+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648590183, "uuid": "21c539f1-5bf9-42b0-936c-7f358af79fd0", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648590183, "uuid": "aa556291-3232-48bb-9ee6-05cce2d866b1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590183, "uuid": "dd5af468-98dc-451c-9cd0-88bbda942ab6", "value": "Archivo-24032022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017a6362-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529106, "uuid": "f65381e3-5ae1-4b48-ae8d-5b783b69a76a", "comment": "Malware payload (Stop)", "value": "21a0f428410d0c39cb34327f8e4dfca9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529106, "uuid": "031712b5-4e99-4552-a68b-ebd4adcc4c24", "comment": "Malware payload (Stop)", "value": "16caa6cee30e3a5de71eeadb718440145027eccddf1bc2dc053435d354d89ac4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529106, "uuid": "bf14af6a-6459-490e-bf43-942f573ed3e4", "comment": "Malware payload (Stop)", "value": "f806e57a140738de6722c35dddb807f87d647a0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529106, "uuid": "eb5ca598-bcbc-4920-8ce7-6483a64303c6", "comment": "Malware payload (Stop)", "value": "91c26c1fe99f720d6088bb613b356a2784ea4b7c2384af1b1a5ee905004e8395c76dc4edda4490ec5245921f1b038d43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529106, "uuid": "717b1fd2-ab4f-48fb-87e9-a768782f5e0c", "value": "T16505231277A2C071C1D62032AD1DD1723A6EB8315F7B8E433B98077E9F317E6AE6514A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529106, "uuid": "b3028db1-8307-4b83-85d1-4fbfd4540110", "value": "7c5b10d9e40901c040091d030f4c7b35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529106, "uuid": "1cf9d2df-89c4-4878-8225-d3496995472f", "value": "12288:LsrGkGRDmmMjA7T1e81MEygVkaVcYDbT3ai1gFOQwD1ltEd0:kxyDeOZP1zzfLT1gFOX5m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529106, "uuid": "930ddd2a-4a46-4c10-a8f9-9b7937864a5b", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529106, "uuid": "c86d431d-7aeb-4142-addf-50a867f02a5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529106, "uuid": "b326c22b-792f-4d19-9eeb-556a4d328ecd", "value": "16caa6cee30e3a5de71eeadb718440145027eccddf1bc2dc053435d354d89ac4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8945f5a-af96-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648582349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582349, "uuid": "a51a01de-d414-4eb3-b927-2f2c222fefc9", "comment": "Malware payload (Heodo)", "value": "93814c0031caa74215fb715c2ab4f759", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582349, "uuid": "4faa4fbd-b040-4faf-b550-b1ff701010c5", "comment": "Malware payload (Heodo)", "value": "173d7780ead70f3d8ad980b3ef9c32a646e947706b9a55360ae9eae400b3efef", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582349, "uuid": "1ba7b6c4-7d52-4719-aa61-f991c3599b5e", "comment": "Malware payload (Heodo)", "value": "866137c3564d061a3a410c5f4fddecc4de2ea0d7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582349, "uuid": "05ed43ab-de76-404b-a363-1118cd08b069", "comment": "Malware payload (Heodo)", "value": "6b6f65f0d194d1b3c654c6fa0875a7142af87d13169310a58120a1c14efc92761564b3dc2947a5c02e9b0941c4cb663f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582349, "uuid": "85d98051-467e-437a-addf-a5ddf48123da", "value": "T1E3649ED173F0CA77E22715333EE597BAB2B9A564DE32C6836394CA4CEC320554532B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582349, "uuid": "831cfb96-6a97-4e1c-813a-a2d69442035c", "value": "1ae872d29ae3f3837d6c8d15813e59d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582349, "uuid": "0f5c8f84-6dde-4f92-8a9e-724f941fa282", "value": "3072:IETHGNaL1eByO0+yJvoXZ13zVMrJAZ/swfkCWNRTlJwrySDJUi3IXjUlziMN3To2:1IuOkoX33WyZEwtWNRByDlPdOkiB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648582349, "uuid": "b9685dcc-0ee4-4b92-84dd-55a180218773", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648582349, "uuid": "62631f8b-1a9c-40dd-822d-d1f389aafeb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582349, "uuid": "396e7d0b-586f-4f7f-b56a-96e885aa9650", "value": "17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bded7cde-af6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (FormBook)", "timestamp": 1648563782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563782, "uuid": "d16bd933-47b4-464b-9842-7730d738d699", "comment": "Malware payload (FormBook)", "value": "91fbc8d29c8dc7463b4a1e8a46669aee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563782, "uuid": "e317e1ae-6c3b-4e41-b288-58347be4b558", "comment": "Malware payload (FormBook)", "value": "1755742f318f26db4bd9a258426cf22e90b27c2dd67e67fcf662659bce8847f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563782, "uuid": "884a1b98-4052-46b7-8716-c04b8e57053f", "comment": "Malware payload (FormBook)", "value": "f3873a8050df734fb0d48a3afc6d9fc756e58f4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563782, "uuid": "36694609-4bb1-445f-bec1-9cf9d3855c30", "comment": "Malware payload (FormBook)", "value": "71f487ea740ad2f8f46930de3a5ff5fd3ca8c8906f455f5c5633fe01ed65b2c2cdeafbf431902c154f10109418d14f5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563782, "uuid": "9418457f-04e8-4555-b903-9f20945433bf", "value": "T121058EAEA3908873C03317784C4B97B999267F512F24984B3AE93D4F7F39A903539257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563782, "uuid": "b7e324b7-b39a-41b4-a1b4-5f24728a6e5b", "value": "dbf1300428baed4574f07bfbbe98b092", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563782, "uuid": "b35e8ae6-5f7b-4134-aca3-d1ed21546e0d", "value": "12288:k8XoVKkPa3yFwp0ShMnn0sAIpxxfBy2oYWVwyU6PdCL9/ZHi:zYIkCyFwXhM0jIpx+h7U6PdCLHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648563782, "uuid": "cddee396-05cd-41ef-80d0-74362bd17626", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648563782, "uuid": "8d822b96-393e-42d3-92cc-6e8b8ae9e420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563782, "uuid": "b32bd835-b1a2-4ab8-a078-d3af9d3188fc", "value": "DOC290322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1de4af-af99-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648583613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583613, "uuid": "71a1b9c4-c8b4-4512-a103-77eff7ddbdae", "comment": "Malware payload (SilentBuilder)", "value": "0863b3879f6f6fcf7f8db7673d51dd88", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583613, "uuid": "2bfc4bdb-465a-4fc3-ab0a-9a5a27a74a5f", "comment": "Malware payload (SilentBuilder)", "value": "17be914f3d6a88c006b33cea5ac7e4774eb6c0c57d8ae8b3c7ad07a45d4efa81", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583613, "uuid": "3d0261af-569a-4049-9230-6fa79247ca97", "comment": "Malware payload (SilentBuilder)", "value": "30919364fe0fb872c8e96046e1046e8af44ba714", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583613, "uuid": "b4782dbc-abb5-40ca-a746-e8be865e857a", "comment": "Malware payload (SilentBuilder)", "value": "ebbc1406f8855a2daca5058e16f3a009d46e6a48867cad7ca1e35c390948e2182bfb20a526f0cb9182c523ec0a8b07c5", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583613, "uuid": "c81109fc-16cd-4c54-975b-7ebe4b59def1", "value": "T14FB39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583613, "uuid": "d61037f4-de17-48af-b222-2c1527708ca2", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMw:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648583613, "uuid": "d6fc3303-150e-4f89-8284-8a7a9e439ba0", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648583613, "uuid": "882c6515-68b7-42fa-8063-550361b262fd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583613, "uuid": "eaec8f0b-dbba-48ee-bc6b-c36297e9a686", "value": "0863b3879f6f6fcf7f8db7673d51dd88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4de9f0-af38-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648541818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541818, "uuid": "24978dd7-ab60-4dcc-a2be-ed3036147230", "comment": "Malware payload (Heodo)", "value": "469f11be60d31a7f7d4a5f35297b7e98", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541818, "uuid": "6d0683a8-d4df-4e91-b5f8-9b5277f15136", "comment": "Malware payload (Heodo)", "value": "17c7abf47c94a7bbfde7d2df3845469863f2f984cb831bcdfe8ca1673848e86b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541818, "uuid": "2747880f-0f53-42ad-9bf8-8baa2f9c4a29", "comment": "Malware payload (Heodo)", "value": "cca46c498205ebef2d867b9e73416fb8f8f3aa89", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541818, "uuid": "0d0b48fc-99c7-4eaf-859c-7ec764a66b30", "comment": "Malware payload (Heodo)", "value": "5f0a5bed810128610e88bf2dbb49a7316ccb258976564218a5619ca3c4650595d69a12c73d0afa97a236b50581fa6ff8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541818, "uuid": "41a8c3d6-7385-4859-a371-75c84a03bf59", "value": "T1C2C3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541818, "uuid": "4330706e-de1e-4a7a-8745-598ce3717444", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCh:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648541818, "uuid": "d0457dd6-8fda-47e0-a327-8aa4db9cf88a", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648541818, "uuid": "b62aa092-583a-44aa-8185-39b451ed868f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541818, "uuid": "761f0dd2-68ca-4ddd-a4d0-a61a07dc72d3", "value": "SecuriteInfo.com.Exploit.Siggen3.30291.14930.13511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94435480-af76-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648568437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568437, "uuid": "b0c11695-fee5-4299-9692-01b0d44aae04", "comment": "Malware payload", "value": "b864f3edcc82c6ab880b897bd2345d3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568437, "uuid": "22bd6e1f-4348-4dc2-a2d8-e4836057617a", "comment": "Malware payload", "value": "182280b43ae55b3458fe8d5ea1fe4ffcdd1c00fbc0f21cdcfde29f8686d245f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568437, "uuid": "23b82144-e68c-4009-93a7-e9b229110a00", "comment": "Malware payload", "value": "0695fce71922343ca91eaf41e6658f9452970410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568437, "uuid": "d4359fdd-035b-45f0-8658-7a8344b1f219", "comment": "Malware payload", "value": "a41ec6d2e20ded16d49d726a2fd58c5d1cbb6d15377094bc733f07b1ccbf754039ae0f1b76a817efabf4f90b2e7ef940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568437, "uuid": "14933933-81e7-4d1b-9d75-d6f4c5b65d7d", "value": "T13384624976746132DD04CB3815F2AE14D2E7EE6D2BE1961D24C8B66D1B326FE8F03AC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568437, "uuid": "a3e069b0-0f45-48f1-866a-091c1a0bc597", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568437, "uuid": "ba964371-b3b9-4c9d-97f2-66cbca8d79ae", "value": "1536:57Ore01qaf4wrQ/Pj33J0QjDpgcoQLHKpqaLy0uyL+ft:57WPMafuPGsbfKuy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648568437, "uuid": "69692216-ab7d-49b5-8a3b-c45e7c1b165d", "value": 371200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648568437, "uuid": "720375bd-6b72-4c2c-948e-9151aac1e16a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568437, "uuid": "13a1b3fe-5441-43c1-b09f-b1c17ee99932", "value": "PO_IN00043INBOM_Specifications Sheet^^^^^dwg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db71078-af26-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648533905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533905, "uuid": "6bd2748e-69cc-43db-86cb-3e455653c032", "comment": "Malware payload", "value": "dc5007ea7b22ca15d0983b62cfce5157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533905, "uuid": "8ca0b015-ed14-4998-88c7-16ec4eab79dc", "comment": "Malware payload", "value": "189dd959bf65cceeca4245ec28dd450b31428e6284529cfd0fc1d594d9128257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533905, "uuid": "4b6f490f-3642-4ff6-b3b8-ad9288c057bb", "comment": "Malware payload", "value": "40f8c25775b181e498315ae9c7ac67ab15f45f8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533905, "uuid": "60f439b2-d7d1-47b7-865d-da452ab6146d", "comment": "Malware payload", "value": "aa24527705bcb542f7d06a4ba48b2fc9c6a792ecd9e1af43d021db796b8a782957bed3f680f9169212e5d68626d4f711", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533905, "uuid": "e8abcba7-ff88-4c2b-b012-1df1dbb2598c", "value": "T197B5B4226AFFA712DDB519708F3CA5B004243D901ADAC867B6A87B6EC4335CD752F613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533905, "uuid": "6e4da359-0deb-4b1b-9036-bf09d1535053", "value": "e3bed136ae1b08477b86233e3d15e375", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533905, "uuid": "b512f61e-d374-4b55-874a-9ce412e03e8d", "value": "24576:2XobaewsAjQvITeqZF3tm7s7kP9zWm8s9AuDzxW:2Blj6ITeqtSSkP9zWmTRDzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533905, "uuid": "c09abe60-4b0e-4695-8e86-94fcff29e4ea", "value": 2305234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533905, "uuid": "581d9e2a-1402-4ee9-be01-0f3149a828dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533905, "uuid": "f6bc4a35-bba8-4cd1-8bdd-7e0afbe9ff00", "value": "31eqds.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7cdf3a-af56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648554871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554871, "uuid": "944ecd4b-751f-4f98-989a-8a4897024fde", "comment": "Malware payload (Heodo)", "value": "6fa66b0071257299952777a9959d3ba3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554871, "uuid": "56a18f2d-52ee-4328-ae06-9185551b0aa3", "comment": "Malware payload (Heodo)", "value": "18cdd9ebc1709c6df1a0f3c922e3891dfef57d133084e9ea7853485bb76a2d9b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554871, "uuid": "ccaae77b-5ac5-4b96-9eb5-267559aa31bc", "comment": "Malware payload (Heodo)", "value": "2fb9ccdaf92437bcd56bb2769c20588c56ce4f40", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554871, "uuid": "0d4c3800-2b11-4771-886f-9f4afe539e55", "comment": "Malware payload (Heodo)", "value": "b95d066dba7233abd38fa4254aa4f25084a87d73f4497150f5209ab76ab3152915e2fdd516f6219c93808225567016ef", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554871, "uuid": "1dee2c57-536e-4eb3-99ed-827046eb7532", "value": "T110C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554871, "uuid": "4e60bed2-2cd3-4241-b8d8-15df97bf0156", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554871, "uuid": "3e07fdff-25e4-4ac8-bce2-52fcdfa2e877", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554871, "uuid": "abcbcf48-75b0-425c-909f-7ce42d18da86", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554871, "uuid": "8d8f37a9-7aab-4db9-bab9-fd93856f59ef", "value": "New payment details and address update_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bff59e-af5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648557465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557465, "uuid": "8f5c03c9-51cb-44e1-92d0-9d4ba60a896e", "comment": "Malware payload (Heodo)", "value": "1c875428d5d290f9b8652f3bfaa035f9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557465, "uuid": "5d913351-e6f5-4934-b8b3-4cc6df6654ca", "comment": "Malware payload (Heodo)", "value": "199874205ac18763603eb0955c027dec5dd36e1f098a0a28fb1320db706ca525", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557465, "uuid": "53b764b2-36f9-4d88-9f44-353b370b647f", "comment": "Malware payload (Heodo)", "value": "041496aadea15dcfbe9f145d05e10f58b4edc00d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557465, "uuid": "8c029326-81d3-406c-a469-7035996cc180", "comment": "Malware payload (Heodo)", "value": "b89389d71c861f100aa49caa27051204e38a769ec73eb0130524f7e056bf7f255d9afd1af96c03f10755c33eb63cdf63", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557465, "uuid": "b8ff1c7f-ba6a-41a4-b1b6-143671b62e2f", "value": "T1C9C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557465, "uuid": "ca35758c-a47c-4663-a320-ac0aaf70e2b5", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCM:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648557465, "uuid": "4dcf9b91-74cc-4e75-ba6e-134d80f7d284", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648557465, "uuid": "37bfc5db-f252-4528-b8f1-62c45a672696", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557465, "uuid": "54c7fd63-cdb3-467b-9266-3459f2551b6e", "value": "iMedPub LTD_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e8cce3-af86-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648575261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575261, "uuid": "6c92f104-9869-42da-a77e-3af45e036a1a", "comment": "Malware payload (Heodo)", "value": "b7acef6777b7aa044f8e66f122972aa0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575261, "uuid": "c85a205e-71a8-4626-a828-85fd1daa7215", "comment": "Malware payload (Heodo)", "value": "19c994f541c1c2630f9b192f33289f0c069bad2f6a1d4e8bd33b949a4819442a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575261, "uuid": "b7c70b97-e26b-43a3-a64f-45d4ea9b9690", "comment": "Malware payload (Heodo)", "value": "ffda454a8a07fe8ab22513f1ca5a678fffb158eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575261, "uuid": "db128f58-5775-43b0-913d-caf448d4ba9b", "comment": "Malware payload (Heodo)", "value": "c7015173469dfe97a9f2b95b0369a0f4da59b7c1f7a6b4fe9e4175df8ec1f3717d601592dd8924876b13e5b1bf7a1800", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575261, "uuid": "cce72fad-46e5-4d7d-aed9-9199325693e5", "value": "T13FA49DC87182C132DE7B4B75C642CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575261, "uuid": "bbecdbbc-5420-45ef-bdc0-e505967e2b76", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575261, "uuid": "a16bfc4d-40c2-448d-a37a-b24cbde571f6", "value": "12288:myXvaWo3sPddfrkaEpBLsORdPDpFlrh5W:F/as1dDkFHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648575261, "uuid": "aed146dc-1898-4569-8fe8-16b135a42df7", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648575261, "uuid": "1bf215ef-eafa-4d8b-a7fd-720e505c4847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575261, "uuid": "dc056e22-d62e-4357-a4d1-9b2c8922f5ea", "value": "emotet_exe_e4_19c994f541c1c2630f9b192f33289f0c069bad2f6a1d4e8bd33b949a4819442a_2022-03-29__173415.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435b453c-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648561858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561858, "uuid": "bd79d508-ea8c-4d96-aae7-56712e9ec8c4", "comment": "Malware payload (SilentBuilder)", "value": "8411836614428d075b667610e0cd9a3b", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561858, "uuid": "609407ef-d4fb-4171-b222-d9ad14a66489", "comment": "Malware payload (SilentBuilder)", "value": "1b5221e563b7d6df77671b3e122c40609a9fc98b095720e78793fe5fcbea2be9", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561858, "uuid": "f37d9a70-c58b-4fe4-996c-db530963213c", "comment": "Malware payload (SilentBuilder)", "value": "c9c6d152d0909f2fa050cc4ed293b673aa269201", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561858, "uuid": "e74ca171-bc63-48a5-824e-6fc58f72160f", "comment": "Malware payload (SilentBuilder)", "value": "cb719168655aab0abb80662866136df907522efbeaeeb34327e0a01862652e9b8640ebdad012e21f974dba2b4998f9fb", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561858, "uuid": "729694ce-2095-4ecb-88a2-c1ee6cbbcb4a", "value": "T1B9C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561858, "uuid": "3fcd9375-7b4c-45f2-afd5-891ca57a74eb", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCs:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561858, "uuid": "a340c602-98d3-4377-bf36-b3f91362d088", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561858, "uuid": "ce009a06-6751-45ea-89d4-4b1bfcbc54de", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561858, "uuid": "db32f8cd-5ed0-4561-b00c-a559ce9d4ce9", "value": "SecuriteInfo.com.Heur.30744.30871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7666d3b5-af86-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648575258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575258, "uuid": "6d235d00-9ef2-45cd-ba98-1a4b178c3869", "comment": "Malware payload (Heodo)", "value": "764b814fafdadacc8c3a427a91c3cf0b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575258, "uuid": "8af88635-d5ea-483c-93aa-e902dd3de42c", "comment": "Malware payload (Heodo)", "value": "1b73e86d801edf689893658656bc92bf8fd6cdcb4b4282a40bcbc7c1bbed7312", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575258, "uuid": "e6bd335d-2a9a-4e21-a4ef-a1870b0a2765", "comment": "Malware payload (Heodo)", "value": "d7f5a4d5c0de5352e51227be59a1bdda95a8e275", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575258, "uuid": "37b97e1d-99a1-4f5e-83fa-3b36c3c24c5b", "comment": "Malware payload (Heodo)", "value": "071e8dc4c78716c9a06ff4e86541df98ea913118dacb109d51915385091f96b186bb47866d2eb530c6a81986f8a49119", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575258, "uuid": "0d3649e4-d597-4ac0-bb33-095ebb259f6e", "value": "T101A49DC87582C132DE7B4B75C552CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575258, "uuid": "9dbdee58-4388-4ea9-a2d6-7ff038c04110", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575258, "uuid": "0974bced-faa6-4971-b455-c0b45bb50692", "value": "12288:myXvaWo3sPddfrkPEpBLsORdPDpFlrh5W:F/as1dDkWHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648575258, "uuid": "32aaf409-9aef-44db-b7b9-e292cd412eaf", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648575258, "uuid": "f5cc2acc-4be4-437c-9292-43827bc7f6ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575258, "uuid": "e364f662-56ce-4d23-8e69-50c65f510e60", "value": "emotet_exe_e4_1b73e86d801edf689893658656bc92bf8fd6cdcb4b4282a40bcbc7c1bbed7312_2022-03-29__173408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9222f83-afbb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648598160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648598160, "uuid": "f1c68d94-cbeb-4407-8953-42dbe8f99d9e", "comment": "Malware payload (SilentBuilder)", "value": "5bd77d6bf535d2626519ca9d64df55b4", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648598160, "uuid": "f409ab87-9960-44bc-a523-49c9f3e438a1", "comment": "Malware payload (SilentBuilder)", "value": "1b7b4de07674b0a896830c649a51473d0c17f4ea18ec4c30001b9886c6af41dd", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648598160, "uuid": "7484e0ce-3556-44a2-b1d4-26ef9f443eaa", "comment": "Malware payload (SilentBuilder)", "value": "1daf1d173a058a71c181e7e13b3774f9a76aa311", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648598160, "uuid": "f0e83b9e-d620-423a-a69b-c06ee8a316da", "comment": "Malware payload (SilentBuilder)", "value": "5e22de6e72200ddb83904599102f610e892a2810316cbdc313f0fe2ae66d05c8ec6514ce20e04d2ee09fa6f77b8bcf94", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648598160, "uuid": "1490f0e4-5392-4627-aee5-3fa0ac1f43a6", "value": "T100B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648598160, "uuid": "6382bab3-ffba-46f5-a079-3c3ad97f4f9b", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsM+:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648598160, "uuid": "7fc1a2fd-8765-4fc9-92ad-e4db7a9c7188", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648598160, "uuid": "a94933d9-659e-416f-a847-6aecfee5e82c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648598160, "uuid": "d18312d2-1264-4460-9347-c52708825027", "value": "5bd77d6bf535d2626519ca9d64df55b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686be08a-af8b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648577382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648577382, "uuid": "4fff7c6e-2eb0-403d-bff0-146d7ee19afb", "comment": "Malware payload (Heodo)", "value": "7f0d1d4088e2b8dd28a3cbcb6d22fddb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648577382, "uuid": "10e9dc3d-128b-40eb-a187-dba60c6a2084", "comment": "Malware payload (Heodo)", "value": "1bb830641da011cf3b35719a99390529b2228ae6342f480289caa432a75a98be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648577382, "uuid": "4a4cda62-4b5f-4368-82ec-96d614cd62a0", "comment": "Malware payload (Heodo)", "value": "c6e798300a5571e671b9e2b86188dd23bffdcfa2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648577382, "uuid": "98c9882e-5774-4ae9-ac9f-6230176ff5d0", "comment": "Malware payload (Heodo)", "value": "a965f8142e04a7b6c621768f259beaf1ebcbe2f2d3befef1772821d3e2d4a50e3085a09512a0e90f3f95f113ea042f96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648577382, "uuid": "655e80e7-7ca4-436e-bb31-c29158bd4237", "value": "T1EFA49DC87582C132DE7B4B75C652CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648577382, "uuid": "10c349a6-7f7f-41ea-a612-8097710c5c41", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648577382, "uuid": "dee2da57-b7ea-4f0f-b2dd-eea41a936e07", "value": "12288:myXvaWo3sPddfrk3EpBLsORdPDpFlrh5W:F/as1dDkeHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648577382, "uuid": "356296cd-de05-451b-b6df-5e5d6d5cedb7", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648577382, "uuid": "6c13e16d-9088-4645-b746-fbd79dbf2316", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648577382, "uuid": "3575d44e-35cb-47c2-8564-5b13e7179aa9", "value": "7f0d1d4088e2b8dd28a3cbcb6d22fddb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e417d8-af57-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648554885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554885, "uuid": "e57222e9-068e-440e-8917-1a38faea8bf0", "comment": "Malware payload (SilentBuilder)", "value": "2094a10e5b5df5f70028e3c985ec929d", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554885, "uuid": "f8084e01-7592-4b83-87dd-9c98f84c28b4", "comment": "Malware payload (SilentBuilder)", "value": "1bbd0e2ecf37a657d22d4de7cbf17df6f136d1b4187f47bce83e59af9d57da3e", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554885, "uuid": "7421bdd2-38b4-46fb-a9ee-e4928531db29", "comment": "Malware payload (SilentBuilder)", "value": "b74662cfc6e25d8b40bd30ba02522052d0032da7", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554885, "uuid": "73552618-3d3b-4d38-ad6f-65429b9bf502", "comment": "Malware payload (SilentBuilder)", "value": "c54b5013430da0cc83ba861fbcffd4112cef4863729926827959be77cc96cea27f1384362abe8d28d290affbaec79a2f", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554885, "uuid": "d40209d8-d840-4b17-ac3c-b1e34afc3adf", "value": "T100C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554885, "uuid": "4160efa0-af8a-46e8-980c-ab9e3c3785c8", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCc:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554885, "uuid": "7803d6da-3b51-43f1-9dd2-d2ff122eeaae", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554885, "uuid": "a38223e9-a523-4b0e-b585-59a47de985fa", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554885, "uuid": "20fc6834-c644-4bc6-9556-6068a019dcd5", "value": "Receipt attached_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c65a9d-af43-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648546541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546541, "uuid": "b00e8f8c-c3b0-42c8-83a0-cdc041433152", "comment": "Malware payload", "value": "b4f12a7be68d71f9645b789ccdc20561", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "plugx loader", "colour": "#10DB64", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546541, "uuid": "dd0b991a-849c-49c3-bad0-0b93e3c88c29", "comment": "Malware payload", "value": "1c0cf69bce6fb6ec59be3044d35d3a130acddbbf9288d7bc58b7bb87c0a4fb97", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "plugx loader", "colour": "#10DB64", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546541, "uuid": "264b89c1-5261-43bb-8349-40b783dd62e7", "comment": "Malware payload", "value": "ef3e558ecb313a74eeafca3f99b7d4e038e11516", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "plugx loader", "colour": "#10DB64", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546541, "uuid": "aaa83e06-69ba-43b8-85af-a2766565fb1e", "comment": "Malware payload", "value": "3900e01baf3ba26d92b2c665c1ead668d7f0c7d75d385acfb4617a662decd14a358564be94d11e5b5414d26f9311ebae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "plugx loader", "colour": "#10DB64", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546541, "uuid": "83ca2b12-803e-4571-b046-8da566bde141", "value": "T1D3938D52F7C1C0B2D8538A3D5176C7324B7ABA402B79C4E737981DCD9E227E1A63A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546541, "uuid": "5f0851ba-d42e-4a09-bcf5-31a4603f51aa", "value": "3bb52be2e0e2298920dfffb9176df3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546541, "uuid": "af14d7b6-5801-40f8-8acb-4cb1f4c29d8a", "value": "1536:RxOHyRtyd+624O2sSd/894mPOfzc4ILUHe936593VQtZe4d86NIJmoA:RxdR4d+v4Dz1IXV65V2tHdjem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648546541, "uuid": "f3f720d2-25ae-4e40-a568-eceb4c04559f", "value": 91016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648546541, "uuid": "ff33b3d5-9915-4711-b77f-f56944b41da9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546541, "uuid": "73215936-f7ed-438d-9643-01018e121664", "value": "WGXMAN.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb092f0f-af1a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529068, "uuid": "47aa808e-ed8f-4a8f-b363-7b9472a3d3e5", "comment": "Malware payload (Stop)", "value": "094755e7c0dd46ceaef0dbc8542fc7f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529068, "uuid": "b6951d58-768f-474b-9270-99a4eba07392", "comment": "Malware payload (Stop)", "value": "1c7f81302bb3396810c11136b17a279d9e193da699d99be89bc98f367d4846b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529068, "uuid": "53ec8e41-898d-48a5-bc6b-57d8e24932d0", "comment": "Malware payload (Stop)", "value": "e22d7ecd74e237ca6b31f0e46f2ccf7014f75675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529068, "uuid": "4c3dacd8-59ee-41e8-ad65-d429b3a81342", "comment": "Malware payload (Stop)", "value": "49cdffda9b1c43c2f842b6d504ffe9cecf99f6344f43b133d90bf5ce822b353bae78fde1cd646843c55ec01e0c8fb720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529068, "uuid": "4963938a-f091-4d1a-af34-134593728ccf", "value": "T1D3050200B7A1D03DE07306F4387592ACB92E7DB19B2094CF62D66AEE56346E1ECB5317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529068, "uuid": "07b66a21-9d82-468c-9643-e5cd42114a80", "value": "4afe698a4ff3f157978858a4a5de1db8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529068, "uuid": "a8a7b978-e78a-4ae6-8dc4-a2db2ac297ea", "value": "12288:dKclKqbMI0wC/g3IA1JZB8cjarpuYEEJLS6ZzIu8kEFnttr7RDieO0uyQc/mV:XuIn8kLB/yfY6tI3FvxmfVVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529068, "uuid": "0619dd3c-3e87-49a2-9a6c-b47adf158b40", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529068, "uuid": "e2845f87-e02a-4bab-91db-5e27478aff01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529068, "uuid": "8f7fd980-4b22-486a-8d52-6b930c039c5b", "value": "1c7f81302bb3396810c11136b17a279d9e193da699d99be89bc98f367d4846b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fff28d-af29-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648535390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535390, "uuid": "59bc9b27-3367-424b-88af-d13ecec24112", "comment": "Malware payload (Mirai)", "value": "e510fbe731c4a9aeefcb64837ac4bf3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535390, "uuid": "46df3b36-93eb-4e23-951f-7589ccd28a56", "comment": "Malware payload (Mirai)", "value": "1c96d5ff3e8100ac06f2118483995965d3474bc5b34db768b5c7ac769d6c11c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535390, "uuid": "d6e3d37f-358e-41e4-a3e5-1732855edc7c", "comment": "Malware payload (Mirai)", "value": "3a3d2889347b4264ab9389f6ede4eeefa33d7db3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535390, "uuid": "7a2f15a1-db7d-43e7-9e86-de6ccd61a22e", "comment": "Malware payload (Mirai)", "value": "39a06d0a1fb63295ce15834d72fd35402c62d41ab2af12aacda7e74b493fadbd4018a93c86ff7addae635e3a8de79c21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535390, "uuid": "ff00c508-5e1b-4df3-b428-c1914b87957d", "value": "T1E603F115E148E062D20009FF96F6090E49511E2CBFE7BE71199CA0B96DC492377FAA9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535390, "uuid": "3b36f226-082a-4bf0-96f6-2274790228c1", "value": "768:WGu5/847xePKGgmvFujdLUesRSjZWoMZzt0xT8PnS3UUe:WXxCd0dL4SjooMZB0x8Pnse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648535390, "uuid": "38084b65-1076-4590-9ffe-74b50e49cf9f", "value": 38024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648535390, "uuid": "ef373d48-9231-4d32-ba5e-53ce79ceee99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535390, "uuid": "2f13437e-50fd-458f-a064-9f33aa56e74d", "value": "e510fbe731c4a9aeefcb64837ac4bf3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0311767d-afa8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648589668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589668, "uuid": "86b326b9-1d3e-4cdd-92ea-1c92b4d6d115", "comment": "Malware payload (Heodo)", "value": "ad089bc5d18283831257de6eb2021ea6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589668, "uuid": "6823c4a7-4adb-4a9e-8bb4-d805bad0139a", "comment": "Malware payload (Heodo)", "value": "1cd5c3f379bb9274a681598be8390551bca07796e98661c5c255488305033493", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589668, "uuid": "839d9f8a-5fbb-4b93-96b7-5bcdda1e95e1", "comment": "Malware payload (Heodo)", "value": "b041e44ab49ac79aef8f28b3f442b8d177153076", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589668, "uuid": "8bc7f9c8-f5b2-442d-9d12-7d1ba228268e", "comment": "Malware payload (Heodo)", "value": "857b4c765224119e346e8150f392e3f23a08ca13c2052261d418c5fa286c9f867250c2bf13ce2068618e0f4feec2a122", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589668, "uuid": "94e29997-5a12-4aec-9a68-a10639200227", "value": "T13CA49DC87582C132DE7B4B75C552CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589668, "uuid": "0238b375-2cf5-4a40-8dbd-d22bd1ef104e", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589668, "uuid": "7a1ff2bc-5917-4ccb-be79-8e63631fb5c8", "value": "12288:myXvaWo3sPddfrk8EpBLsORdPDpFlrh5W:F/as1dDk/HRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648589668, "uuid": "9224ceb2-e7eb-49ac-8c02-7b7027b4b926", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648589668, "uuid": "67422a9c-e690-44aa-a83b-c5cf8d2b0f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589668, "uuid": "e506dd70-83fc-494c-a28c-1122ce14a006", "value": "ad089bc5d18283831257de6eb2021ea6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee391f28-af1a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529074, "uuid": "27de7802-e5bc-4702-b715-e787c6e3309a", "comment": "Malware payload (Stop)", "value": "fa04b614c6cf028566fe6bfe7e5e2890", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529074, "uuid": "403e65e0-d0a4-405d-8148-3f7af57008ce", "comment": "Malware payload (Stop)", "value": "1cf923ca8729ef09965b1d808fa93cd9de374cde86c86830f31a05ab39284261", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529074, "uuid": "38559fbe-9fd6-429a-9a62-b1ef12bce794", "comment": "Malware payload (Stop)", "value": "d5f189656dad95460880825bd713888b17eb35f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529074, "uuid": "9fb0c625-a97b-425a-88c2-8ed3db595e52", "comment": "Malware payload (Stop)", "value": "79e3ec8c60641f33ef43f99ed12347bfa92ca3d77cbb31c5c7c99db54f5491ede7ffedade0a2d9817b4a3cf9ab0b04f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529074, "uuid": "dc11a58d-c20e-4150-8096-a51aac33b46e", "value": "T100F401007B50D035E5B712F45A7693A8A93EBDB15B7860CB67E16AEB1230AF4EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529074, "uuid": "36d131b2-4cc3-4e90-b43c-88e419ce0aec", "value": "8b43e1344b27321e8381c60a4a19bca2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529074, "uuid": "473f1b75-dc8a-4aa4-882e-2125fe0539c3", "value": "12288:pf04aq8lt6iGJvlBIcDgAU+FJw/6bizAIX+GEZAGZ/ubFHNxZznVTlIJgq/I6B0J:O4atTWXkb/6b3SsAAqtnztymcIfHZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529074, "uuid": "4ca6693d-7cc7-4aed-8faf-7a5e5e80c907", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529074, "uuid": "f2bf6f8d-4ff4-412b-9bd2-e144986218e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529074, "uuid": "3400bc8c-3030-45ec-ad23-d6ed5466c3bf", "value": "1cf923ca8729ef09965b1d808fa93cd9de374cde86c86830f31a05ab39284261", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76d09c5-af71-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648566402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566402, "uuid": "e0969561-2e44-4ede-8317-ced1d7577ef6", "comment": "Malware payload (SilentBuilder)", "value": "87f159e05fb5f715118ea56021b6d0b7", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566402, "uuid": "75f9f831-11a9-4b03-b206-0ab705d4815b", "comment": "Malware payload (SilentBuilder)", "value": "1d2a970a13f178da4a04cec74076a142eeb0fd2d6c9a1c639661da703fa83ec1", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566402, "uuid": "de59971b-03b1-4e34-988c-cf7f5331f875", "comment": "Malware payload (SilentBuilder)", "value": "7433e4058a390f5a0d22964fd91dc3e97e727d11", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566402, "uuid": "1cf95a6c-3b51-4906-9f92-68241dccce35", "comment": "Malware payload (SilentBuilder)", "value": "d159f6fa090f872329bb6f1db8e318f39599baf79617dbd0679de89055bbb36ffe181c012042183eed0329452ad571a8", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566402, "uuid": "8d3dbf51-5f7f-4f6d-8b55-86c7768522ae", "value": "T134C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566402, "uuid": "39b991d9-802d-43f0-ae3a-bf17dc6b3ffa", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC8:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648566402, "uuid": "3b013f26-2001-4aa1-8674-548da8e6d340", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648566402, "uuid": "ca6fad80-6f04-42ba-805b-b415b9da3904", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566402, "uuid": "31c9495f-79c7-4069-89f3-6f7a4d792695", "value": "87f159e05fb5f715118ea56021b6d0b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de31bbea-af69-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648562977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562977, "uuid": "8497722c-24db-4a4a-b638-1c72b89a4c33", "comment": "Malware payload", "value": "e9aeecf130ddaad1a50f7630da4f0d09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562977, "uuid": "2341169c-6520-497b-83a4-996cc19fd310", "comment": "Malware payload", "value": "1dd19a042aa37738b1b8751ec64fab0ed189ac8bec7466b8e5288c998bbbef22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562977, "uuid": "0ada89b9-0fe0-4efe-b42e-a52980d30ff9", "comment": "Malware payload", "value": "9aed156ee01beb1c817d4faa14f44732518c1364", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562977, "uuid": "ccdb96c6-bf30-4d9a-b6e4-d23c36c19b5d", "comment": "Malware payload", "value": "f9597ffe66abdf1b1b38e50debc96ddc825136fcfe489948af01f0404aa8f2fd6f93677a949c02f085b69e81fe76cb29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562977, "uuid": "f07128cd-55aa-40e5-9642-b9b36d4e4284", "value": "T102D38340EA4DBCD9E7E8D1B3B43A9B100575BAEB92F8819F12A5331456B37D32077D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562977, "uuid": "c60be18b-3b1d-4fff-a719-f303c6bc9559", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562977, "uuid": "5b89ae86-1676-4d30-989b-db1eac83cf17", "value": "3072:9gifm1keYRqir6Ory8o05lhUqrAMgTPA1p8Dja+auDOLQyDl9hFjO4r56ZQY7j1e:9gTkeYRsXCvK4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562977, "uuid": "0895a7cc-bd7c-470d-b76c-da2eb21a5742", "value": 140288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562977, "uuid": "bf05f6fa-26bd-4e3e-81d8-bdc3a559ea14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562977, "uuid": "337261aa-857f-4826-ad11-dc05aa37f9c1", "value": "57892310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8398d7b-af1f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648531238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648531238, "uuid": "f81bc95d-8814-473b-a15c-ad8272dcfb95", "comment": "Malware payload (Heodo)", "value": "d77922dc227cc8e162e8f56ece621c0c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648531238, "uuid": "805801ec-c879-4564-835f-629502a667cd", "comment": "Malware payload (Heodo)", "value": "1df2a057b56cfcca4c1ebb59767d1e32b1a40f9ee13ae5a015dbdfc123693cd5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648531238, "uuid": "2b1e9c4c-1327-4730-aaa2-c8645cdb1339", "comment": "Malware payload (Heodo)", "value": "924939d78961b2acd8df3af407dd75d0e26e2bdd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648531238, "uuid": "b6dd34d8-4c01-4bc0-a24a-60029b917922", "comment": "Malware payload (Heodo)", "value": "97ed098146b990655297e0143a088259f1c184df8b91f3f263c3f8256e0f57ff6044e3a99213c1028dbbe0b09c7a2052", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648531238, "uuid": "169d75fb-e943-4e79-9cdc-9091f3fa49f3", "value": "T144C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648531238, "uuid": "085813a7-090e-4b11-b934-cc43b36aa37c", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648531238, "uuid": "63fdcddd-4064-4da3-b2a6-4a6dc8b4af2e", "value": "12288:S54yM33d3q3Z7BogxreNmF+U/9JckIAGfUeb:SKh3831BobN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648531238, "uuid": "c092de5c-4f5f-4836-9475-be0757a2b6dd", "value": 567064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648531238, "uuid": "6771e6dd-12d0-481f-aa4c-1ed075a9d92e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648531238, "uuid": "ff8e4fb5-65c0-43f9-943b-6223f8e799f3", "value": "emotet_exe_e5_1df2a057b56cfcca4c1ebb59767d1e32b1a40f9ee13ae5a015dbdfc123693cd5_2022-03-29__052033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dc7974-af18-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648528097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528097, "uuid": "84b2151a-3170-49c1-8a8c-15e13b997c31", "comment": "Malware payload (Mirai)", "value": "e0c02a7a213f6888eb8df7d9f0bb861a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528097, "uuid": "2e76f701-edde-4e9e-b45c-124988529831", "comment": "Malware payload (Mirai)", "value": "1e3a7807c3efb2d660f41180db06731996c3bfaf983d6063d8d0a23e62de7f5e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528097, "uuid": "bc650467-415d-43fc-b352-421715c644a5", "comment": "Malware payload (Mirai)", "value": "3e0f3bb7a6b5a438ef703964a609a09d5a8c0edf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528097, "uuid": "9f870970-d160-4b52-8c32-e5c0600f4b05", "comment": "Malware payload (Mirai)", "value": "7be04871deefa98c03e82074363fb7f332b497a05fbd4ef05c55996d89b26a8b931ca4d18e4e85df79fd93ffb8a0a987", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648528097, "uuid": "0b1326c8-0259-4932-acc5-befb8b466b5a", "value": "T174D3C848EE94932EC7E3B6FBEB9942CD333A4794B3DB7D229538426467C43687535220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648528097, "uuid": "30743c68-174a-45cb-ab6b-1b0c6a0026d2", "value": "3072:NCzBtLQ1oEA2D/TzJB27icV2b072bmaCwJ:8Nt8JBcQbbmsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648528097, "uuid": "9eec2db6-7388-40e1-a8f0-3acce57e2401", "value": 141779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648528097, "uuid": "4721fb5c-2e27-44de-a09b-cca5f08d385b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648528097, "uuid": "d91c77bb-9fd3-4e18-af2c-2e48736a461d", "value": "enemybotarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc010920-af4b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648550035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550035, "uuid": "c0acb063-25a9-41b7-8f98-13d24448c1c3", "comment": "Malware payload (SilentBuilder)", "value": "96d9f59d1fc79331956cb4c2a9b82e8a", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550035, "uuid": "f7d70dc0-0d9c-4a9f-992f-bec462adb70e", "comment": "Malware payload (SilentBuilder)", "value": "1e9eff7c45e0ee2a30715522b6558df5e7f4aba6a698185c43acd453ac188fa5", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550035, "uuid": "22cd97e5-5a81-4db4-a77e-941ba910b57e", "comment": "Malware payload (SilentBuilder)", "value": "a044825e96adff2f3c946d8c28bcd1bef7245c4a", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550035, "uuid": "3a397094-a2fd-4fc6-b1a3-c7137920d1d5", "comment": "Malware payload (SilentBuilder)", "value": "efbcd8828f089387caf3d23c3c4e9d0f61753a29b26ba6c881765f7716a282f069d88531fc35f498cbb20d4655324fdc", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550035, "uuid": "6eae149a-9e08-488f-b153-467a351ef922", "value": "T1EBC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550035, "uuid": "6b73ff1a-ac20-41ad-9a4d-f6f87b1f1b20", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCM:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648550035, "uuid": "4855e82a-4660-4c36-bea9-3eb6902dd74e", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648550035, "uuid": "2031eb8a-312b-421d-80a2-1b016945e5df", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550035, "uuid": "d8830f9a-324e-4239-952f-b60d8eb10118", "value": "Rechnungs-Details 2022.29.03_1159.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6da0d0b-af56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648554751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554751, "uuid": "9384c25b-2196-4620-936f-7780878d31a6", "comment": "Malware payload (Heodo)", "value": "c05028f99c48de8b5e5221b1f9246197", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554751, "uuid": "07c56107-ca23-4ad5-9246-464c4b16141f", "comment": "Malware payload (Heodo)", "value": "1ebd8762ba3ae01a222bd2da97cbd7352b9adcff121b07a8fcb913a8d686090b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554751, "uuid": "7b813f0c-b71a-4256-b136-5170e17bdcef", "comment": "Malware payload (Heodo)", "value": "0e85ea07e9800c3a6c68b04223715b55df7aeb22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554751, "uuid": "6fd0566c-b2e2-42fa-8a06-cb201acfab76", "comment": "Malware payload (Heodo)", "value": "de80e5ecf7dd89a9e3095f2741fb869d21876fc380365dade4a8974d206acaebf0cc1a8ca63ed1fb911ff1fe87cd0531", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554751, "uuid": "93b2ba7c-4340-45c1-a725-7e48552ebd83", "value": "T147C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554751, "uuid": "eb89e31e-5b19-4e4b-9eb8-da209a3bf0c0", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554751, "uuid": "d5b3b8fa-3283-413c-bd81-840351551618", "value": "12288:iUV7ciwHX3ew9aYU3p1c9inFijaQeL+nZBb:UiMX9Inky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554751, "uuid": "6e7150ae-805d-48e4-b665-1ec40b51ea04", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554751, "uuid": "632b315d-da6a-4c40-9012-13750d18ad5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554751, "uuid": "8ff7f4d4-695b-479e-bda9-1a65160aee58", "value": "c05028f99c48de8b5e5221b1f9246197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32140285-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648536060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536060, "uuid": "ac9f70d2-1456-4f2f-864e-8bc677633972", "comment": "Malware payload (SnakeKeylogger)", "value": "81709dd4178a8f3b8ac8e8c44bbff147", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536060, "uuid": "bb4f129e-9309-44a4-b496-da137c7dbff2", "comment": "Malware payload (SnakeKeylogger)", "value": "1f53f14c48ecd545980d315ae494ea6a2bd99fa1e9a3671debdf80626942bd2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536060, "uuid": "bf78f015-9787-4592-a1ff-49bc311d6264", "comment": "Malware payload (SnakeKeylogger)", "value": "26db6cd93cfeca8c77bf859543c9c2425db29748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536060, "uuid": "6fa8d7e4-024b-43db-90b9-2963d0daced2", "comment": "Malware payload (SnakeKeylogger)", "value": "b0e3f69984c211b2a6fbde01057d39858878adc27c8c37f5372fa0fde44dff64d9e8573bd8c7a49316a4503ba977e28f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536060, "uuid": "a0a16a4b-39b7-4c90-a4dc-67200a08475c", "value": "T1AAD3275D3BF88804E5FF8A7305719121C7B5F892196ACE1C1AC1F56A2ABDA40CD1AFD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536060, "uuid": "871b882f-eaad-45d3-be04-8eb11a07f4e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536060, "uuid": "ea43b29d-405b-4a84-a72c-bfa991ac6703", "value": "3072:njId3DgXf+wuq2EqvhBibCsa2wB1rnbY:Sz2nLqvWbB6Lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536060, "uuid": "973e9187-b4e1-4c69-b0f7-79eb890b1857", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536060, "uuid": "7f88e49f-83c4-4400-8be9-f814e583944c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536060, "uuid": "cf521002-0d74-486b-a065-ce56ef10307f", "value": "Remittance Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6236ca20-af5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648556327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "a1352deb-c445-4fec-bb03-6bbc6f177198", "comment": "Malware payload (Heodo)", "value": "7687f510e9b295295507cc71c5c0b05b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "4be824f7-6a0d-40f4-96f7-7469aef0556d", "comment": "Malware payload (Heodo)", "value": "1f8ac6e2088e18b946a4ae19077f18654734dbcdffbb2a6711c658e243530a91", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "bbba13ed-bbd0-4b40-9d7f-cbc6500a22a2", "comment": "Malware payload (Heodo)", "value": "59d0d5a304bcb62b02b5888fb84209b822372aa8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "ed066692-62f8-46be-a2f9-e4c256381c66", "comment": "Malware payload (Heodo)", "value": "1d5fb751a08430dfc81e17074267d1fdcac81cdb7a6a114d5a6e0408f7cc43d2304c679d4bebb5d5599f9ef7477db680", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "215803da-7fe2-4299-b848-6dc450f2c25b", "value": "T1EBD45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "0234a279-58a1-4182-b25f-b0b4b3f17b99", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "1dae2b8a-3b70-463a-b824-d4e35faa940c", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzRipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wiooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648556327, "uuid": "a6790989-badb-4a05-ad31-b8f23fd741cb", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648556327, "uuid": "3a233899-3e91-40eb-b84c-ce634df32f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "7d7a3a2c-245e-41d0-b62d-91126cc63e9e", "value": "emotet_exe_e4_1f8ac6e2088e18b946a4ae19077f18654734dbcdffbb2a6711c658e243530a91_2022-03-29__121838.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b604ab2a-af64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648560762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560762, "uuid": "773bbb66-9c6e-4666-a28e-c7a5264459c9", "comment": "Malware payload (Formbook)", "value": "efd638102b94041f24a6b614a46e0f70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560762, "uuid": "16433470-be7b-478b-9bda-f6de9c642116", "comment": "Malware payload (Formbook)", "value": "204e96b879210c8e42455d3670b69e7c2408bb65324b8243346803ef24af6f9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560762, "uuid": "864340b0-4745-45ea-92c1-fbe98d0841ab", "comment": "Malware payload (Formbook)", "value": "1ebc92184ff1c22b6883f6773d06754421e817a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560762, "uuid": "cc30e75a-ac7a-4223-b045-0df4b243f3bf", "comment": "Malware payload (Formbook)", "value": "9782f1dbe945c248a1b9da8b40438d8f5e2204b07b535a8f2c184d064c9e1881c4877c24619d90d96f74a2e61aac1b44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560762, "uuid": "9e6072dc-43c6-4db6-972d-d21622499aee", "value": "T1DF058DAEA3958833D1731A384D5F97F49829BF143F6494872AE83E4F7F346A03629153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560762, "uuid": "24825933-cf6c-4b31-b959-7f1914f183be", "value": "dbf1300428baed4574f07bfbbe98b092", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560762, "uuid": "4adec05b-c84c-43fd-8806-44c1e3b45809", "value": "12288:k8XoVKkPa3yFwp0ShMnn0sAIpxxfBy2oYWVwyUcPdCL9/ZHi:zYIkCyFwXhM0jIpx+h7UcPdCLHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560762, "uuid": "c7d90df9-16e1-460f-94bc-f6a78d2b7fd9", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560762, "uuid": "f47c9202-29aa-49d1-b039-3f377b1a0330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560762, "uuid": "df3c2168-ca6b-4dda-bc25-d4d152add342", "value": "efd638102b94041f24a6b614a46e0f70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1796259e-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529143, "uuid": "e4e6c73a-8497-43dd-846e-397f506ee8b1", "comment": "Malware payload (Stop)", "value": "805c4554201ebdd77d184b7dabb8f9a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529143, "uuid": "52cc4fb2-f654-4922-9762-b5ad33ec309e", "comment": "Malware payload (Stop)", "value": "2084f6652ba0078d12b6d929b05b27948587c8e7113e187b28adba6b95f87741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529143, "uuid": "c988d3b4-c864-49a0-93ad-6bfa4bb6555f", "comment": "Malware payload (Stop)", "value": "49362dc5ac91581689312847466f9dedc7a519da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529143, "uuid": "68047b97-6786-4e22-859a-414851d7e28a", "comment": "Malware payload (Stop)", "value": "3574c4843dbc1c1f39089876f85b73b80ffb85ffb1bf05c4a3a4da064f648cc4faacaf13b5122adfbe9550088679fb6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529143, "uuid": "221b883f-3a7d-4767-89ff-2633a48b88b3", "value": "T1A605F110BA90D035F5B756B1497A83AD793EBEB09B2064CB23D16BEE16356E4EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529143, "uuid": "40270af7-8697-4c8c-8cd2-0a094f512328", "value": "699070d0802ac292c6d967d0195e7ff3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529143, "uuid": "73b37d42-027d-43ce-8248-92b0dc42afd9", "value": "24576:I02d2O3251phDHZWUVOEhsSDR4aHstF1a:I5/2R9H7O6nbMF1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529143, "uuid": "d6e7e97c-0b18-40f5-afcf-0a5c58879926", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529143, "uuid": "74901f9a-8c34-413a-b500-1c2f77cfa63e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529143, "uuid": "0ebcf67e-3491-49ff-94a2-fd0a8e85a5f1", "value": "2084f6652ba0078d12b6d929b05b27948587c8e7113e187b28adba6b95f87741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5579c32-af4e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648551420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551420, "uuid": "5158a3a5-bf08-4283-a642-8819f5041c69", "comment": "Malware payload (AgentTesla)", "value": "847c5080c53805ac64582417ecf53437", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551420, "uuid": "f7eb11d4-c223-4b1f-b43b-6e39eace13b4", "comment": "Malware payload (AgentTesla)", "value": "20b5a9cf690dbde505508ccefeb55092fd0e5d1b8cc9cc33d68667e5fdce1fc7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551420, "uuid": "35ab7e23-8d97-407e-8896-19ba00ab64be", "comment": "Malware payload (AgentTesla)", "value": "c78a5a9e4896166fb5ab2e5db5ddecc9362af3ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551420, "uuid": "69b2b5ec-fcbf-4bc7-b5cb-72b4916b7f95", "comment": "Malware payload (AgentTesla)", "value": "380a0c6319a7f64562e86ec8e6948dcf60377cec90352ed2c48b33e9ef7b81382772605f82bc29c7794ee94dddebbc21", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551420, "uuid": "771bc098-72f1-45c4-8d78-02b6e31a7772", "value": "T146F4B3ADF2F075EFC857C0729EA81C68BA5175BB931F4103A02715A9DA1C987CF14AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551420, "uuid": "8fe0af82-3172-42b1-8f45-5b8a9f7bc406", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551420, "uuid": "632704b6-2e5e-48e3-9a67-f514e0a8898d", "value": "12288:oqBRfG2IXw3GZkaDM2St5JZnG2zbMPTJnnlA+zOP71mgUrVwbrdHrgjjyWq/6fGc:9Hrgjjyh6YRO4lgOzYBmpYRTuURFQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648551420, "uuid": "a0b319f4-d8cb-4d89-8141-d30d938a53d0", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648551420, "uuid": "de11c197-016f-4a83-a153-b643407c4f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551420, "uuid": "b19d3e96-7bd7-4944-879e-1f9c77791fa7", "value": "SE PO- 216238068.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f57c315-af33-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648539437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539437, "uuid": "c4efba5f-8f10-42e9-9947-b60db762232b", "comment": "Malware payload", "value": "e517646bf39ecb084eb2ff338bb03f25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539437, "uuid": "c1dc0f6e-6858-4f7e-bf4a-e07c2e66ed5f", "comment": "Malware payload", "value": "20b8273b5da19f736dfed8a595713a4b0f0f09a29544399e93d595b9457ca8d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539437, "uuid": "e316f908-86e2-4e08-962c-3cd7e9f775fa", "comment": "Malware payload", "value": "8c67d4137f6831f058fac24273d43fda6a5c89f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539437, "uuid": "f355dbf5-7296-4989-b050-e85612b9d4b0", "comment": "Malware payload", "value": "397762f7a604b7f8bf31e8eea8d0767ab2527903172616892dcb4a876bd9e7007b8ba83cc2e2a665b2e4c3cbf7287adb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539437, "uuid": "47cbe6b0-c36d-4260-a906-089e4c5b9ac0", "value": "T17C763313F28DA7BEDA226E707575A63129249F231B248F4B73E0ED7D857015CA930BD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539437, "uuid": "a44ae0af-62c6-444d-bc4d-10ccdb63b93a", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539437, "uuid": "91f5d0f1-e448-4f1b-acfd-279bb93e0a04", "value": "98304:h76HYGHUKMWIOZLNP009qjP+WgbpU09/PMKjoHDzQ8AAW1llu4BSYKHmNlPdP:J8dUAOFyJ9PM0oHDzK91llhS3mNlVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648539437, "uuid": "cd422d14-931f-4dbe-a48e-ac54c4248c8f", "value": 7436920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648539437, "uuid": "fb31a189-f9ac-419c-af94-c4adc1fa263c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539437, "uuid": "f14f3c36-d22a-4be4-b86c-d8b07e5cb746", "value": "e517646bf39ecb084eb2ff338bb03f25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1c6b57-af65-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648561225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561225, "uuid": "29cf7630-443f-4344-bf2c-d1ca39d63078", "comment": "Malware payload", "value": "b02f24cdbd7b033137405dc97b491b57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561225, "uuid": "84da7a6d-5b58-48a0-9a0f-fcd4e7df0df3", "comment": "Malware payload", "value": "20e7cc400373ed70a3e51a348fb8f90454532ed572169f2639ede9f4103bc685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561225, "uuid": "389e138b-22e8-4788-b957-2fb0c68edfb3", "comment": "Malware payload", "value": "20e497fce06974c929a65f367a1853558d6196bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561225, "uuid": "d176de30-4e87-42ca-a76f-e24ee464473c", "comment": "Malware payload", "value": "66e084af470544f1d07b0a244a5edf2e38d813493366282718991e949f435be3fd00a5d4d15f16d3a4c640829d619c9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561225, "uuid": "11913a47-417c-4cd8-b91b-8cf7dc49197b", "value": "T1F6346D6AA2E50A96FDBBD6B9CD53C227D7F238451B64C31F13B0CA965F47321B218342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561225, "uuid": "c7d1886f-15fd-4b25-9d87-845a12289e23", "value": "6144:qyihnaKbEFhck6xW3SJ5gtS3z9pjFAlkkO4a0pf:qyih1EF2k6S/SD9pylkj0pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561225, "uuid": "0922aafe-1104-48f0-9f06-5986960eaaea", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561225, "uuid": "00a9fcbe-b400-40a9-82f0-f92189ca1fab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561225, "uuid": "dcfee7b5-ad51-4358-a273-ea4f17596793", "value": "edf0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da2da5d-af26-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648533958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533958, "uuid": "de46aa48-f725-4df6-a73c-c50725b30b71", "comment": "Malware payload (Heodo)", "value": "13ebf0474d0d92b679ed7dab3aef3f91", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533958, "uuid": "5d3c4ef6-943e-4a5e-a75e-cf8c8a19e337", "comment": "Malware payload (Heodo)", "value": "2122054b5981ca07860fac9582e14cc011a0d6cfa99a40eede1c2b65bb0aed56", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533958, "uuid": "fb40be77-774e-4709-bdbe-83508c85a282", "comment": "Malware payload (Heodo)", "value": "c22d0f4379fcf40cdf58642f560e3fcb7122f439", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533958, "uuid": "10e5571c-c8ea-44dd-9c6a-f22c16d83072", "comment": "Malware payload (Heodo)", "value": "e29c974d46082a91314fa8c9ba7e5b2497d46efbb80ed766a0d0e2e1ffe9fa46e273295de21da10ebd9e31b2195c796f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533958, "uuid": "156aacac-a5da-48c5-82af-4adf667d193d", "value": "T1EE158D423BC5C0B7D36211735A93A25E63A2BD248F318AC76BD41BADDE345C2BB76344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533958, "uuid": "b69e2a75-8798-459d-8be6-5737835510ed", "value": "78a3c307bcdb5955fefde2169f849777", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533958, "uuid": "0465390b-f9f8-4659-a8ee-75c12db87665", "value": "12288:f/J+NC0xu2rPcHKeNmcZvF/SZGYzZ5Q/lN:HJ8R6mcVF/mGY4dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533958, "uuid": "d0747cd0-857b-4dfc-af7a-8b5547116ea8", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533958, "uuid": "3b8e857b-5a6e-46aa-97d5-a58133dfb14d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533958, "uuid": "9c64cad9-08a6-4df4-92b0-05bb29442d08", "value": "aejiogds.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc4e566-af5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648557477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557477, "uuid": "9f928a4c-9590-4f4d-ab18-f657d3a1a143", "comment": "Malware payload (SilentBuilder)", "value": "b34dd477695887411c6c92ce42dc157b", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557477, "uuid": "880f0ed1-3905-4b62-894e-eb91652fe4b7", "comment": "Malware payload (SilentBuilder)", "value": "2175a15aa9c69319877b72200420e140f9a8c0837b8aa9fd62001934085d8fc5", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557477, "uuid": "72839c10-b93a-4095-8611-53b387e4f0ae", "comment": "Malware payload (SilentBuilder)", "value": "e2be63ed336d4ba0eed6eee25cbb0c3b9410b3e7", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557477, "uuid": "d3a814be-133f-4985-a271-58965f411b25", "comment": "Malware payload (SilentBuilder)", "value": "616a2e92b40a996ba0e7374943d0bb6f5f676a0baf498d71d8bccd836c2e3a36ab08743d74f0abf7e15c2c3976a20692", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557477, "uuid": "c31771ed-6e71-45c7-8373-0d1d14086b79", "value": "T1DAC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557477, "uuid": "07ff4b29-2437-4771-b64d-bf2be7b998f2", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCI:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648557477, "uuid": "89422adc-cf2b-4bfc-bcce-06c0184a47fb", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648557477, "uuid": "99cc473a-491b-4d17-a3c8-4c3082f0d3ec", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557477, "uuid": "8a502beb-3920-4fc9-a90b-4e958084e055", "value": "OMICS Online.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac81c301-af58-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648555592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555592, "uuid": "feca2729-b4b1-4a83-a722-b1afd7bcb152", "comment": "Malware payload (RedLineStealer)", "value": "3f6d29bb9a3ddd6cb68799ddc458d147", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555592, "uuid": "689a5ba5-83fd-44de-b9fa-886c2cb0b416", "comment": "Malware payload (RedLineStealer)", "value": "219fa2180e6724ff3a675aed4499038587e0cf09aa2227f9e7ef3fc1cb08795b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555592, "uuid": "f58de60d-1003-4634-8faa-c2df7a66c1e1", "comment": "Malware payload (RedLineStealer)", "value": "9bb248f9de8b37cadbd05e813e2216ec9456bbc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555592, "uuid": "b8b8a697-eae8-4c46-9bf0-7680c40da36d", "comment": "Malware payload (RedLineStealer)", "value": "7e1a9b1951570951ddc2b7e6579a9dc06d89a86e90503c62531b3c0322714ef6636535c199587a6567e7c511bac13019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555592, "uuid": "04423e67-8e5f-4507-bf1b-ed59b69fb91b", "value": "T19384CF10BB90C039E1B71AF44AB993B8B53EBDA19B3554C762D53AEE56346E4EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555592, "uuid": "af7d20d9-29ac-4907-8722-eb92dac7d243", "value": "962dcf4a4b969d5194f73601a217ba6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555592, "uuid": "2f872a40-5b85-427e-928c-796c26e0a61f", "value": "6144:AzAu9Quh5k5HmRWVewNSYhLlNUyyvXns4SG6DvJirONZjAA:AzAubq5HmgVewz5GyyvXH967yONV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648555592, "uuid": "3fb59af3-5609-4dc0-9f57-243cb6d63fc6", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648555592, "uuid": "6682104e-d715-4313-8ad4-00d2eea297bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555592, "uuid": "5effd988-3717-4073-b5f7-5661f065b867", "value": "top.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04de5d40-afaa-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648590530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590530, "uuid": "95bc738e-266a-4a4d-92cc-e73406ae35a8", "comment": "Malware payload (SilentBuilder)", "value": "ee5035310a6ba6c10073c929e5924582", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590530, "uuid": "b46c17a0-eefa-4edc-b26f-7c0909231f3b", "comment": "Malware payload (SilentBuilder)", "value": "21b493331dfa55c98bb5ac6fd74d85190940cfbcd4c7a6c499019918276e0cd8", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590530, "uuid": "36278a25-89d1-4b2c-99c8-0fd56f9107f3", "comment": "Malware payload (SilentBuilder)", "value": "e99c1b6dafa0450098e9765e97c01187f7511474", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590530, "uuid": "fd27ec95-30bf-4559-945a-7b695a7893d9", "comment": "Malware payload (SilentBuilder)", "value": "ad41b88ef8613aa18793448e39cb0fb1d57f73a7085041ef60d7fe0e913b53aba6dd5b13387f3079ff1b071ee36e26f9", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590530, "uuid": "6a85898c-aa8f-4262-b49a-5b63ac7a3ad8", "value": "T10BB39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590530, "uuid": "8f693aae-f1aa-4fe8-a3c9-df93babdd01b", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMO:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648590530, "uuid": "a6c0cf9a-51c8-42f0-a449-1fe44ef80a5c", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648590530, "uuid": "1381e468-76e1-4052-a5c6-285afb267ac6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590530, "uuid": "9e23ab4d-515e-42da-a495-f176ec7e7a5f", "value": "ee5035310a6ba6c10073c929e5924582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cca3f5-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648529112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529112, "uuid": "ca3cdb68-bf32-4792-ba0b-9dc75ca0bbda", "comment": "Malware payload", "value": "ffb381cd970f61d2d90ac23d7b56911a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529112, "uuid": "c87bab16-9ada-4158-a010-1a197147b207", "comment": "Malware payload", "value": "21e4f80b25a605ab9160cc30e4d6936a1b4731760603207097fa151ac7267c0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529112, "uuid": "2f5df9ef-781d-4e4e-a5bc-6ab12ad4ee13", "comment": "Malware payload", "value": "34b975eda1a46b9b398269c8e418fb0b209363a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529112, "uuid": "a4c363ba-0884-4472-beb8-941abc104397", "comment": "Malware payload", "value": "5075282102add77015dd71fbf38beeb1ceba8e6d7f1a49117fbaa3268719b104d4aa3ff40da4925dd4f4b5b472b8c135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529112, "uuid": "046fe706-f54c-4143-9e88-b9ad2a94f398", "value": "T1A2F40211A790D035E5B716F4497ED3AD792E7AB09B3491CF22D26AEA42346F0ED3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529112, "uuid": "7739c2ea-ad5f-4214-be4b-9506f7ff5571", "value": "8b43e1344b27321e8381c60a4a19bca2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529112, "uuid": "f19634c3-2d9b-4140-9544-ad896034fe00", "value": "12288:nSx0yHBjyGLwIY87h1pk5jrW8ubxHO1avuRl4+r319sMbZrUKTNzVV:xMWtY3pEjI9HYDYwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529112, "uuid": "2e04d6d5-dd3c-464d-9ce3-a0a594d53de2", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529112, "uuid": "661b5890-0f59-40fa-afa9-6a0a92ca4c13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529112, "uuid": "beb5dbeb-59ec-451a-bb80-8b8e121c87bd", "value": "21e4f80b25a605ab9160cc30e4d6936a1b4731760603207097fa151ac7267c0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78915359-af86-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648575262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575262, "uuid": "0481a9c1-af34-46ab-8b97-846c4638dc23", "comment": "Malware payload (Heodo)", "value": "85ab1130a545cb73bea376293af23a37", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575262, "uuid": "f8fead75-4b45-42f3-b08a-0fa02c84dad5", "comment": "Malware payload (Heodo)", "value": "221c6df689d254c04dcbcb67e629ac0088b5fce3eabf52127a1755e0dcfeddda", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575262, "uuid": "3c3de761-9e9a-45e2-bb61-dd5cab734d76", "comment": "Malware payload (Heodo)", "value": "dc9525d627baf2369165e7ab637b55f323b60e54", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575262, "uuid": "f203c813-8ee5-4fc9-8525-1286b75f23ea", "comment": "Malware payload (Heodo)", "value": "55d5d232006df36cb0ceb8105396ae225a989997b7d12630955ebb58dd67d26576441517fd186de8b33d8d1ef2a8ae27", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575262, "uuid": "0c548cf0-0ee5-467b-b88e-ee25cb355bce", "value": "T1E2A49DC87582C132DE7B4B75C552CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575262, "uuid": "bf14b129-cd0d-46d5-80fd-6890740cb564", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575262, "uuid": "da96148b-e1cd-47f9-b15a-4774cfe51204", "value": "12288:myXvaWo3sPddfrkTEpBLsORdPDpFlrh5W:F/as1dDkqHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648575262, "uuid": "c093afee-b367-47e9-b688-646c33cd47dc", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648575262, "uuid": "04588c81-de9a-4836-af6e-3608d8169ae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575262, "uuid": "3d08c317-9618-492f-a2b8-1f2997d3415a", "value": "emotet_exe_e4_221c6df689d254c04dcbcb67e629ac0088b5fce3eabf52127a1755e0dcfeddda_2022-03-29__173413.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd961fc-af29-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648535331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535331, "uuid": "beff596b-50b4-4444-b57e-3b02cccc7c15", "comment": "Malware payload (Mirai)", "value": "9dd42e2d82b7857cec0f5326f3ba45da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535331, "uuid": "a88b0f61-3c9c-41c4-891c-b6b32b35a962", "comment": "Malware payload (Mirai)", "value": "2228fc871c689249c61b9d110f17be2c6d105fb581a8fec36d355deebeb82045", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535331, "uuid": "0b8b8c58-231c-4527-872f-1c8d04370874", "comment": "Malware payload (Mirai)", "value": "e5974b18293f07cd2625eb4164899b87dcf2fb7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535331, "uuid": "cb16d2f5-e2fa-4d7b-949f-d8f78d0520fd", "comment": "Malware payload (Mirai)", "value": "0d4992ba8cf06aabb1db816b6a78b1dda053b34ef66a1de701f248ec801208fea4585250e2119e9a4a09ef824f613656", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535331, "uuid": "7a2b9340-59d6-4b62-9f4e-90930399f69b", "value": "T1EEE2E18385E5C7EDE1A7D0F70CAF7919B940C32D90F8ADAF1798B93320C6F542668169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535331, "uuid": "3541dcb0-5805-458d-baba-ef03e2d86634", "value": "768:7PrnwTgBSr+TGkC14fnZOAP5XYN7szMQFnbcuyD7UiyqS:AsBCkC+XYNcFnouy8ZqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648535331, "uuid": "e44bac6c-532e-4fad-89b5-d83447f42fd8", "value": 33024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648535331, "uuid": "191867c3-99fb-4c3f-adb7-2568262f60de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535331, "uuid": "eb3318dc-227f-4884-b8ac-8c497e8b0e0b", "value": "9dd42e2d82b7857cec0f5326f3ba45da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e8917b-af99-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648583576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583576, "uuid": "4854534c-123e-4309-8a7b-000d10097187", "comment": "Malware payload (Loki)", "value": "340f282ecb187d8d98e7859ed4904e7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583576, "uuid": "e917ab93-774f-42a3-9d93-c108f02d8d14", "comment": "Malware payload (Loki)", "value": "22b4b7794624e7f97297da6b23832f26f54e57b77bdb393f9c4211d6ad31c9c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583576, "uuid": "a5df4c62-4a73-4dcb-846b-2d0187b10898", "comment": "Malware payload (Loki)", "value": "18079d4137c10498363097ec05c039b360a293b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583576, "uuid": "408b9666-9618-4b6e-9f4d-b5607002b6cb", "comment": "Malware payload (Loki)", "value": "0738c4327a74c70ed78fd1a8e601f5d7b835fef8ae413f32f3637bbfa6ebe86c4dc66a5f9ee89126cf47676aa1aabb45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583576, "uuid": "2d569dbc-b702-4999-8e06-4493768f8ad0", "value": "T1A8251200F2F81AAAC9B607B9583181002737FB2B421EDB4E35F6348D5977BC2655AF5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583576, "uuid": "5932d8c5-bd2c-4f35-9107-97964cf8b072", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583576, "uuid": "358149af-fbd4-4689-98e5-ad2be1395ad8", "value": "12288:e1SgjjxSzRQIlZ7k8+msr/1CVF/SmgS4jmeHKXDMhCTHW8TvhklxZT4m/tOkmywb:9gjjxLIl2QsDAP/SmJSTGhLfSlPTRgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648583576, "uuid": "64630513-c0dc-4077-b59f-f22653d92361", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648583576, "uuid": "ada7a451-8f5f-42ff-be17-b78508d34530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583576, "uuid": "fbfb776e-2889-461e-8a0a-a7a0a83e721a", "value": "PagoSwift-29032022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3aaa4d0-af62-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648559899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559899, "uuid": "508a57cb-7ff8-4b92-a5fa-607ecc7f3897", "comment": "Malware payload", "value": "41a50f9f218658295d6a34934c8b3748", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559899, "uuid": "4c3c3229-0e61-4f38-99ab-04a7377719c3", "comment": "Malware payload", "value": "235d9564f07487595981b4d199ced7767ae39a96bd0f9d2f0e7c1c700d2d1116", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559899, "uuid": "b2e43eac-623c-4767-adfc-077bff2fd5fa", "comment": "Malware payload", "value": "b7a58792e4684ae4ef49a58e49b967f62e5d409c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559899, "uuid": "41973aa3-7217-4bf8-917a-c63d79decba2", "comment": "Malware payload", "value": "19356b2f21dda8758264f5e70de451d1852fbf627d1dcc825f0f60b1b6aa20a79bd91a0f8e51ce98d41ff9e2b3ec257b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559899, "uuid": "e8e4f851-4eef-4a42-9dad-53745b2fb19d", "value": "T17535122827E8C551EBBE27FBF0F444419B70B52B1627E71E82C278DD0E623C2995A753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559899, "uuid": "03d5b946-1fef-4062-b44a-725f57bf889c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559899, "uuid": "dc47173b-50b9-4b4b-af9e-0aa1c3003b3f", "value": "24576:RKeEzDSmvmQlhieTt2qofJ+6te3t09BMI0I6f/nGrfWP:RKejmvD0qo06sd09BMI0VHnGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648559899, "uuid": "db1e91ca-d1c5-44bb-a880-75aa7fcd709a", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648559899, "uuid": "98823391-54e0-486b-9449-adac81d786a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559899, "uuid": "65f2618b-2e15-456e-b3f9-c750dad5ae73", "value": "Instructions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1555d644-af4e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648551044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551044, "uuid": "5091c03d-7e2e-4300-a264-2f6b61a00e37", "comment": "Malware payload (SilentBuilder)", "value": "24486504f66a35d5c4c3fce7b52fdc68", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551044, "uuid": "02822877-b2ce-4732-9df9-f70361e2df5a", "comment": "Malware payload (SilentBuilder)", "value": "23635563212ae325ba6b388c2ea723bceb1c611601c437947dd49684f705ae62", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551044, "uuid": "d3520cbe-0304-457c-bfa9-11dd61e4d671", "comment": "Malware payload (SilentBuilder)", "value": "b3b5bcc26605935aa9d2195caa963ac99ee0d2c2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551044, "uuid": "6c883f53-3f75-4ae6-9b94-0416c56af6b3", "comment": "Malware payload (SilentBuilder)", "value": "56c60de6af88312ffafecca63d49a4fc276640bfcbc01ab35a74c4d855f78ddf5e5f9b4821c9943b41f31dce14efe61d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551044, "uuid": "d899fead-7b3a-4eef-a8b7-aca752fb26dc", "value": "T1CFC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551044, "uuid": "ce9a3280-8a6a-4877-a4ba-42ea9f130985", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC4:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648551044, "uuid": "ea0a2675-08e7-450b-a3ec-7f4780542f10", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648551044, "uuid": "8254ca44-f72a-49cc-9a25-843fd0d26c46", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551044, "uuid": "ba9bd4f4-7f2b-40b8-b47c-7ea9cb2bb6b6", "value": "1007556411564355610.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4c0622-af36-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648540959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540959, "uuid": "189202e7-fcdf-45d1-b8e9-0d35b07c2773", "comment": "Malware payload (Formbook)", "value": "cc2d78c736c1f40ba3c1e02cda9001c5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540959, "uuid": "cfeb979e-77ce-4ecc-b878-36334b02cc2c", "comment": "Malware payload (Formbook)", "value": "23a1abebfcdfa77ad775dfdf653651714c9958ef4b96e959869df2891b137e7a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540959, "uuid": "defa4a51-f689-4355-bd71-52287252608b", "comment": "Malware payload (Formbook)", "value": "3b9272cf3a98f5cc04bc386e74ea15afeb9e4d27", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540959, "uuid": "c1b72099-05f1-4d21-b8b6-1cc9b34db163", "comment": "Malware payload (Formbook)", "value": "0475422f60dc4da6becf6f322eca2d3cad321d19cfb87e40afb5a538868cd6296f6969875b8d44261efa4c0d50a5ca8c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540959, "uuid": "e89e3779-d387-4527-a754-104faa6f28ff", "value": "T18DB423C6B374AC5D8A09BC40D7115BCBF2C92173E4CFE18D570EA468D3829676B7A0E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540959, "uuid": "affca78f-ae78-4691-9180-fa2ec99b8d4a", "value": "12288:TNulztst858CrGVCqy7ZxOIj4xSbQLuTHTCuj:pMqt8anFy7KI8xkQLSCuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648540959, "uuid": "1392e13b-65a8-4421-9a6e-92d3a23ddaf1", "value": 514209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648540959, "uuid": "311e72ec-15b3-43b9-bc82-c2b415cc4a19", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540959, "uuid": "ca4eaa09-de19-4119-8525-cf0d40c48e8d", "value": "00009453725262.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f046d6d0-af5c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648557424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557424, "uuid": "1fac9d2c-72e3-4965-b4b4-55440f641ec8", "comment": "Malware payload", "value": "0a6d071a17608e1a8f6689a89045f9e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557424, "uuid": "c53685a5-fff7-42bb-bf3b-0448b6a8b89e", "comment": "Malware payload", "value": "23a5c9de612ce6a2464263883efb5809e29d8412b1c27866d4c26ea173a3297f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557424, "uuid": "c1f615d7-eb72-494b-9c40-dfef294fac43", "comment": "Malware payload", "value": "374e2bdf221f930217fc4741a3ae6aab6f2df6c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557424, "uuid": "9a45a7d0-a382-48b2-b6bc-7db7d10d94a4", "comment": "Malware payload", "value": "97e373f09de7d2a5362ff4041eb0a584ebdcfb15f95addb0cd2883f84f3db945c278d392e48450098eeb3c6ba22a2374", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557424, "uuid": "6bc5d452-d09f-46c4-8d70-ca9ab051e623", "value": "T14C447E6AA3E51D95E9BBC5B9CD93D227D7F234091A60D34F52B4CE966F03322B21C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557424, "uuid": "4da713a6-7f43-409d-98c9-c1518fe05ae4", "value": "6144:3jOc9lLYJm9qCR8h2O1CCP1GzzBpbf7DWtM555KMu:339VYJj0g2eCCP1GzzT7DWt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648557424, "uuid": "4430dfd0-2913-4544-afcb-42e8a6829ba9", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648557424, "uuid": "1d84739f-93f2-4a9d-bf66-e107b1df3c9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557424, "uuid": "245f1420-d02d-4e74-af80-2f668d4f0269", "value": "a560000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8662a1-af87-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648575753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575753, "uuid": "1732ff1c-a7e1-4b36-a368-1c38de3e54d9", "comment": "Malware payload (SilentBuilder)", "value": "fed638b70cce190bc723bdf330465062", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575753, "uuid": "2ee6b562-43cc-4ee0-b1be-9b4237f8cacd", "comment": "Malware payload (SilentBuilder)", "value": "23f8a8f49c3c031d30875fae0ca861f77ca7de37772390ea7645e05f5eb02cba", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575753, "uuid": "931ca5c1-a220-48cd-9210-962b3d49ae7a", "comment": "Malware payload (SilentBuilder)", "value": "24cc7ef71f6b63ef09250ad2346c928fc52605a2", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575753, "uuid": "1d817b0d-bed3-4e19-989c-6a5210799d35", "comment": "Malware payload (SilentBuilder)", "value": "4ad630667da46fb7a80d8dfa0ed56d08efe4cdc2057a04d050f93b84d7ce687d406a9bd6ebd52f91fe2dc1cbd6cf3161", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575753, "uuid": "42201417-320a-40f3-8074-dc16ea61a118", "value": "T198B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575753, "uuid": "2fff5b2f-1091-421c-932f-b4050f6006e1", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMZ:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648575753, "uuid": "9f6f969e-dcf2-4160-97d7-e66511cc9605", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648575753, "uuid": "9687415b-53e6-4064-a06b-00ec10cc1359", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575753, "uuid": "f843e860-7982-4574-aa11-115e925e3e7b", "value": "fed638b70cce190bc723bdf330465062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e06b788-af5d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648557662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557662, "uuid": "b68c5dee-d952-48c9-8149-8225d21c8ac5", "comment": "Malware payload", "value": "bcf1f2c32895109b31f8007ed6a47337", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557662, "uuid": "c6ecb1f1-8740-4e13-95c1-d11b50b98fc6", "comment": "Malware payload", "value": "240b53f32aefc3c4786e9e96f7f63a516df159cd7b67aa3e8dd505e9a7384b84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557662, "uuid": "98814195-6a5c-47f2-b71b-0e1f6d1c8189", "comment": "Malware payload", "value": "6f15d4914434fe4443f9859d31ff1e389c2e08cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557662, "uuid": "1c6e8171-efec-4a14-8010-cd5d0a8f5bc7", "comment": "Malware payload", "value": "288a24f088c5692d915a8c3b573b076adfa16e06f2052265fca7d7b79e07ffad7c06e60084155d04191912f7ec82ffd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557662, "uuid": "6216d7c2-4c3b-49c3-b35c-2aefc870440e", "value": "T1BC346D6AA2E50996FD7BD6B9CD93C217D7F338451A64C31F13B0CA9A6F47321B218342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557662, "uuid": "1d29d0b9-5ef0-4fdc-8307-8279325f8d1c", "value": "6144:RyihnaKbEFhck6xW3SJ5gtS3z9pjFAlqkO4a9pf:Ryih1EF2k6S/SD9pylqj9pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648557662, "uuid": "8a8f6c3f-4de5-4515-9b5c-15122cf2fa7a", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648557662, "uuid": "d01cf311-ac2a-42d1-a3f8-34ca3a05e181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557662, "uuid": "6f2885c1-b723-463e-8dd9-4e7a8e544512", "value": "c2f0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a27e901-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648561789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561789, "uuid": "9eb8807e-a759-41ee-9ca2-c9b733083ad3", "comment": "Malware payload (Mirai)", "value": "a78f10ac71c4173446121e756117d013", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561789, "uuid": "aeec86c5-f3c1-4332-a90e-54846fddc64d", "comment": "Malware payload (Mirai)", "value": "24189fb24fc45e84e8772fe6b14794733b2a51564f5119d58e8b8ddbfeab5ae8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561789, "uuid": "b46da0f2-e45a-4db3-8129-a5b18367f884", "comment": "Malware payload (Mirai)", "value": "5f2fed6b14a8046ae3f48002d75cf482fdbed5c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561789, "uuid": "2e38c204-2875-496d-bc11-2b48dcc4a24a", "comment": "Malware payload (Mirai)", "value": "0282a3417047ec7dae5a8133df97f2aef8d2e6bbb15bb0e391c111e654f4a66f7e3736afd8ea28ddbe65b323d9a337fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561789, "uuid": "36cc22f3-2664-4a5c-b442-beec780c5f4b", "value": "T1CFE2E109BBB571CDE5101BF802255DAB3C5C9EED4929EE9A74ACFF081766E00F58DA04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561789, "uuid": "838d5454-63a2-4654-9836-e85e5a79d903", "value": "768:hq/PdirgiOMaa7X0oYPfTlpntWJQIDCAo6Y:hq/P0JOMP7X0RTzn01o6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561789, "uuid": "626e3d08-bc6d-4580-aa38-a5d950c2656c", "value": 31608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561789, "uuid": "f397031f-d294-408e-8a73-fa1f89235e74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561789, "uuid": "fd50e82b-e273-4950-8c24-7490fefc0270", "value": "a78f10ac71c4173446121e756117d013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6d8bed-af2f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648537907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537907, "uuid": "ca8e9ddf-43e5-4ad6-83f3-4ff3128f9d5b", "comment": "Malware payload (AgentTesla)", "value": "4d9b67d7927f3ee017a0ba551c87594b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537907, "uuid": "dee88dc0-0939-4f30-82f7-d925a5a2ff28", "comment": "Malware payload (AgentTesla)", "value": "2435ad06113ca4d5811c288e36243d7d0b54075b229d61432fa34ba1eaadf13f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537907, "uuid": "3ddc3b02-d133-455e-8ff1-9ae439dda6e3", "comment": "Malware payload (AgentTesla)", "value": "2102d9321fca3c47e74762ac3c12d61ed4c8a3bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537907, "uuid": "f986a58f-7144-4a40-b93e-5b0d8c986288", "comment": "Malware payload (AgentTesla)", "value": "568ec554f8059edaa799f269e154e4a4ba5fa941b3bd30cd1fb575e242f9c801d8c40e0e5edd6a7b812ff1ce485d4938", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537907, "uuid": "1344d5e4-1210-43d0-868f-8c7dd92c045b", "value": "T1F3D4DF2277485B66C07C763A0561D46123F0FDCA2A20DB2E7DD6BBED36766C16F26302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537907, "uuid": "03d50f5c-b56a-4363-86f9-1fc878c0d41e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537907, "uuid": "1c506517-4b3c-4e7c-b9b3-acf050025a7e", "value": "12288:6rz0GNL63Uoib2qIx1EH5y4hagv/bLEhM6f:+kObG14y4A+jwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537907, "uuid": "318d4f6b-a5f9-46cd-9f9a-a13de907a641", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537907, "uuid": "8d5c6920-0422-4429-8a44-5c9280ff8400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537907, "uuid": "e1677843-cccd-44f4-a15b-71c1aaf0fe3b", "value": "DHL Delivery Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea781833-afa7-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648589626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589626, "uuid": "d619af34-5e4a-4bd2-ab2d-259b4608291f", "comment": "Malware payload (SilentBuilder)", "value": "09e00453026bb3885aadee094d51f205", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589626, "uuid": "44a1198f-7a7a-4a3f-9522-4ac3570efe71", "comment": "Malware payload (SilentBuilder)", "value": "24a1941927cd7d54e343a4d2eeece0639b6502fb458e92b9e9d325cb138842f6", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589626, "uuid": "3115d245-80f0-4cc1-951b-d9642fb31078", "comment": "Malware payload (SilentBuilder)", "value": "77ce9b44d545120db5aebb276064b3b460e15ed8", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589626, "uuid": "30a1a7fa-c030-4f2f-be19-2e5eecb37741", "comment": "Malware payload (SilentBuilder)", "value": "9a337bcbc811835290cdd08219b4ca5be1ae2fd7210fe498f994e2c7b5643b078e9b7fb3586c69b28b571b426e0a6c45", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589626, "uuid": "664bb3dd-e13a-4d26-be6c-556f0a8cec59", "value": "T1CFB39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589626, "uuid": "58ecb06e-beda-42fa-96e7-96f60af5fc0c", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMi:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648589626, "uuid": "d5caeebb-841a-4b60-8186-43af9bb65415", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648589626, "uuid": "63e84101-1184-47c6-af66-ccc87d1a16b0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589626, "uuid": "864aee21-7dc9-4b5f-8079-270e3f99efb1", "value": "09e00453026bb3885aadee094d51f205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66953dfd-af27-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648534430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534430, "uuid": "9a3ec9c2-e6ad-4411-9dd8-beaf5f1b016d", "comment": "Malware payload (AgentTesla)", "value": "eea303ecdf689cc188510134bdd86699", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r10", "colour": "#E6E94F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534430, "uuid": "9557cd6b-40fd-454a-8e8a-064dfaeff345", "comment": "Malware payload (AgentTesla)", "value": "2527f4f8118cb7bd388615ac910ab6bfca46f049fb4bfdde73d0449efc45cf16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r10", "colour": "#E6E94F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534430, "uuid": "53b01939-9172-4983-9484-36b092aa7b77", "comment": "Malware payload (AgentTesla)", "value": "5490b5f88d1667d3c07ca44892278054c3f0024f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r10", "colour": "#E6E94F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534430, "uuid": "737ebcaf-ff2b-4d1e-9b65-84dec8b439f4", "comment": "Malware payload (AgentTesla)", "value": "3268b01806aee4f937af73ad4842bf1b821bb571117f621a9cfa57c0d8da4632551ebb1e20fbba3880b09d7ab404f321", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r10", "colour": "#E6E94F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534430, "uuid": "5e870b89-709a-4cee-9178-15713b1d2e73", "value": "T1C17423D2FE8207740CA3009FE6DDED38E2F64867C526352E7A3B8611F98795505CEE90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534430, "uuid": "7f358a01-988e-472c-a447-52e1d4aa090a", "value": "6144:H0xjbePF4KC4mSucdFmY2bP15dBDG0qNoZXXTjTyxp0wpX8MS8cl:BPCtd8dFo15zqKjTy9X8MSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534430, "uuid": "8ab5355d-ab91-4017-99a7-77cac746c332", "value": 344422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534430, "uuid": "d422a981-c493-44c6-8472-3a4f7d699aef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534430, "uuid": "a082ae9c-08e6-441c-a813-047b3b605a75", "value": "TT8543489876.R10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b038b80f-af2f-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1648537989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537989, "uuid": "478852a9-c09e-4ee1-8af8-6b7c73881bf7", "comment": "Malware payload (GuLoader)", "value": "86b0f2c74890747ce9df10cfbf276dcc", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537989, "uuid": "919f2491-5432-4ef7-9bbe-34850b0feb08", "comment": "Malware payload (GuLoader)", "value": "253f3e1ffc17c3ef73f007378392b6b18c856f03175e978572bc3f105b3754a2", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537989, "uuid": "9e44bd25-058f-4d6c-9252-a6033a2e7b67", "comment": "Malware payload (GuLoader)", "value": "55a8d862defbbe783100b560c02e3ccbec32d372", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537989, "uuid": "02ab1ac0-4b37-42b9-87f3-99b6bc823cdf", "comment": "Malware payload (GuLoader)", "value": "f99f9992e5042ae6308d0f55c8a2e5becc98d22c22263b5058f1c36abb33730d011a8051fafb47dfda0c6fa4c36e7f0c", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537989, "uuid": "14966b96-6567-4c4e-9a81-a34c2145c956", "value": "T13F34D0407BA4CA57D47307704DBA837277B6DD122AA2870B23407B6DBE337D1A91A3E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537989, "uuid": "37f0c238-d729-44e3-869c-8853c1e924c2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537989, "uuid": "050ce1a6-7771-4ce7-b93a-e0455ee5865b", "value": "6144:uYa6YglXKajCOLq8KL9oALrCsrB1uqa+9:uYRK0Coq8tALrCWrXaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537989, "uuid": "dee3024c-2189-4bd5-a3d4-e70a78806971", "value": 234168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537989, "uuid": "426fff8d-10db-41dd-9113-e21e286bf1aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537989, "uuid": "81f4fb1d-a44e-4dcd-acae-911c18e720b6", "value": "HSBC Customer Information.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7467ce40-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648537030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537030, "uuid": "d4e13bed-5bcb-4fc7-a6f3-a5cda47d403c", "comment": "Malware payload (Smoke Loader)", "value": "c6a26f8f7639474cb02244fb121cebd2", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537030, "uuid": "395f40c5-e180-4203-95e2-0431785bb8d9", "comment": "Malware payload (Smoke Loader)", "value": "26a9abcf3345e335a22af2dd2fc18d6166eee124ead24f745b45a18bf2995575", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537030, "uuid": "930cb252-0588-4980-9fec-db5116fe697a", "comment": "Malware payload (Smoke Loader)", "value": "8f46912c2122f18dea60f117d4a3c1cf3db1a6b6", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537030, "uuid": "37abb1c1-6299-4486-9d8b-213b7929ac0e", "comment": "Malware payload (Smoke Loader)", "value": "ff5083044e25cfc1230abacb7051a8d5aa394cde135afc7e9d1089efc66311272dcddc54aa7f5e0e1d9f5ab119690ac3", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537030, "uuid": "f8b4d542-8f96-42fb-8802-b2cc155d050f", "value": "T1A914123A3A207112FD4B63F94BB3F83F4F39FD15A817190D7551346DBA3698A4028DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537030, "uuid": "2c213bdc-e35c-43b4-b0c5-85e52dfa2c7e", "value": "3072:olQe0Ki/L+aZ6cEx/jzk6pb6RJfNpfwveWar5iRC9pDA6pwea/HzppG:/ee7PpE6Rl7fAaoR6pDvyp/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537030, "uuid": "943f9962-3095-4034-8050-5b12be4e8df5", "value": 192264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537030, "uuid": "dc151276-c03c-4f66-a6b4-db079e0abca9", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537030, "uuid": "ece13154-224c-4711-852b-0a47ee7b211b", "value": "Order SB31S53J.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abad31b5-af87-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648575777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575777, "uuid": "d845c719-ca72-4448-9904-e5b249734e11", "comment": "Malware payload (SilentBuilder)", "value": "3f259e197599be8e71f2a6c25f07d28e", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575777, "uuid": "4276c320-54f4-440b-a796-1a6505952cca", "comment": "Malware payload (SilentBuilder)", "value": "27189fea209b3bebd9b9d190466aa9b9b629e8f543d2d9fca45fa5a6ab72cea9", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575777, "uuid": "ce088b38-3762-45b0-b2cb-9e4d997da17b", "comment": "Malware payload (SilentBuilder)", "value": "f6a88734bfce66908cacff846f8a9007ede598c8", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575777, "uuid": "ff9baf52-01f9-48c7-af79-b8a305f14b14", "comment": "Malware payload (SilentBuilder)", "value": "6d30c86c74f9b14de100b775194da5e2df34d66c6395a1f569cbcd332cacb0284edcbab2d6f92438a5acbafd5f7ced07", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575777, "uuid": "2e47630e-d75d-43ef-ac27-2eeb26aa4bca", "value": "T157B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575777, "uuid": "4680f170-1476-4005-85bb-0b8f63d8b310", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsM1:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648575777, "uuid": "a21acb00-20b1-44bc-a3e3-a41e18d88f77", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648575777, "uuid": "44572454-8694-4944-83b0-4ad2e480420e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575777, "uuid": "a3baedc4-76fa-48c9-80d1-6432200232d2", "value": "3f259e197599be8e71f2a6c25f07d28e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678cff2a-af29-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648535290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535290, "uuid": "e2fb0a71-9558-4a9f-bd44-d76b68d04aa1", "comment": "Malware payload (Heodo)", "value": "18438898accea72967e5400222d00b2a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535290, "uuid": "3269af9a-daca-4660-8718-ed702d984515", "comment": "Malware payload (Heodo)", "value": "27dd7c195b62f7505a6e2607c5a3202eee565a5cac5222fa9e2eb1e756246886", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535290, "uuid": "963a7a68-b083-4a47-bb5b-932c66448d32", "comment": "Malware payload (Heodo)", "value": "6934ceb3ceff400ae8535bd904584834756ec77e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535290, "uuid": "92bc956b-4bcf-474b-8fab-78b98e437b39", "comment": "Malware payload (Heodo)", "value": "52010b71720a41abb6106ac48ef32c4db5269aa2504b23c5c15c72a721594038d61d552b9cbb82e43b75fb566118c266", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535290, "uuid": "cdd98164-15fe-4d9d-b86a-0bc0e20a8721", "value": "T11D156C0377D3D4F6C6570B3701019A7432A67F628B63D1BB3AB0A97C2BF69D29624712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535290, "uuid": "277e320b-ed7e-4b92-b8a3-57e80057b0e5", "value": "a75fbf174f418163882037d6ea99f755", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535290, "uuid": "dd79f0d8-5a1e-460f-a212-46e9375a3d70", "value": "12288:R8q2m092irmW0bkvW3ZYI3tNZzw2gYGly:R8rrr0bMLAj6VYGly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648535290, "uuid": "31837299-5a7c-4a48-a45d-81dc2a9d8dc7", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648535290, "uuid": "92d7d70b-8dbf-416f-bf08-9fb39f68c42f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535290, "uuid": "f22362bb-e6ad-4fa3-b94c-268df613a61b", "value": "emotet_exe_e5_1a8d6671f2c8050f13378fa4199807cbec9f359018b992e54141a2ec9556ea42_2022-03-29__062804.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3fe747-af6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648563677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563677, "uuid": "0a815a1e-dad5-4497-8cca-4a9fc3d203fe", "comment": "Malware payload (SilentBuilder)", "value": "473dd4a29ec589e3e592d600e1168f41", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563677, "uuid": "4240274c-d4f2-4e57-8dcc-bfad5cd2d7ec", "comment": "Malware payload (SilentBuilder)", "value": "2827bb5481f07ff33a915872039378bcec4228b90894b031b4380d64d1006d63", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563677, "uuid": "2010d283-c735-4742-89c6-d1eb97d91600", "comment": "Malware payload (SilentBuilder)", "value": "f73012cde405791abc628535d46aa180280fe7c4", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563677, "uuid": "4772c347-8df4-48a8-8492-b42c296d8b63", "comment": "Malware payload (SilentBuilder)", "value": "d6535ecd374dbc06682ee0dd9f583af46568583a2ddf2f17fb8393fe14c5e0fa0d4478e01344d491862838eb2752bee9", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563677, "uuid": "b764e0b9-58dc-4694-8e3f-54b30d94f944", "value": "T1A3C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563677, "uuid": "7a896adf-bb98-4a3c-a78e-d4efa9034169", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCY:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648563677, "uuid": "817d7228-e51d-4a5f-ac49-a22581bd7b6a", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648563677, "uuid": "8f0dba93-de6c-41c8-9d3c-c1923032a380", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563677, "uuid": "10dbba8b-ec18-4f73-af9b-d951705fae77", "value": "imedpub.com_2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebc9cc2-af89-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648576453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648576453, "uuid": "7feadd68-c285-4ecd-aa50-f56190f98d3f", "comment": "Malware payload", "value": "94d283d2e8ae409f691d310bf3ae8ac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648576453, "uuid": "e43d3fab-334d-47b9-8998-3fdb82220c3e", "comment": "Malware payload", "value": "28ce5e1b19b7e02d512676368f781d92dde4d344affae737a45703205d9620d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648576453, "uuid": "32e32248-05a7-48cf-be6a-c0110d23b3df", "comment": "Malware payload", "value": "e663ed2d68406b1c338c81c704627a9f8315b90e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648576453, "uuid": "fb4e1674-6ea1-4b27-9c34-96094b959729", "comment": "Malware payload", "value": "530dd7bd8248de7b8c3974ecbfce6128d92679ab4519c9c2c8f02053026236e6e028230d2a81a31ee22bc490acadf8c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648576453, "uuid": "05e8d129-ac31-42d6-9cc6-af95a9d56881", "value": "T12805D076E3F86F4AF0BE53788020946E77F0EC42E7A1E55E7EA211F90961B414792F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648576453, "uuid": "3e5a7010-3214-478f-a8da-efafeb570e67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648576453, "uuid": "33764f51-8a75-4355-aa07-fe94d7cd50b6", "value": "12288:NaQKPlTEnO736siUxcWz7nFUYpoToeOFMtE6dLbsFsjtfvlNEHCNJvwdg:QQvBbccWPFU7seOF96kspnlFJvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648576453, "uuid": "a7fdf23c-5e43-402f-b474-cef6bbc8a1da", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648576453, "uuid": "10d45322-12e5-4220-9b5d-afb5ccdeb7bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648576453, "uuid": "8d66c92d-9097-4445-a3a6-52c0d06d10ec", "value": "DEBIT NOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d8fb6f-af27-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1648534371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534371, "uuid": "317a3991-9b5d-4a9f-af6a-5501986e3a31", "comment": "Malware payload (AZORult)", "value": "1b24abba0cfc1d62d50e12275a1e7d8a", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r20", "colour": "#C0872D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534371, "uuid": "decc701e-6b24-4087-8239-df33962f3415", "comment": "Malware payload (AZORult)", "value": "2a17b33d0d38b0628d3bd1378baad4362b12f005a671d9fb4beecffc5594ba9e", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r20", "colour": "#C0872D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534371, "uuid": "dffe8412-4a0b-4c3e-b15f-33092406bb26", "comment": "Malware payload (AZORult)", "value": "42c0f55d31d29bafbc293f5db8b4ae2492cfa06d", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r20", "colour": "#C0872D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534371, "uuid": "0bd277a9-e6b5-4a21-a7ab-a78258c05223", "comment": "Malware payload (AZORult)", "value": "b2cc9c480ac5ddf69cf84e3b450277739067669b2c9b16686026e98125f0d6d188256bb7ec6fd55f67fe3791669c75e6", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r20", "colour": "#C0872D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534371, "uuid": "393545b1-22d3-4932-82f4-9427ef74e0be", "value": "T1DE1533B7028FF81844435FFF9BC6E1503A9F9C171F6A2664602EFCAE94A67406906F31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534371, "uuid": "6833b4c6-e7c7-4dfc-a98c-b698d3f7c790", "value": "24576:CwIFH6bd/7yHmvH3yYfOaw7Bsv9NG3lztHtuEnK:CR96bF7yHmvHiYfeBMWH4EK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534371, "uuid": "14e4aee6-655f-4203-af6a-98db4bf51258", "value": 944143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534371, "uuid": "5291d59c-9cb9-4121-9e40-c08773b68907", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534371, "uuid": "497abf7b-f1ad-44fa-85e9-68dad8e1734d", "value": "Dhl Documents for parcel confirmation.r20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1767c2-af50-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648552208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552208, "uuid": "a10d8212-a2f4-4e51-85cc-5ff9a51b3dae", "comment": "Malware payload (Heodo)", "value": "556bf5b6871cea767ef43a28ca20e264", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552208, "uuid": "db427daf-206b-455d-9928-81c54d006892", "comment": "Malware payload (Heodo)", "value": "2a406cefa95987644533060d48bcad46456b2e4c16bd320cd21e4fa489117f73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552208, "uuid": "8107959d-980e-4cb4-b365-b413fa468957", "comment": "Malware payload (Heodo)", "value": "3fde47fbe36a6e0a3a985d6c2d8787e415387783", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552208, "uuid": "ecc135ce-c755-4b1d-8ec1-fd848ec82042", "comment": "Malware payload (Heodo)", "value": "b162a840e42bd323b031589b76fcbc160f758a78006c9a93c475fd23a725336df757e4d03165dcf9c7a289a745e7cfb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552208, "uuid": "4bf34eb8-93ef-4ab5-90ad-1c6a68ad0510", "value": "T1F2C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552208, "uuid": "fafd8a69-d8d5-4476-bdda-f25cb3b5ced9", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552208, "uuid": "d2afed1c-9ee6-4daf-b102-196a5b4639e2", "value": "12288:iUV7ciwHX3ew9aYU3pJc9inFijaQeL+nZBb:UiMX9I3ky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648552208, "uuid": "daa3ecf7-9150-4b80-ac5d-2be414e9b77d", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648552208, "uuid": "e570a5e2-a1ba-490c-ab54-940056bc26f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552208, "uuid": "22fe6552-bab7-4cfd-95e1-957781a8f922", "value": "556bf5b6871cea767ef43a28ca20e264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2815be8e-af52-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648552793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552793, "uuid": "650d270f-9a5a-4ce8-ad9a-4ee442b50859", "comment": "Malware payload (AgentTesla)", "value": "80da18b7dc57dce590fbc99cb4c7d72f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552793, "uuid": "f2e6dc0a-6c74-45f0-b6be-3a778162802c", "comment": "Malware payload (AgentTesla)", "value": "2a742e0bd233aad9f3cdb6a16f0c78dd4c17c19455fbafe24079528ff3775bd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552793, "uuid": "8a0b46b9-fa29-471b-acb2-7e23108f51cb", "comment": "Malware payload (AgentTesla)", "value": "14d0e76004fc31c458449840bb6001dad4e95cec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552793, "uuid": "a340cf71-49c2-4bcd-b58b-4baad2e6f926", "comment": "Malware payload (AgentTesla)", "value": "0d7d6a1ee2fe5c3d53803009e77aaedfc3f0453c8a231d99d5e8e5adb2ea3f58c7cbcd766464fbe12534183a1ee2ff66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552793, "uuid": "ca7d193e-cde0-4faa-be10-5e1fc9cdb1c5", "value": "T197D43D5C7A0D1A72FD8D893089462E08BB660F1323E8AAC6579B35C7877F0F91D95F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552793, "uuid": "94973b86-bdd9-4819-888c-00a350ddb17e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552793, "uuid": "fdd07680-b3e4-4d30-8c40-fbfd9aff3de1", "value": "6144:BL8NG6ZjUwb+xsLkZ38kGVi+ccDgwVhwjrJz2YCqjaZKoB1NYLEr9g31Uih/:L0Fb+xsLE3GwB1Bz2Yxh31Uih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648552793, "uuid": "3f5318b6-c1a8-40c3-b2f4-1e70497dbfb3", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648552793, "uuid": "8a3b60c7-0e3d-4508-be04-0c746eb93b4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552793, "uuid": "37d48ea8-9b34-4332-9c2f-c8c042fd8ed2", "value": "Lincoln Park_Q88 (Chemical)_29Mar2022.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a0f726-af6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648563802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563802, "uuid": "77cfc8eb-ec71-45a2-8bff-7a52c2c02bb2", "comment": "Malware payload (SilentBuilder)", "value": "ce3b04bb82758bc091e53988fe14c5ad", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563802, "uuid": "83a176e9-5e2f-4bc1-bf10-ee794c47ad3f", "comment": "Malware payload (SilentBuilder)", "value": "2b0003fcaf359f402714274af087e8425d6be032c66f17eaa2ed58f82d87f8b9", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563802, "uuid": "aafb5047-3865-4c17-8c40-fad8a983b85b", "comment": "Malware payload (SilentBuilder)", "value": "f155b5fc62601d5cafb586f29244ee02abf834d4", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563802, "uuid": "cff2ae79-d456-48b3-bfd3-e0402cbae0f3", "comment": "Malware payload (SilentBuilder)", "value": "06d98bda02f0272ef2159c42a77c2e023f7b346b50e944481f4fd0a14aac219592899a61a49b018bbe89da7e2a008348", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563802, "uuid": "6dfe0377-a55b-4ef8-b95a-bad0dd7b38aa", "value": "T1E2C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563802, "uuid": "b6678e28-75c1-4a31-a3cc-c62c29fff73e", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648563802, "uuid": "9b83ff77-dc35-430c-85b3-ad314a721f03", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648563802, "uuid": "b7b0c81e-fb0d-45d7-8db2-6945f2942eeb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563802, "uuid": "d2e3123b-38ef-4c58-87d7-6eaf6f6a1130", "value": "ce3b04bb82758bc091e53988fe14c5ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78989bcb-af86-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648575262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575262, "uuid": "a650346f-4a07-4ba6-b1e1-ee94aa00918b", "comment": "Malware payload (Heodo)", "value": "36735c5e5c6463c8f79a693f98f0d99a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575262, "uuid": "e432042b-6126-4ccb-99c3-3d66ebdb39e9", "comment": "Malware payload (Heodo)", "value": "2b33911e8d3b225fbb258c096d3b1a6f3bd08e4b210970c2e66cca096562bf81", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575262, "uuid": "19569f40-858f-4a02-9a16-c0d0c5e828ff", "comment": "Malware payload (Heodo)", "value": "53963a2da10d4789d0a885f4a6a5ca097f7abe08", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575262, "uuid": "5aa5fa50-43c8-45b4-ac7d-ddf708725510", "comment": "Malware payload (Heodo)", "value": "43954027faf75df061808c2d59904a89f98e6e4782f9515bc21fe0cd4d40749b9b2abd99c4b99f469f8b0c726a4ab32d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575262, "uuid": "62dd29e4-d3d9-475d-8e45-a8a4bb4441d0", "value": "T13CA49DC87582C132DE7B4B75C552CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575262, "uuid": "193ca4fe-0483-4119-a4cb-aa659847a6c0", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575262, "uuid": "a107d472-7b3d-44ce-a03c-ab08a50c1cb9", "value": "12288:myXvaWo3sPddfrkOEpBLsORdPDpFlrh5W:F/as1dDkZHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648575262, "uuid": "abacee6f-cbcd-40cb-b339-bd3caf2cfc8f", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648575262, "uuid": "db668706-abd6-4843-9c88-00f3b0054fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575262, "uuid": "5c51eedc-fcf4-47be-a48e-c613799bc678", "value": "emotet_exe_e4_2b33911e8d3b225fbb258c096d3b1a6f3bd08e4b210970c2e66cca096562bf81_2022-03-29__173415.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f162ba74-af94-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648581478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581478, "uuid": "8dfe2339-d804-4e98-a9d3-2459c3b375d6", "comment": "Malware payload (AgentTesla)", "value": "8f396d27d20fb4dbd2510bc13b96467b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581478, "uuid": "05240c74-e278-407f-b2db-b1be9129b2c2", "comment": "Malware payload (AgentTesla)", "value": "2b4a97a682fdfee9c1fd767aeae4feb593ea0cede75514b402fb92c87f78d85e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581478, "uuid": "0e9bae65-a1f7-40d5-8228-3872e6bc4483", "comment": "Malware payload (AgentTesla)", "value": "af4b5613fd7aa1e9877ff4773a84aa21503eb7d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581478, "uuid": "5757aa62-dfcc-4501-875e-6749c333faed", "comment": "Malware payload (AgentTesla)", "value": "d816fdf4d49549ade33e0de46a6564454769fed04244f1ac7d8c615ff1d1c41fef2af3969ed5886ded6055dc8ee83634", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581478, "uuid": "7b7387ab-eeae-488d-9deb-0af99d78d38f", "value": "T19315D076E3F86F4AF17E53788020546E7BF0A852F7A1E55DBEE611F80861B804792F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581478, "uuid": "f0d9d89f-f248-4e6c-9018-9dd63d1d72ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581478, "uuid": "bcf50b9c-3b48-45be-9e3d-e1c825aca5aa", "value": "12288:mDPTq/oRpYfResb3XR4HS3m4pW0h9civlWo1e714hZUEChFm8fK8YyIALd8m:XoRpCReSXR4HqWkHlh2jvK8XR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648581478, "uuid": "07cc5d06-63d6-422a-8876-37c7d3fe0598", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648581478, "uuid": "f9b18f51-b5cd-4ae0-a083-b0c3f14244f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581478, "uuid": "0f4c47d1-ba9d-49be-bd66-6ad41e631ddb", "value": "Payment status 003559.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cf3519-af33-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1648539535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539535, "uuid": "9e95e172-24fd-4492-93e2-1e653ff007e4", "comment": "Malware payload (CoinMiner)", "value": "b85e06106269499093186db2e186597c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539535, "uuid": "2c232fb9-239c-43d8-aefa-f01a80fd9fd9", "comment": "Malware payload (CoinMiner)", "value": "2c2aa7f857b1118c36fc4af2c9edde53424c833ca355978b6749773829fc7c78", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539535, "uuid": "6c0b8a52-acbe-43c2-b40f-edc104e154c3", "comment": "Malware payload (CoinMiner)", "value": "0949a48145043307118e87e6093cee35ea76fb95", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539535, "uuid": "00788634-af92-4447-93e2-75c35d6db374", "comment": "Malware payload (CoinMiner)", "value": "09fd7ebb96fe476882bb9c04a6c9260a0b4c6a922f0a270e3f15c14ac6141e9a1d0b91892fc35fd22faabadc6040eefb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539535, "uuid": "cc827127-8fc7-4ba9-a113-ce26a844ea07", "value": "T191E501AE6268231CC41E893C5937FD0472F6961F56F8996E74CFFEC02BAB411D942B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539535, "uuid": "950b8823-8560-47a3-8a0e-31734caf2c93", "value": "4e4095a0d90406c8428c5d9a9c6b05b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539535, "uuid": "b87749af-c214-413c-83e0-ecb5178ba1da", "value": "49152:2oqnOJIee2llcqxbuZdMLiYTL+5/Dn43CsVs2KL6/lVuCrTcWTUUk:27ngdlcqxbCMLiXSC0r0Uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648539535, "uuid": "1b657e80-4495-42ac-be76-0e7c377e18ce", "value": 3027895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648539535, "uuid": "4b49305e-3695-408a-8306-6869e0296235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539535, "uuid": "f3b04f62-2b0c-4d6f-b6b3-015afccb549b", "value": "b85e06106269499093186db2e186597c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d06206-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648561993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561993, "uuid": "3a29e3ce-93ca-4277-9549-f8fee6734830", "comment": "Malware payload", "value": "ad0ce1302147fbdfecaec58480eb9cf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561993, "uuid": "3d819a82-6224-4dea-b55c-b659153e7353", "comment": "Malware payload", "value": "2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561993, "uuid": "ccef7ec8-f40b-439f-8976-d80485fdf622", "comment": "Malware payload", "value": "874efbc76e5f91bc1425a43ea19400340f98d42b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561993, "uuid": "d171f714-4c4c-4c08-ac72-e41af773b189", "comment": "Malware payload", "value": "0f731e98f26294ac590691fad967ebc94520c20dc2828ab64cdd99d50cee8ca435dfd279da05d0a2373072d4f5c8ef04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561993, "uuid": "37f419ae-4a2e-420e-93ff-025685ab8982", "value": "T1B7232A48968DB723C2EE4EFFA4D2A7510770C12B9B8BE70FB48413356D267DB1541A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561993, "uuid": "b9a460cd-723f-430f-84e0-2d6215c42026", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561993, "uuid": "c0617fcf-acad-48f7-a67d-5d47a45f8d34", "value": "768:in0xHS0Z8GQFAUKYoG5LIDbDyipdRsQ89yQk1JFR+eJKR0pPQb0MLz/NQa0hrAEK:ymHnZRQFpKYjUXyipdtVhKRIPQ4cUrAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561993, "uuid": "60b2f722-17df-40df-9d3d-d9a8b8d90003", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561993, "uuid": "6dcf9730-22c4-41be-bff6-935487f13a36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561993, "uuid": "6c34658f-8632-4627-886f-c924d9990986", "value": "Windows Services.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52862eb0-afa9-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648590231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590231, "uuid": "6ee10ff9-6b54-47e5-b921-c8f807a1d653", "comment": "Malware payload (RemcosRAT)", "value": "b933b611ce9fad4e6ea2a50a45388039", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590231, "uuid": "be72dfec-0cad-4d76-88e6-cc801400c601", "comment": "Malware payload (RemcosRAT)", "value": "2c8b78fc6c4fe463dac9d39fde2871f1bb2605453bc0f2d57c7549cf5d07aa86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590231, "uuid": "9b1f8d91-ed64-4afd-b5f8-fae14a15d0b7", "comment": "Malware payload (RemcosRAT)", "value": "bbccc56fcb82968f5a0e3b037a2110701bb96747", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590231, "uuid": "b8c85034-ac56-49ca-a313-9ecb2a7643cf", "comment": "Malware payload (RemcosRAT)", "value": "3c2dd5aac4186b8c9941ce2e36df91c72c926d23e7211801a3024d0692082aa7944221f783e6f77c07232910893d1f16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590231, "uuid": "d2eafc52-318d-4021-9f77-080639695a05", "value": "T1EDA4BF11BAD2C072D97251340D29FB35DEB8BD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590231, "uuid": "11c9515d-6412-4cf3-abae-38bfd5a68f12", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590231, "uuid": "f26eb767-8d08-4a40-a9e2-d58c45ac401a", "value": "6144:JOFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcUryg:JOFtiNBuFgawDB4NOmuwsfZPQyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648590231, "uuid": "2d29a54b-4554-4c2b-8ea4-af8406f0a238", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648590231, "uuid": "9b408bdf-0c8c-4179-b4e8-cca6fc5fd001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590231, "uuid": "2e3dbbd5-b5ec-432d-974d-d95cac14fba3", "value": "m.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0312b5-af70-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648566037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566037, "uuid": "ea06e1da-3781-44ba-8994-afca0049122f", "comment": "Malware payload", "value": "58c3fdf2f6fea5cb2b11ce65378b26f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566037, "uuid": "7956b50b-94a8-448b-aff9-2cd480f2e6b7", "comment": "Malware payload", "value": "2cbea40a20f5891b0625771f6d8e58fc488eff155a79469ac50eae1361aac290", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566037, "uuid": "aa072c92-c24b-4995-a3b4-d8db52f898c6", "comment": "Malware payload", "value": "00c887c05999ae7303077f76ffbb09308d84cd85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566037, "uuid": "d003fc50-8da0-42a5-9ccd-1c25d0006dff", "comment": "Malware payload", "value": "b897f4c2f4cbe4396966a4f76ecbbc1a6f433d49b5e61b27fb9e34e11f9c572ce32fd536d2c41ab47bc8b22e3f93d3da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566037, "uuid": "c1868a59-347a-476f-bfab-60acc19b77bb", "value": "T18E441354B6B0C49FC07207315AB45BA49AFAF32271B14F0F17B86F09BD79B499A0E781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566037, "uuid": "dc51b349-01e4-42d5-b757-5e5f929d99fb", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566037, "uuid": "f8c76662-fbc8-4152-ac6d-b9c43773d329", "value": "6144:HNeZm0mNCkxcsby+4c4NW88EIUpCt6YENenXsqkotwMBnuy:HNl0mzxd+lN67UOJcqkotwMBnuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648566037, "uuid": "e3dd023a-0aee-44c6-801b-8a3af7df45ab", "value": 272447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648566037, "uuid": "4c60fa60-70b5-42c5-8e9d-ab3f055e55ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566037, "uuid": "a8a9cb3d-2d4f-4fc1-b308-2a8acf52058a", "value": "RBtuesdae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62436d3b-af5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648556327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "14da60fe-f84e-4726-af4e-ba5547e29d95", "comment": "Malware payload (Heodo)", "value": "97cdea5f2879347a96d52933411ce4cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "4d659b73-d9f0-4822-a8f6-19375756d141", "comment": "Malware payload (Heodo)", "value": "2cd7331956daeba2312eb8d5173a16a5cef50b847f5ed7c8a9def5053c84d7fe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "6918fec6-872d-4b1b-8a9a-0139854d183a", "comment": "Malware payload (Heodo)", "value": "3626b22402ded173ecd0d63ece2a5c59b9a97390", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "e509fc8a-8810-414c-ad3a-f520762adf65", "comment": "Malware payload (Heodo)", "value": "7947b353bb3074eddc1e8b58f712f5388a2446da9fd656eddb2517a4466dc76c19b584fc0fa693b594891c9ab6a7649c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "2ce50d42-7c99-426b-b069-d70234dd16a2", "value": "T17BD45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "bdedd60a-86dd-452e-a8b7-4463d8882a97", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "cc171bd5-2c59-49a3-9380-8d1527d72606", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzxipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+waooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648556327, "uuid": "4c7d5136-3b19-4bb8-887f-cb5a975cf82c", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648556327, "uuid": "44643717-c5dd-46c1-8541-45c696cc0096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "7ffd45e3-08e4-49b0-9ec9-8540715169f0", "value": "emotet_exe_e4_2cd7331956daeba2312eb8d5173a16a5cef50b847f5ed7c8a9def5053c84d7fe_2022-03-29__121839.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fb7b0b-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648536063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536063, "uuid": "014a566a-8feb-4332-848c-ee2744a77499", "comment": "Malware payload (SnakeKeylogger)", "value": "6407d1ff46e04a481edf5cbf5089da24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536063, "uuid": "b1100091-2cc3-4176-b76e-d06df6d0fd75", "comment": "Malware payload (SnakeKeylogger)", "value": "2cdc4a696af6d787fe57e559b9084bd0ac871ff005336e15df4985162ed973d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536063, "uuid": "3fb07920-2b67-42fc-8222-cfa6eaec9f1d", "comment": "Malware payload (SnakeKeylogger)", "value": "edf3fd69663799686e0b8c260605d59a6b7aa103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536063, "uuid": "48e45923-924a-40e0-a7f7-bebd00fc9ffd", "comment": "Malware payload (SnakeKeylogger)", "value": "c3d9e9bd62ea0185ddb0d920c109882c0347449f137f8895d0d4da4b189a6a5e6b0557534286934548fe2403748fc976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536063, "uuid": "2a3381a4-5982-4c58-9d94-e547c981e547", "value": "T104B4F2C2B6C05097D8A80A31D5678721372BFC76A9E4891B22A53D163FFF2C3B917647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536063, "uuid": "2c40289f-c0bf-4347-8927-f8f117fb95c9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536063, "uuid": "80485b6a-2f09-4395-873c-c45b98d76f28", "value": "12288:yO9loFoSCxTauL46JCP+1B06sVz0W9bemi:tvoLCxOuLtoqJEAWAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536063, "uuid": "364031f7-fc4b-4378-bcf1-db4c3076081e", "value": 501008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536063, "uuid": "c75746c5-2c9a-4a90-b05f-2dcc319beac0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536063, "uuid": "b9864cfb-122d-41ef-a5e1-f2cafdb13976", "value": "456780098765432345678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07961df4-af0e-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648523533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648523533, "uuid": "0959c672-c9a7-4b72-b8da-cb195760b7be", "comment": "Malware payload (njrat)", "value": "a4842ba1f0108b8005ec1c1d9b0038a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648523533, "uuid": "ba5481b8-d0ac-4e17-9d04-b0622d752bc7", "comment": "Malware payload (njrat)", "value": "2d05fa6521a50e157d071146d47e623c11c569ec2b6d5b3e4a092a806bd5ce5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648523533, "uuid": "452f0c4e-3d1d-42da-964b-46e7fc631985", "comment": "Malware payload (njrat)", "value": "85946fd7fedbfe5173840ec634cb3f65cd99f46d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648523533, "uuid": "24b8ecd7-6ea3-4145-b53d-6d14e633f8db", "comment": "Malware payload (njrat)", "value": "f342ee63ed8bdff3badc734e9ef523ea34e4d61c42ed7b6ae90f8b74c9d4c4585dcb2bdbabd2b17853849869b545def1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648523533, "uuid": "2fc5e3d9-7c94-40b1-a6b3-85aafd7478da", "value": "T1B613E74CB794E174D5FF8BF1A4A2B2890B71A01BA802970F99F154D98B73EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648523533, "uuid": "459987d7-9e74-410c-ac1e-d75e489fffd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648523533, "uuid": "f81e2a0b-7f3c-4945-b964-48fb3d12578b", "value": "384:VZysQNU1SoycwJO3l9WhYYsECcEPvTI8Gdz0Iij+ZsNO3PlpJKkkjh/TzF7pWn20:/QqglcwJkFfDLIBuXQ/oXC+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648523533, "uuid": "140246ed-5007-4923-abd3-91480521c8ec", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648523533, "uuid": "503acde0-3d7e-40f3-834c-69d6b5a64e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648523533, "uuid": "ffc58310-e189-4f70-8772-d57c5b0a3dd4", "value": "a4842ba1f0108b8005ec1c1d9b0038a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a899a186-af5e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648558163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558163, "uuid": "9f5bc248-5aa7-4352-a7a4-9379b820294f", "comment": "Malware payload", "value": "6a396cbfaf4920e5b5bbd60083d50f71", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558163, "uuid": "287c2325-2a43-44a5-b614-9733234107a4", "comment": "Malware payload", "value": "2d060c3f5713313594bab6502eaaef87cc8d8cf5fd0baa847edde6445123e5a2", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558163, "uuid": "403cc5e0-20e1-45a9-9227-78eccff656c7", "comment": "Malware payload", "value": "50fdfc6c620aef4dc8759dd47a98b6a0a081e138", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558163, "uuid": "f4a99f5b-dad7-4a14-938b-dec50310f578", "comment": "Malware payload", "value": "59ed7ef84292bc4aff16c7a8fb3e12c510b22202585e8bd3a38a122ae38bcac926aaf4f661b09225f84994cebff978da", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558163, "uuid": "9f78d949-3451-4bbf-baf7-37af354e6dbb", "value": "T1D314128A73818370E7BC81B62057D939B5ABAC84F844B96512F0B3A41FF3259293D57B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558163, "uuid": "861608c7-4534-4772-af69-129cabad485f", "value": "3072:tNWoEbiJxwt71jcydASYWrjYdY47t/v/jPuj0/V3+BPMxUxbO5V72dZcTrBrqMV6:bJxqJj7YAs+41TbuBPM6bO72rjM7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648558163, "uuid": "994293d4-71ad-43c0-ac2c-1169ebb5d83a", "value": 193416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648558163, "uuid": "1dc7bb14-fc3e-4943-be75-0bed5a3c990b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558163, "uuid": "949253d2-1eb2-46ef-a37e-f56844e6fd0c", "value": "TT Payment Copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0291f3bf-af28-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648534691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534691, "uuid": "46204ef5-33df-4522-ad13-6041039debfd", "comment": "Malware payload (AgentTesla)", "value": "3fe5e890bea947a43ad1ad4a5ccc587b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534691, "uuid": "073785b2-f311-47ee-a687-15d1d3ec9a41", "comment": "Malware payload (AgentTesla)", "value": "2d4ecbc0e825f5b7345517714b1c1a33409e71366edfc98d94f747c23cdc1d92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534691, "uuid": "7bd88265-276e-41b2-b01c-8b6238633c70", "comment": "Malware payload (AgentTesla)", "value": "539c0e2f982d8d2a24173752b8b1bc547e0b58c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534691, "uuid": "e7b97f9c-9654-4f8b-ab28-2dce4a5e2054", "comment": "Malware payload (AgentTesla)", "value": "626f1c2503fb8a92b759bcaa11aeb931cd4c2f030827f083f20b6d0c1f8f84a7f6a699cf51f41b58562bfeaa1b0c1875", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534691, "uuid": "ab08c933-2530-46ea-8dd0-07663807ef98", "value": "T12DB4233863E5F60A80FEC43E304B77DA7736461F5F962A4B081B74629CA572BD2185C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534691, "uuid": "bea702c3-3d12-45ad-878c-0b31e1630917", "value": "12288:rlLrazBEPMahgS1m9jKLJiEoSUFXLzolpE+tza9E4nPH:xLWFGHhgSc9+PoXLslpRRa95f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534691, "uuid": "a7ab1c03-a088-4eb0-8ade-502f5e6ffde8", "value": 524625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534691, "uuid": "3b1698be-9c22-4ff7-9d9d-af25db41ad86", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534691, "uuid": "f4a368f6-8c77-4dd7-877e-5ff51f2b2f14", "value": "1092991(JB#082).r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1614c1a-af1a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529079, "uuid": "bac7bb4d-6508-4241-a57e-4bb74c3b4688", "comment": "Malware payload (Stop)", "value": "2dcaea71f538d73facf6043cce3899b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529079, "uuid": "2a37507a-278d-47a3-801b-2a873b9c8115", "comment": "Malware payload (Stop)", "value": "2db1bb25566f90ea473b56bcdc4670b9e6f730986a9c6f9d4b59a9ca6f542f54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529079, "uuid": "412e5f6f-388d-4cf3-91d6-7e7f28749517", "comment": "Malware payload (Stop)", "value": "0fe731b25c88f35c5eb2f6b6f02430cbcd1098ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529079, "uuid": "abbcde4e-a331-4ef6-b8d4-c1a89448d2d6", "comment": "Malware payload (Stop)", "value": "cbf5801fca66bf2cec9231b9c90e80429c591d16c980de594efd8c829eefd54d14c147b0c3e8384db62eceade92a3248", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529079, "uuid": "5ddd8d96-a197-4628-9479-d2309adbc9e7", "value": "T19DF42360BA21C133DA4F257E7D0AC371693E7A3208AA5C17BB4857364E215D0E6F672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529079, "uuid": "e74c6306-62c5-43e0-aad6-eea185b60780", "value": "9b5dd8ae6c49e5fbd407dc1f346434cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529079, "uuid": "fdbf9576-696e-4182-93a4-9c7ad1ae99c7", "value": "12288:en7kpJQUlJrpg6gX1qbf8/vajT82MBHkzcDa+2PrRQDGLDbvv/e:e7kRlJrp5eqbk3g82CH0SXWrODGfbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529079, "uuid": "d2a80b2e-d962-4088-bbda-2599870511cb", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529079, "uuid": "a4a40a3e-b3f2-49ac-b9dd-baa48e68c2cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529079, "uuid": "02023213-5f8e-49db-b45f-5eceae3f65ee", "value": "2db1bb25566f90ea473b56bcdc4670b9e6f730986a9c6f9d4b59a9ca6f542f54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab9d65f-afba-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648597707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648597707, "uuid": "13637dc4-8069-4a41-9a7b-c9ac5ba10782", "comment": "Malware payload (RedLineStealer)", "value": "a149f9c13f37f5c71124e0c26da9b52a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648597707, "uuid": "9f67722e-5780-4a15-8bd2-6dc701f9069f", "comment": "Malware payload (RedLineStealer)", "value": "2de5fe686b665d9aeb98b075fb139e33fffe278986a15622ea90bcad2f760ab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648597707, "uuid": "b7f1b609-e968-431d-a45a-cadbc7cb3eaf", "comment": "Malware payload (RedLineStealer)", "value": "2a4961083c2015d449a7fef2042f4cb54a8ebc3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648597707, "uuid": "f836864c-935a-4d70-b1fc-e0bb39b9ed9b", "comment": "Malware payload (RedLineStealer)", "value": "14f5c04e17d4232bf2afb99f700c7e83f3b8d4215c3564fb85570cf8b57fd22813364e6a1eadcae79057d77ca0da3ac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648597707, "uuid": "f1824e87-dbf7-4359-92c7-30a6c7debcc7", "value": "T140347DBAA2899E67E59A44316230C03007339D559557D32B60E03E6B78B93F3217EEDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648597707, "uuid": "c9087ce9-b7fb-4412-9f35-226d6967d94c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648597707, "uuid": "0dd7cb1f-bb76-41e3-9724-77f5f4a3ea9d", "value": "3072:cnoOkmEQ4Zpc4CRWEFaBP2CudkT2z2y8gzHdwim7E:coOipvcNloB+VdkT2arIN+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648597707, "uuid": "a53b60af-5298-4576-b8eb-2ed97e952c52", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648597707, "uuid": "4ebb4845-656b-4bfc-921c-889311d5dbcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648597707, "uuid": "6e9d7a18-3809-432a-81e5-72fde8e2c5f7", "value": "2de5fe686b665d9aeb98b075fb139e33fffe278986a15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb7c45b-af63-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648560235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560235, "uuid": "3093693e-1388-487b-91a8-0985e1231dae", "comment": "Malware payload (Formbook)", "value": "c9452db6e30f690b5f56525d505feabc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560235, "uuid": "5f3dd79a-c225-446c-a96e-daba60728fe4", "comment": "Malware payload (Formbook)", "value": "2e22a70a6b87ce15fa230bdb14fa4ba0ab2c22fd2a075e53b4f0163bcabb7dec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560235, "uuid": "df45e7d6-603e-4118-a7c3-98f54bc930bf", "comment": "Malware payload (Formbook)", "value": "6f2c32d8ae524d166df3507bb9401fc605d3f65c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560235, "uuid": "9d1465a9-62f8-469d-8afc-05c0eb24265f", "comment": "Malware payload (Formbook)", "value": "f980918e531f3dea78043c71e8c6ab9743e92adaf3b282dd51a7146328c2be972533d4475186738181da7b9dc10bd349", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560235, "uuid": "4507f6d3-1387-46d1-b1b9-fa0ce19363e3", "value": "T190252347BA695E67F74F1FB808E27A5903BAC9124E92FF2CDC01A5D143CB3455790A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560235, "uuid": "d3374b87-ae13-4a39-b334-92f9e0057b58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560235, "uuid": "0664c270-29f7-49b4-90e0-f92df4d82e0a", "value": "24576:UXohrnvulsryTiwHKfsdWqna3/Op4zjIlVtR38el30a/clrC:UXohrnv5r6BHK/R/u434jt0iclrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560235, "uuid": "2b473f90-b10c-47be-92f2-921d0c7fca49", "value": 997376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560235, "uuid": "a3bf45e7-fcc1-46c2-bb5e-b67ce46d0f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560235, "uuid": "e29b2aae-77a0-4ab7-a46c-88420faccf84", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaae8b6b-af7a-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648570192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570192, "uuid": "cc1e09e3-8d6c-4ce6-b0ea-b4d69ce2ba18", "comment": "Malware payload (SilentBuilder)", "value": "96be18364ec9681f213888b052baf136", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570192, "uuid": "6a32b90c-6c75-421f-99bb-9eeab9331eba", "comment": "Malware payload (SilentBuilder)", "value": "2e56e74fef7ded15bd185c61bf6058b1f541ff48dcbf1dc38b6d4b9f792e95c1", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570192, "uuid": "3980e609-c71d-4b25-9793-344cd7650a8d", "comment": "Malware payload (SilentBuilder)", "value": "4aaa4427f8b8594aff4899cdfb00a6880bef9fe9", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570192, "uuid": "d0e6e9e9-7234-44c3-88d9-674b19b9b7f4", "comment": "Malware payload (SilentBuilder)", "value": "542581d709f0c47affbbe24850db69c1320dfdcfe575e4f6bab09f60ec60935bfa975155131d0691444885be6d902175", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570192, "uuid": "b1e1d7fb-138e-42d3-8671-b170f6e3974a", "value": "T145C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570192, "uuid": "15247a45-4bf3-4edb-9216-fa4c08855199", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCM:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648570192, "uuid": "434ee131-d00e-440c-aeef-4ab8d6a6d412", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648570192, "uuid": "4d762f13-8572-419c-8341-1f5fddc371bd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570192, "uuid": "85ef31c4-86e6-48dc-8fb0-6029bdf16b0d", "value": "gescanntes-Dokument 2022.29.03_1732.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949a87d4-af29-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648535366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535366, "uuid": "0362d997-a947-45b9-8ef2-33ac6a0cc7d1", "comment": "Malware payload (Mirai)", "value": "eaff55e64aacf1f14db252a439ee3b00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535366, "uuid": "d163a146-f8db-4663-9f0e-c565692d0b0b", "comment": "Malware payload (Mirai)", "value": "2eb7bd0a8ddbff315f11b36b0118bdbac0875afc889fbd6b49ae9c5e069e5b05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535366, "uuid": "7a07a345-37e3-4dd9-9fb6-09d31a59a494", "comment": "Malware payload (Mirai)", "value": "3d33b27d92b5c2e4d7fa9c1a12230d3a40e76754", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535366, "uuid": "0772f9a4-caaa-4aee-9bb0-3799f32128e4", "comment": "Malware payload (Mirai)", "value": "35e8303ebc8ba25c1d0a18907ca9215347bd463ddb0baddd4e208d52a8cb8208ae1200e13bb99aea985c230ba60a83e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535366, "uuid": "3d452725-cf99-4cf4-b67f-7b72fe093ea2", "value": "T1D943F152950911129BB04865FE63CD0FC55CB7AAE2EDB00E933B4686FDDB0017BBAD36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535366, "uuid": "4541bb33-b147-4bde-bfd0-851238a4b86a", "value": "768:PzLk1Ruy92J6HiIzFWGzroPqZg/h2H5KzlKea3w5hzJq3UILbuurqjAv2QT04krl:bLkjuypCGkri+GMMeaQmfu7kvz04I1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648535366, "uuid": "932414cd-44b3-42a8-88f4-b7941b217bca", "value": 57932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648535366, "uuid": "a4f7fcf9-c422-4544-9e76-f9d2c51e392e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535366, "uuid": "07288e04-c751-47b1-b5cc-ebea5f02f51e", "value": "eaff55e64aacf1f14db252a439ee3b00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779c9e5b-af63-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648560228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560228, "uuid": "7bb41377-4d44-4fcf-a303-8b787db8d565", "comment": "Malware payload", "value": "83377e8163869ee018e621c38ae6012b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560228, "uuid": "02e9c945-03d3-4e3a-b651-104c67afcf9d", "comment": "Malware payload", "value": "2edb1b98f11438149127f9feb66adee897a520adb8cf186a7b5e56ee2d7fef0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560228, "uuid": "c36c7676-d4fe-490d-8404-a2fac5ecc0e8", "comment": "Malware payload", "value": "f1415bb722f5cf7ee2d1dbbc16943f3f55afd95d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560228, "uuid": "7329cb84-9e45-43f2-b2dd-fb67fc525c15", "comment": "Malware payload", "value": "2b025bbd262bac09fd96cf29f1ba6eedc99891734cbe71675399f778d64b57c3408472f1b745376cb8d5b8eca803572b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560228, "uuid": "a009af36-b4c3-41e7-9798-21e42f126f00", "value": "T1E004021126B0C523DCA21672197AD7AF3EBBE9063961527F3363E289FC25B90C52F315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560228, "uuid": "312eb1bd-c005-4f2e-a544-a55555ae5ccf", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560228, "uuid": "75c344b8-66de-4f39-9c77-d8b26c97b226", "value": "3072:MfY/TU9fE9PEtuVlbRnrxJ6Vym3mjlPPQtI7J4jHYUloSHs1+4l:6Ya6rpRnrxJ6ZgPPIqJ1Uloy4+4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560228, "uuid": "b3e74f6b-e486-4a41-9db3-467eb83a7219", "value": 176496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560228, "uuid": "fd0b5485-55ac-4f5e-ae45-b1a88869dba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560228, "uuid": "af41c334-de1b-4a09-95e8-0574e96ac102", "value": "EMBARGO_07225458910156_6247253195156737_617964514445893417_34467448107694883_6209743423794.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfddb04-afae-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648592448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592448, "uuid": "801ce23c-79d1-40a2-a870-3e010218aaa7", "comment": "Malware payload (Heodo)", "value": "f7997a00daee30c78762c075db244fbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592448, "uuid": "73d134b7-2ff9-45e1-952c-2bf6527eac39", "comment": "Malware payload (Heodo)", "value": "2f0f574050b0b601f1e101b68f6ec7e29d74c732144306f5c4af10d4504bff89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592448, "uuid": "d63437e0-bd13-4a83-b055-8710c3dbd27f", "comment": "Malware payload (Heodo)", "value": "08d41a154808fe99529e314c78d1ddfef77629ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592448, "uuid": "b7a5862b-2b27-4a59-b02d-82e84a00f186", "comment": "Malware payload (Heodo)", "value": "f7f91b3092ef7fe8032ae8d3032cb7c6ebaf1c4246e3069f99ef5c7748afbe7865751176a0ff4e5ded9c39418020aa2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592448, "uuid": "c8a17e2c-dc8a-46b3-9b41-fd6b8fe94397", "value": "T1D7A49DC87582C132DE7B4B75C552CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592448, "uuid": "f982bd71-3445-4365-8a87-30ecf64c9cc5", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592448, "uuid": "8d2033db-7d80-43f6-9855-bac622fa1cf6", "value": "12288:myXvaWo3sPddfrkyEpBLsORdPDpFlrh5W:F/as1dDkdHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648592448, "uuid": "6ee92241-be32-4a83-8c69-c02f15a19a6a", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648592448, "uuid": "7b49a27f-52c7-46e5-b006-9e1f13510dc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592448, "uuid": "a6b96995-cb96-4db6-b839-a7b31a1ffcb6", "value": "f7997a00daee30c78762c075db244fbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcf4874-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648561792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561792, "uuid": "7fd0c957-ad5d-4be7-9a4c-578f2c0510d2", "comment": "Malware payload", "value": "319b813ad02fdd9cb8bbdec00c3774cc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561792, "uuid": "bc7fb8ee-eb49-4cbe-9aa4-df7575dd5877", "comment": "Malware payload", "value": "2f36f1a117071a9097c1ec0fff17772a029594500d6706f470899168d3b595f8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561792, "uuid": "c4dd6bd1-f4c5-48f2-9b01-62c42039818e", "comment": "Malware payload", "value": "e00f63367d4ee49d84ac05059f67e74351eb73e2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561792, "uuid": "308ff884-36e8-46d2-b4e2-632b3896710c", "comment": "Malware payload", "value": "ddf763100e35e74e504f7ec64c5d088f0f23c4233acc8818b6d305c37050ae5880f3aa5cd06a8bd1484d95c09a80b6ba", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561792, "uuid": "dcab17ef-0f4c-4e27-8a9c-afefccad1e32", "value": "T1AF328D3CBCD892A44034EC92D7A4283950CAE779218C347DA8FE76CC6BC5624DC5FAC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561792, "uuid": "0060ff2d-9ba9-4e10-aedc-f87d27d8386c", "value": "192:zV97d4XPSyX4SBXmtArXS4/UotArXS4UfUyXhPpm+XN4U97d4XPSyX4SBXmtArXH:UfXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561792, "uuid": "ece8ae9a-274e-45bd-9ec7-3361310ddffa", "value": 11458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561792, "uuid": "f101d62c-8a08-4629-ab54-3d57b9c4fa71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561792, "uuid": "8ce70d53-8871-4e0a-a19d-cf0e7e180eed", "value": "Report Details.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d208d1c6-af2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648536757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536757, "uuid": "28e6c27d-fadc-4880-a8fe-859a6a2d684a", "comment": "Malware payload (Loki)", "value": "adec01723d2ab18a51fdfcd83ccfc835", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536757, "uuid": "aada0024-263d-4b11-aa80-d664caa38f32", "comment": "Malware payload (Loki)", "value": "2fa60b10acd9bca4f1bb04c0e1b49fcbd5387d35f43a2a0d7509426d0b09660a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536757, "uuid": "173ffca9-e67c-4e8a-9b56-c404ee150128", "comment": "Malware payload (Loki)", "value": "7ac02f5e87f9a24dc9304bfa80b028be32f1105b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536757, "uuid": "bde33082-ed7b-4740-8845-a3585ad7bcf7", "comment": "Malware payload (Loki)", "value": "43bbd507a37aad09be40f63b4648e72e49e93c9a547cf013a3f173d3589074dbfb3717f40134e40bc92f2de657acedfd", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536757, "uuid": "7e1cac95-3797-4e4f-ad18-611db993b97d", "value": "T16514120E7B644F92E2A6C1396475146087334FA65F05BACAE10632BBCC7A1F6E093B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536757, "uuid": "fdff9160-f94c-4e8f-ade1-e7c04b3210e9", "value": "3072:pRfk+dFGhngiX8CZxY6fQmgzM1D7+bLZuNhaNbb8KsvQReB03wne/l8:DlFygiXrYRmgAnGLZuCNbbmgeWget8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536757, "uuid": "40f6b121-a15a-4594-ad34-84808205adb9", "value": 193704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536757, "uuid": "7aa170c2-84bd-4bbb-9d7f-f49aa4a9c521", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536757, "uuid": "0cbeecdf-6bc1-4761-b70f-5d6c60bec40d", "value": "PO2203-0154.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb79b5d-af33-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648539463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539463, "uuid": "fe3c709a-fb4b-4b07-8c43-98aa00b9f6c3", "comment": "Malware payload", "value": "4dd3d367bd475cc0e9b5287fd695382b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539463, "uuid": "3e47018e-b152-4aca-b12c-747553a09f1e", "comment": "Malware payload", "value": "2fbd5608c9518c3f649388ffced23a1044699456a29421ad372dd218fdb8f3e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539463, "uuid": "63090d11-fee9-4fea-9786-344501fae5e2", "comment": "Malware payload", "value": "9c4adb93aef1738515129652c099c7fe12abda46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539463, "uuid": "c9983758-3223-4343-af4a-cff7d9d88b25", "comment": "Malware payload", "value": "519a3c225a02585f888ec845358a50837803c09268b31f8e96ad6990b8a9cd7af0a8134677868002dc5bb03cb80127c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539463, "uuid": "3c46a546-8333-4acd-b15f-edbbe452a597", "value": "T1CB563303B68D97BEEA265E707574923029289F632F358B5B73D0DD7D8A7105CA930BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539463, "uuid": "a082534e-2dd7-41a2-ba94-cc8766e048e2", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539463, "uuid": "56141dc3-a15d-4c39-8e78-0e04549ffeaa", "value": "98304:h76HYGHUKMWIOZLNP009qjP+WgbpU09/PMKjoHDzQ8AAW1llu4D:J8dUAOFyJ9PM0oHDzK91llj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648539463, "uuid": "8fc7f2a6-c5a2-4ef9-becc-510fc7b3c192", "value": 6335768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648539463, "uuid": "2eb89148-b296-41e1-8f14-9161e094d4dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539463, "uuid": "b6f0773f-0fcd-464a-aea9-883542efadea", "value": "4dd3d367bd475cc0e9b5287fd695382b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bccc692-af46-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648547833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648547833, "uuid": "a35d6f31-ce6e-4a37-b009-9ffcfe5a707a", "comment": "Malware payload (NanoCore)", "value": "686c293653d44029d95edb5d28ff1775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648547833, "uuid": "05278f86-e1b5-4444-bbf7-2919aabca305", "comment": "Malware payload (NanoCore)", "value": "2fd0132ed7ddf3e78d9569ce149fff4907970d3b4afcf35757b430cc791f0b45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648547833, "uuid": "6e4a7ba4-8089-4d95-94f2-5ee6814719a9", "comment": "Malware payload (NanoCore)", "value": "3af59595ecdad7979391e4cb422b24267bfc2df0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648547833, "uuid": "0e8fca33-8b1f-4271-abdf-b632e3129bd7", "comment": "Malware payload (NanoCore)", "value": "d2be157e29882b35d944b9a747dbdd0b12cb0ce3893aca74405898b753d8085588aa1479b3b8dd6f222ed2594f9c6756", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648547833, "uuid": "b45cfada-8363-4a8b-a4b0-098be20f7f1f", "value": "T1EE45F15673CA9802CABD57BB84EB90005BB47D968533C70E79C977FD0E223C26A4635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648547833, "uuid": "372e2fec-c384-4a44-8d5f-d5a2aebbc9b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648547833, "uuid": "1d50b663-397e-404d-88de-7bb17ebbd0b4", "value": "24576:jPLrZ3buzo9Ig3Lk4EVZ0x1lH2mTZVfDgdeSiEsUtaAxx:jpbuzo9IgI4Ef0xSmTHQhsUtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648547833, "uuid": "414b33f7-944c-4f3d-a630-bde3d18fca9f", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648547833, "uuid": "902ea22f-e2d8-45ee-8505-aa6dc9336562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648547833, "uuid": "138b7832-922f-4e79-823c-1f5405cd59a4", "value": "0000292ue7382237000000003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a265e197-af78-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648569319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569319, "uuid": "f6cb0644-73aa-458e-a86b-d4bad55b2282", "comment": "Malware payload (Mirai)", "value": "1bbd87d6346e53be4d3006dc5c13de9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569319, "uuid": "7082cf22-adbc-4aa9-98e1-025fdfbf6c41", "comment": "Malware payload (Mirai)", "value": "2fe44ecffc55dc0ea6fc891b515303e8ffa3cbac12919c440d1cc2790d9409fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569319, "uuid": "9f0933e2-b93d-4854-93f5-20f60f1db88e", "comment": "Malware payload (Mirai)", "value": "05347dda7d2c6a46bfe9be38ac53518e80f6b769", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569319, "uuid": "dac93aec-fddf-4f0d-938a-ebccdf0d4b31", "comment": "Malware payload (Mirai)", "value": "350fc8bdc0ad8b78fce16455bf454086d99b561600766eafbc2f415e464a15a90e171f3afae0e867716d6e716b7ffa9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569319, "uuid": "a2e4fd12-6c1f-42b1-b506-8bd4f27be8f8", "value": "T139B2D020F15D54B9CDB01C70EBE6978EA31F2038FA5BB0BC7824452E5B6A58DF5A904F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569319, "uuid": "d1fa180e-4573-45f6-868a-a7f73dcdb2c2", "value": "384:Eq3xycsbUZFv+M9XaiSkBFjGt6Fgvkq+Zmho0v4I7G3bdQRrAcjqmdGU5EK:Ew5GMNJSOYtygpgmhoSdR853U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648569319, "uuid": "dd9a84b5-405b-4371-aec7-b616f0325a3d", "value": 25476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648569319, "uuid": "d3a17e19-436d-44af-b18f-b0ad2eec002e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569319, "uuid": "02a78b0a-461c-41eb-b140-cf5872ad7c30", "value": "1bbd87d6346e53be4d3006dc5c13de9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3561b5b3-af3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648543796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543796, "uuid": "0a18ac8e-7bb7-4dbb-8d20-978f336e70fd", "comment": "Malware payload (AgentTesla)", "value": "b469a2fa7fe936cdbea6fa2c8696c259", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543796, "uuid": "e957d1e8-b0d6-4286-9a02-4f7f8622749e", "comment": "Malware payload (AgentTesla)", "value": "30817622f85ca75a091ed341e082b9f60b93d501717613097177a34f09323b43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543796, "uuid": "554faf1c-98ae-4c8b-9d56-8c6385e09633", "comment": "Malware payload (AgentTesla)", "value": "d98ffb51fbd6d3c325e2f4ce7d38ba5f6c9e85db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543796, "uuid": "8c1118d3-992f-484f-84e8-f7f2cbba8619", "comment": "Malware payload (AgentTesla)", "value": "9deed83ae6bd79350a068a71445ce5f7db3a454bd65e3a0f7f71d1cd19a7a6149ef3b33981fff60af021e3ebb97df71c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543796, "uuid": "340e0aa5-261b-40ae-9680-815f15e06424", "value": "T1EF35122517E84851EBBE97FAE4B440004B757A1B213BE72D86C628EE0E733C5966F713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543796, "uuid": "7cde3329-fd44-482f-b012-2d477ba5083f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543796, "uuid": "485fa924-9ed5-4b96-9837-b8462e84ec91", "value": "24576:pKejl/7eowKvMJf7PlM2KGewIX0wuOi/wSg2lUC20SMTq:pKeJjeowKvMID5rQOioApjSMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543796, "uuid": "8066e4a6-0dc5-4549-b1eb-afa0ad5fa633", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543796, "uuid": "38dfbaeb-837a-4930-9319-768396d6febc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543796, "uuid": "77b08f12-f3e6-46bd-b15a-f0294003d661", "value": "b469a2fa7fe936cdbea6fa2c8696c259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25b7070-af87-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648575788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575788, "uuid": "d4b6a316-1ab5-44e1-b8a8-fa1830dca9e4", "comment": "Malware payload (SilentBuilder)", "value": "9f7e43aa359dae7c69ed0e8f5e771d0e", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575788, "uuid": "a47fb5fb-e528-47f3-9908-3158dff934a7", "comment": "Malware payload (SilentBuilder)", "value": "308b593f5b62b6ab4cf14a46ec1cd2e3b4ebbcc8f96f50a9e3463424410a0570", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575788, "uuid": "0b0c0ea8-74e2-4e6c-b156-a0f66115c621", "comment": "Malware payload (SilentBuilder)", "value": "9cf8d8fc97098b929d25ef7517493b1a8980c3e1", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575788, "uuid": "4540b99f-21ba-4a88-836e-0fcac6944024", "comment": "Malware payload (SilentBuilder)", "value": "94722071c388fe8081a65590d1da667896d755ae0298159baf183363d9f20da1829d5b1aa0b349857b430f5719047c49", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575788, "uuid": "811c1bd7-eda7-49c1-a93d-b7393c19496a", "value": "T136B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575788, "uuid": "b591dbd3-5ee7-4d2d-96b4-eda4a0e99580", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMJ:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648575788, "uuid": "097ba427-f71f-4f13-8482-71f03a89a68f", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648575788, "uuid": "86b95289-4372-4b3c-8ea1-de08a0da459b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575788, "uuid": "51d35cb7-6c03-401c-aa91-3e4549693979", "value": "9f7e43aa359dae7c69ed0e8f5e771d0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f861e96-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648536055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536055, "uuid": "3eaeca14-8c43-41d5-b0fb-2d172639db95", "comment": "Malware payload (SnakeKeylogger)", "value": "60a31884926f3b26908b1871297924a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536055, "uuid": "4486f57d-d3d1-4335-b062-324c9c0132c9", "comment": "Malware payload (SnakeKeylogger)", "value": "30ba4a249cb8b169da499f1f4d6094af0a12bec747e088b047542c7bdf07f507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536055, "uuid": "a824f04c-1edd-4ea3-ad95-8808e77e0cb7", "comment": "Malware payload (SnakeKeylogger)", "value": "7146fa00819c7adbdc92064fa98b680197b4ec86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536055, "uuid": "6f2db954-a579-4e6b-a319-d73efd137b77", "comment": "Malware payload (SnakeKeylogger)", "value": "6d1436a769e7f30577d58a3d0178002fe6f783208780179b4ce33fa9323c13f39a06e6ddbb897b44f5b74591e1fc46e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536055, "uuid": "b0471245-ce39-4b7d-816b-8fccc0fb6d47", "value": "T132422A90ABA8D9F5DC360AFA5CF74A111B69B206D8169F0F74CE730F5C2361205B2B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536055, "uuid": "03db9892-a75e-4ea2-af14-6c789017da06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536055, "uuid": "c855d879-3f2f-40fc-94dd-d10d2aecd62f", "value": "192:Lp9aqmRuQMcbDKJlKFFfiiLX2HS9yxSyrsRt8G3mSF6zlYw:LpkDuQMcbzFiiay9ycyrsR2vZhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536055, "uuid": "060d2263-aec2-4b71-b22d-732633f34da1", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536055, "uuid": "9a9a273c-ec76-460e-8c2a-86b2ef6cda7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536055, "uuid": "81925efb-de39-4a7b-a6a7-b02bce6e86bd", "value": "000098765434567800098765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309dbbdd-afa3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648587597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587597, "uuid": "74d0b1bd-99d4-47f8-9397-062ea687bd98", "comment": "Malware payload", "value": "e7363072fd9fc98748f2cc3d74db234c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "wslink", "colour": "#2273A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587597, "uuid": "63a1ee88-4ac7-401e-8597-94d9549f370b", "comment": "Malware payload", "value": "3180d22f33b9a964d47c3f00d0527b9d6903cfc31e283920ed297fac2ba2cd50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "wslink", "colour": "#2273A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587597, "uuid": "990ea104-c17a-4d24-b46c-d785c8090837", "comment": "Malware payload", "value": "840bbd3475b189dbb65f2cd4e6c060fe3e071d97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "wslink", "colour": "#2273A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587597, "uuid": "92313413-ccba-4220-b289-6e5792e372b3", "comment": "Malware payload", "value": "0f66e1a6daeae9089c7267c9d938f561a2c14089a63bba9bec7900086355e3d2c7258d564247a585cc8589daa3dfca85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "wslink", "colour": "#2273A6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587597, "uuid": "fd6839f4-dc38-4326-9afc-cced080bf498", "value": "T12C254B13AB5455E2D9B7C178A47B821397F0B44603B0EBEB97E4A5790F93FC562BA300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587597, "uuid": "fc6f21a5-f273-40f4-b6ec-02d448c22cfa", "value": "924e3a91a9838185230da3ffc45ff04e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587597, "uuid": "7ba1eb10-620c-4d6b-8a5d-e5744726bfa6", "value": "12288:QzoMLh8jiGbLFvsLjrurTveI9GyxaxtGgIbxratCsaYk:9MLh8j9LpcjrurjeIUyaI9rZsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648587597, "uuid": "1104c799-9dbc-41fb-bb76-662958ad334a", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648587597, "uuid": "74539840-7aab-4243-a0ce-d0bcac606c95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587597, "uuid": "72f9a72d-b7c1-4dda-b7b2-13e94214173f", "value": "3180d22f33b9a964d47c3f00d0527b9d6903cfc31e283920ed297fac2ba2cd50.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de215b96-af17-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648527758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648527758, "uuid": "e76c9d72-a85c-48e9-a268-eefb5315e3bc", "comment": "Malware payload (Formbook)", "value": "bcf7f91a0663e048df762c473c1589ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648527758, "uuid": "43c08961-696a-4807-b5f9-98527e7e81c7", "comment": "Malware payload (Formbook)", "value": "3230e570068c3d5d6d0017a368fd6e5b179eadbfec7a8d5eb9b10308fa22c637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648527758, "uuid": "af1c131e-360a-4f16-9731-a0411d7a372d", "comment": "Malware payload (Formbook)", "value": "f33829a093901801d3a35f5c7bdfe5c08ddd4ab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648527758, "uuid": "a2c1c49a-9318-4e5a-9f7a-884ad09c3d7d", "comment": "Malware payload (Formbook)", "value": "adc9e22ad054acd676038602af9414ace0fee5a4dfbd42a5a5d9f4c38e5720b124512acf5a92bff0c8aa06680c8c91f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648527758, "uuid": "94f26136-aee7-4f0a-8920-a6e9ac54750c", "value": "T13E350185ABA494A0ED7E53F6A471C8304B327C2F6135E61C4ACA3CEB3E773825916357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648527758, "uuid": "07cda8fb-ce4b-41f5-9981-689d83016e44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648527758, "uuid": "2eb25e12-7efa-4f83-9a9c-d8a250410ddc", "value": "24576:ATevBbF8Oc6mbY5dfXDDAlaLeBxDdQPKfd4Xk+skd:ATeZitBYbfXFAxYId4XYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648527758, "uuid": "fa53b2cc-5c8e-41ec-9322-6461457ec2e5", "value": 1129472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648527758, "uuid": "9d34481f-d2e3-4d02-b38a-abc62e262dc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648527758, "uuid": "0a88efd1-a540-485c-9a94-9e14d91455d0", "value": "UDFT9203S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0902af-af2f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648537954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537954, "uuid": "0ffa21ad-7f06-47ea-ad73-b9765aca6ce7", "comment": "Malware payload (AveMariaRAT)", "value": "e2dbada867d6e0f4da7f2afb8cb660c9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537954, "uuid": "01687eef-3904-4eec-a2ab-055a6a9132ae", "comment": "Malware payload (AveMariaRAT)", "value": "3283830ccf60d4481608cb301a1e81f6b89bd02ff08e41f6034488bc28baf010", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537954, "uuid": "7d9e8ecc-8637-4b15-822b-83a82436ee60", "comment": "Malware payload (AveMariaRAT)", "value": "09306c26756b13ac48c20d3e9439bc968bcf3524", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537954, "uuid": "a6254559-0613-4982-87b0-e4aaff3afe80", "comment": "Malware payload (AveMariaRAT)", "value": "4b63743443948871a8ef9cd4f75771614789b1a14a90700d2034d5ffdd530f5308a155b7fad084a864375f2b1a841578", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537954, "uuid": "3338275d-67a6-424f-b67c-bdd1c8d06cf5", "value": "T1A1659D4113A45D6ED2EF4772E0FFCD586AB1E8589B2AC28D0783DB9A84AE74DC4053D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537954, "uuid": "4b1b2425-b9d4-426f-847a-c823e5133a3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537954, "uuid": "1cb0bfb3-d40a-4483-ade2-e00bdd724720", "value": "24576:aJPb3dZ3PH01/CzF2qaH7dyKR3NAMrdGSnhri1a7huqvhA7l:uD3PfBF2qUdynMrdGSh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537954, "uuid": "ed3d0388-212e-4dad-9e24-0b683681ca61", "value": 1541120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537954, "uuid": "315d2b91-2934-47b8-9c15-1f88441cd1b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537954, "uuid": "ac0c8ba6-cda8-4fbe-a258-42291067e5cf", "value": "Documento de recibo de DHL,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751c8bb5-af40-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648545191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648545191, "uuid": "4725cb14-01cb-48cf-a64f-146735a79047", "comment": "Malware payload (Formbook)", "value": "da532a820031b6d1cf1d9da2b93f6de3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648545191, "uuid": "bba4f900-a6f6-412b-be31-6cb363d4fb6b", "comment": "Malware payload (Formbook)", "value": "33ea37cc06b22e51f0fcf9b04bc11dcbaf9d46169560b3261860e2a2eb275fd4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648545191, "uuid": "33cd487e-f826-4836-bf69-76251bbfe2a9", "comment": "Malware payload (Formbook)", "value": "dd32ff6e7fb6e2ebd8593290b83652f7ba93fb73", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648545191, "uuid": "b2b8250d-f7e4-47e5-a394-13c0b57f5089", "comment": "Malware payload (Formbook)", "value": "87b060c76a1993399bae7ebfc134eb9122f3639564f86c071e833b4e58bc6e62a6c354ac1e35a3e988b16096fc03abbc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648545191, "uuid": "a9267782-72f0-4d89-b80f-a3a34e193372", "value": "T16F141211A44BEA01D06EC973A9C8D5DEC335FDFE14BE550A251BF1BA207368B4706CEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648545191, "uuid": "b83f4394-1512-4ee4-ab23-f07511cc702f", "value": "3072:Fived+GPoZSlY7uXBF1Llc1VTB6Equapsnsbr/vZO+TLWkaFfTKS9bJhk7bwdtmd:XSBSXBCTB6EwpsnsP3ZOCCxf+SNPk7Uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648545191, "uuid": "b36841a1-7783-49fa-9528-403f56c9fa12", "value": 193704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648545191, "uuid": "e87994e8-9b38-449b-b95a-f697bf4f5cbc", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648545191, "uuid": "a3248a9e-b50e-4417-9deb-199562cd55b6", "value": "RFQ.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a5cf36-aef7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648513807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648513807, "uuid": "c8d581ce-6243-40be-9e05-2c49cd6eed93", "comment": "Malware payload (Heodo)", "value": "9c0c7160ab01bbddd255d1158ef64714", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648513807, "uuid": "e07d4a8f-6d29-454a-a1b1-5d9875f4df9f", "comment": "Malware payload (Heodo)", "value": "33f0041e3f93169b507470c47da75c35ce088a40b467d8a937f5685928acf0a3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648513807, "uuid": "3c4ae908-5c2b-455b-acad-d8fa483193bd", "comment": "Malware payload (Heodo)", "value": "a28a25068d8de412ee2570814e9efeed525920cd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648513807, "uuid": "8c54ba8a-040b-4238-aade-e217f38967d3", "comment": "Malware payload (Heodo)", "value": "19381efdca07f253ceb2a6b79a00456868fdb22cddb3d34da8226dc92ca1b57fc1a89f2e8d8cc87422183901d6fb2170", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648513807, "uuid": "98f77443-dfb9-4d30-b442-468b9685a5c1", "value": "T1C3F48EA23183C8B3C3F9B37409829F589F65FA9553B31253EA90153EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648513807, "uuid": "724eae0b-b911-466d-b309-90f2a39fec73", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648513807, "uuid": "df202e3c-4770-4881-993d-d3d5560b3cae", "value": "12288:Wvz1CLJyyvmMLSrBg34ruGbPlVpqb+DlYzF:WJCLJyybLqB64ruA9VAqDlYzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648513807, "uuid": "b1676af7-b8f3-4a96-8837-36465993d58d", "value": 784560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648513807, "uuid": "d52b4981-2250-478f-bd63-95dcbe3bc122", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648513807, "uuid": "92e0a1bd-6cba-4670-b9c1-4c01d5bcdd0d", "value": "emotet_exe_e5_33f0041e3f93169b507470c47da75c35ce088a40b467d8a937f5685928acf0a3_2022-03-29__003002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3227c7-af43-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648546596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546596, "uuid": "db77e120-9589-4443-8553-ed9c3730e94a", "comment": "Malware payload", "value": "c6c6162cca729c4da879879b126d27c0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "plugx unpacked", "colour": "#D4A7B2", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546596, "uuid": "da0a87cc-9931-4828-bd19-bde08a5013f7", "comment": "Malware payload", "value": "344fc6c3211e169593ab1345a5cfa9bcb46a4604fe61ab212c9316c0d72b0865", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "plugx unpacked", "colour": "#D4A7B2", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546596, "uuid": "e462060e-67a0-4c40-8b42-cd085e57829d", "comment": "Malware payload", "value": "80e5fd86127de526be75ef42ebc390fb0d559791", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "plugx unpacked", "colour": "#D4A7B2", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546596, "uuid": "8d7af21e-babc-4de5-bd0f-bd249d1e08b6", "comment": "Malware payload", "value": "1706666a2e8f7e2d56b871e6cc5fa4dcf5dd2f41f689ed6c0f314677cb523aa8786456461110e89ab2a1f46afec47483", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "plugx unpacked", "colour": "#D4A7B2", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546596, "uuid": "fe344ff3-a144-49d8-a136-1ba94ad820e1", "value": "T1A234C5F2B090DAB5FD9939B5816C16656F98E660238612FBD2CC7C8C092B5C633742CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546596, "uuid": "161fedad-f252-4940-8792-e1454ddce87b", "value": "6c0cd514bf0ee7f973a56ac40daccd05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546596, "uuid": "ccd1b958-801a-4a7a-a124-a5e570ee80e9", "value": "6144:Jwlg8I1Bc4YCqXUqU+EgLg2C9AjMCQWZuVbmTnkX4Vvg9R58TSX:ylg8I1BNYCqXUqU+EgLg2C9AjMKYbm7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648546596, "uuid": "8e12963b-77c4-4bc0-b74c-b574d1c8d3f5", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648546596, "uuid": "6bae3aa4-71b8-4728-9d3f-14e0915ce445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546596, "uuid": "c2627064-2448-4efe-96ea-3e4595d743cb", "value": "talisman", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56b4c8a-af6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648563875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563875, "uuid": "2a1c3b21-27d8-47db-b17a-54752eb8f92f", "comment": "Malware payload (Heodo)", "value": "845a09a0597a563be828ebfed8c60e94", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563875, "uuid": "89f360ed-0f64-4e46-9036-8f7ebe2c8994", "comment": "Malware payload (Heodo)", "value": "350532aebabcdd88cc9909c58b321ac75e3d874a82ba5b7dddd9a1fa9d13f940", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563875, "uuid": "ec7bb619-ae59-492f-b544-ce4219f88b4d", "comment": "Malware payload (Heodo)", "value": "34a6164a763127b79418018a3711c7881dd7b217", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563875, "uuid": "2422a6c3-978a-4a0d-824d-232b4ae32936", "comment": "Malware payload (Heodo)", "value": "2eee71509e1969d30c0b5fecb8f262f5effd028447f959e5b70b1c78369f60355161758605f7159ed74d3ad495496a90", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563875, "uuid": "7071df33-160f-4512-8511-3002506f6114", "value": "T1EB548C2176D1C07BD9DF02322A16C36A62F6B5B08DF5C247FFD51B0EEE325428B29259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563875, "uuid": "2bf5f698-8b31-416a-825f-d23f8b1ce49f", "value": "196752bd65f33bc6f5dd0426f39259ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563875, "uuid": "23b3022d-5518-4eb0-88f4-186d311b81e2", "value": "6144:buZlJOFmzvtg1Eyid5GX5BVhthqnhdDpV+WWT8D:bGptged525pthqnhB+Ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648563875, "uuid": "255a3790-3dd9-429b-8cd6-afb5ec34d9af", "value": 303541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648563875, "uuid": "51e81944-5f68-4d00-9015-5c4321ed347d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563875, "uuid": "3f849a7f-cf87-472f-98e2-57b88874a9e7", "value": "emotet_exe_e5_350532aebabcdd88cc9909c58b321ac75e3d874a82ba5b7dddd9a1fa9d13f940_2022-03-29__142429.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18de153-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648573183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573183, "uuid": "4018dfcb-6abd-4def-b010-4c8a757af883", "comment": "Malware payload (SilentBuilder)", "value": "9f25b234d352067db742a46faf8e05bc", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573183, "uuid": "79a43072-fa59-4e16-a21f-d97f50466f75", "comment": "Malware payload (SilentBuilder)", "value": "359f7d2b9452e6ac52910acc59f7f5960560fdd91bbd37f30720a7b9151bdd82", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573183, "uuid": "f663ac55-b41d-44e8-979d-43e36bc2b1f9", "comment": "Malware payload (SilentBuilder)", "value": "c2ffa5f599e6eee89124250c46d1094cbc1d1e34", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573183, "uuid": "5fbd58ba-3d15-4b59-8458-bc2d2ebbf1e1", "comment": "Malware payload (SilentBuilder)", "value": "ba870aa158001a211afd7718baf986f797430ddab8556125e6833b50c0f258ad4458033a4b953e29f93e119d824a3776", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573183, "uuid": "a32f1cd6-54cd-46ec-95bf-959cb14bc14b", "value": "T102B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573183, "uuid": "fd082402-5149-4b06-b69e-dfa19ee70dba", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMF:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573183, "uuid": "5794e91d-3b81-45f3-a16c-8155ccb9e4a7", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573183, "uuid": "979b3649-a5c9-4b74-afa3-e8b2cafc50ab", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573183, "uuid": "c8a0424b-c830-4d6e-9b8c-6d148783a8e3", "value": "9f25b234d352067db742a46faf8e05bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0292eb-af5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648558623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558623, "uuid": "09e6a698-e0bc-424b-9d4d-e1816ab87b16", "comment": "Malware payload (RedLineStealer)", "value": "a3919d3e47be824e2e47f9ffc529e398", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558623, "uuid": "e9a25559-b463-45ac-9953-ec60aae1dfaf", "comment": "Malware payload (RedLineStealer)", "value": "35ca9c06c64525702c430b2781dca9570ba31ba755294b034b926357a2aa2451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558623, "uuid": "bbff92c4-5211-4834-a1e5-bf6db4b65b83", "comment": "Malware payload (RedLineStealer)", "value": "7a0ce344a9758b105de7aa8dce0f3942981fb21b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558623, "uuid": "536b7cd2-9ed7-42ac-b622-7e088cd82d24", "comment": "Malware payload (RedLineStealer)", "value": "0bc83bbe8af8f8d6b108fd1d227e9fce259e6a1baaf5d966d847dfea2e063c40239f26da74401f1ecea1fb7eb3a42b03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558623, "uuid": "c0ba2999-b024-417f-b3c7-258a516effd4", "value": "T1E325DFD0DB51346EC0E1A0B7E0051DC32D534F149DAA2332569AB7AB4A37763ABB3E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558623, "uuid": "de3fcac3-8898-456e-8f4e-41b96baefc70", "value": "96916b97ebd360a460e24a44f1ef460b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558623, "uuid": "315e35a9-fdae-496f-a0ea-9634c6e35529", "value": "24576:m0YXqKt+y9qs2zhpe9XGwgyNaE0ZtAbZxJFVh3c1WPCRf6i0:cxt+C2zhWhgyMELbdhMApl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648558623, "uuid": "4b8f6067-6afb-4057-9c6d-a60d2ab60bc7", "value": 971232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648558623, "uuid": "3ef026b0-8295-45cb-a855-d4c956768dab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558623, "uuid": "628ff809-f03d-44d6-849e-dca194901158", "value": "a3919d3e47be824e2e47f9ffc529e398.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01a68f6-af78-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648569342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569342, "uuid": "ae3254ba-89b8-4892-90e0-864c3b7ddba3", "comment": "Malware payload (SilentBuilder)", "value": "0ad1eb933a6e3fd570126d6c663c77a1", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569342, "uuid": "a2eacf42-039d-4957-8a48-f3e115dc3bb2", "comment": "Malware payload (SilentBuilder)", "value": "36ddef878f541cf2477defbaacc04b5459ccef1311c752d594799ed768f7e95c", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569342, "uuid": "98f6c664-5c2b-4627-bbf2-8a8660c330dc", "comment": "Malware payload (SilentBuilder)", "value": "ab4fe793ecc3ce1e80217cc91ea51d0b04ff101d", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569342, "uuid": "775816c5-e2ca-4dba-8e30-04e9b187f4cc", "comment": "Malware payload (SilentBuilder)", "value": "8f8bed8c9e572f83078fbb58f765dbed27ba8e025e96b59a65a3d9f99f08b9dcc7ead6b2f822eeb2e686b49c8dc5e3be", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569342, "uuid": "87abaad1-6e18-446d-a3f4-c4e72d2f4c6b", "value": "T1EFC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569342, "uuid": "b2f467fd-62ce-4e78-b267-bff1748d3cb9", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCM:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648569342, "uuid": "8f112a8b-59b8-4933-b55d-473ca6730cbc", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648569342, "uuid": "d80f3714-f3c5-4a47-a271-cd7c96bad495", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569342, "uuid": "0e9092e6-7bec-4a69-93e0-0c2c4aefaf92", "value": "0ad1eb933a6e3fd570126d6c663c77a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf32cd0-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648536051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536051, "uuid": "fab04990-bb14-4074-a600-d03531c3a3af", "comment": "Malware payload (SnakeKeylogger)", "value": "33bb0ff6520f2b00a879139ce10a57d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536051, "uuid": "8a544b75-18b2-4d09-8bc5-52136f6eaecd", "comment": "Malware payload (SnakeKeylogger)", "value": "36fc6f6f25054deecead71b0c3360fe845a45b8f51a6770ef11826f97be58e71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536051, "uuid": "3c241110-a42e-4f62-a3e3-f7423da9b3b8", "comment": "Malware payload (SnakeKeylogger)", "value": "e24efb8d7f19803bda8f6c0947c8ce6fcf7d0aa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536051, "uuid": "ec0c492c-a31e-4803-8cdf-b64b093dbdba", "comment": "Malware payload (SnakeKeylogger)", "value": "aa354627bf0434836d3b4f1f4dfa351c62e05021ceac97da5a11a64273fa4ed22205d7e520106b0f793763727129c8bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536051, "uuid": "4b09e506-87ba-4211-b8de-fdf857cba637", "value": "T130C4235252998F4BE5BF0F3A2976E9D8E3F78F5E1DA86FC95B005F293920A414102273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536051, "uuid": "b95dc673-9f73-49de-85b4-124ad714f62e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536051, "uuid": "5382c7c2-e0ec-40a6-a32b-624e917f8c5d", "value": "6144:jGi6Nr2wHVWnFiiDi5U61kB7RGzOMcn5I2G8Fbh715RNIvbtofKhHgo9DRkgwm8m:uNrrIp7lRKj8llRKhHH99kgwtPzAhdb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536051, "uuid": "8ab56725-408f-42f6-967f-19a8bc7af41a", "value": 589832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536051, "uuid": "06568262-764a-40c6-b341-016cd0f9cb54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536051, "uuid": "55053f53-64cc-4cef-b4ab-e9327e51c584", "value": "invoice0000000001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94aff06b-af2f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648537943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537943, "uuid": "6503bb8d-6246-4223-9898-0f6e0f9f7ce5", "comment": "Malware payload (Formbook)", "value": "1faa2d8d14a91055a54728de6d8825c3", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537943, "uuid": "17ee5d67-a2a0-4f53-9b2d-4ec3b11a2b84", "comment": "Malware payload (Formbook)", "value": "3767dbe48449f355d429f2a4aecd212925ed1dfd69db1a7ff263c5660f58d571", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537943, "uuid": "212d7f94-10ac-45ca-bda1-640a375e7b3a", "comment": "Malware payload (Formbook)", "value": "db16a2547d13905f6674ddbf4405f5d93767601b", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537943, "uuid": "9c621b0b-14cd-4402-bbfb-f21706011aaf", "comment": "Malware payload (Formbook)", "value": "c73959178aa678c6b1ffdc0c74fb3fdb783ea9776b0729fff61f0fa8900913539f69a81d0261bbb202a07caf859ad55f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537943, "uuid": "966d98c5-d6a1-4f68-a24b-d4ba1bb3cf18", "value": "T126746CE0A740C465D8A7967D983BDAA7B823A25D9CAC090D2D91FF0B3D733474027D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537943, "uuid": "3ef3e718-681c-4acf-a8ce-7b6ff6332228", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537943, "uuid": "de97e3cb-f8b2-4467-808c-dabd3ba09f57", "value": "6144:EbE/HUruDA1+f9OUgFNWmyCpPtxqIfo/nTEkQzL+RsNnKUlE5tvPV:EbHgA0f8UgbsCprOTBQzvUkml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537943, "uuid": "429a2ada-609b-493f-9c3c-6e15f102809b", "value": 352200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537943, "uuid": "7ea8986b-80c2-4ab0-8a5a-57903c7adf95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537943, "uuid": "7ab94a25-0d78-4980-84ae-08cb81206085", "value": "DHL179030 document receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117734f4-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529133, "uuid": "fd2d68a3-3d90-4847-a803-62458814ddc4", "comment": "Malware payload (Stop)", "value": "7b0d0ee5addada8e0e2830c8f9e86f57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529133, "uuid": "6b7a3be0-d200-4298-bf8d-efe9213b0dbc", "comment": "Malware payload (Stop)", "value": "379adf36c2cf8f91ca2490e4d233bc9d1d89c5444fcd23378d8978c8b473e793", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529133, "uuid": "693ffba5-57c4-4806-9ed4-adce9d606535", "comment": "Malware payload (Stop)", "value": "a6919fb6cf1234c06fe4bc15f5724f48112a7f27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529133, "uuid": "03dd654e-16d7-4d5a-ae09-4a3f579106f4", "comment": "Malware payload (Stop)", "value": "da71ad85b75cb0215b11f149d590d359adff8bd7ca1293756b8fe3537ee50cd223c1186f074f650a55bf311da6bb7261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529133, "uuid": "34f05f79-efb1-4b28-92f5-f995df9d8279", "value": "T189050110BBA0D038F4B756F05A7593B8653EBEA19B2494CB63C46ADE56357E1EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529133, "uuid": "955db8c1-a1a4-4da9-8834-efad90e0fb65", "value": "699070d0802ac292c6d967d0195e7ff3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529133, "uuid": "8021309f-4dba-490f-a303-e9a0496d2222", "value": "12288:+855y5BMZNHZcmjJlbULjKXE3qT35iYQtWFaFjGztIbTo25y5iJD4wleBZDEg6px:+ayqN57ULxqFLna8BIwAyEJD9/Zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529133, "uuid": "20adbb4c-1085-451f-b94c-ac00e56b1f33", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529133, "uuid": "c56170c7-2a01-47a5-85be-4dae823e6e3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529133, "uuid": "589a83da-fb02-46fb-a072-a7a8e43e7297", "value": "379adf36c2cf8f91ca2490e4d233bc9d1d89c5444fcd23378d8978c8b473e793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a72c0e-af25-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648533650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533650, "uuid": "5af22fde-5368-475b-838c-6fe015815a67", "comment": "Malware payload (Formbook)", "value": "1d4d1116d1e3f031a880c19e5e90d5a0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533650, "uuid": "c32fdd55-641a-46ab-9947-1219e91ed2e6", "comment": "Malware payload (Formbook)", "value": "3848c0e85e47489c42a9c9619ea0f67fbd9e6bf03c0c3f4b07d2b56bb7f7aa5c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533650, "uuid": "69f8d7a6-5fe1-42d9-9d27-8862b9066bf5", "comment": "Malware payload (Formbook)", "value": "c70ece26f3225546e5039ab2f126475fa8f887ac", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533650, "uuid": "34c13905-4667-48d5-96d8-1890238bf139", "comment": "Malware payload (Formbook)", "value": "e3f7501142782b33d175fb84827fc6d5575d703150c11d4f5f1015f6a34a609c6b845367aab43f0bef872333c5de72d1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533650, "uuid": "134da46a-36d3-4f8c-a6e7-0ad4d2c4895e", "value": "T18D14120E7AD3C5A8C054C8BF96169553D5F1FF9028AA42AF759B31F9043B89CD8903AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533650, "uuid": "9db28bde-5748-448c-95ab-49266187dbfc", "value": "3072:CizLd7JeKwRXtakp4TqJFC3J94f1+lRruh69rnMNvX9VrsfhrZYJzgVJtnaYzKT:rXX4tpyTQC594f1+lRKIrC0f7EQJtnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533650, "uuid": "d95eb58a-2e21-4ac8-8604-89ae96175a62", "value": 193912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533650, "uuid": "f76ce131-af3b-47e7-9d0e-a052ea1651bd", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533650, "uuid": "02c3522f-ca2b-4ee4-8066-f386d89cae08", "value": "PaymentXAdvice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2d178f-af78-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648569310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569310, "uuid": "02223729-b2ef-4ad5-aafc-c477b00983cb", "comment": "Malware payload (SilentBuilder)", "value": "8fb38830230eeff72c5788b80017900b", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569310, "uuid": "2f0ca259-91c6-46d1-bdbe-a5f936feb21c", "comment": "Malware payload (SilentBuilder)", "value": "388461b9223d420ebc8775e113bd3f148b585799472a924bf2680ef2aa3a18e1", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569310, "uuid": "8c3afad7-4580-4737-8725-cb94506b3e96", "comment": "Malware payload (SilentBuilder)", "value": "cdee7ccbfcc744563431cf6f6d256740b8c273ab", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569310, "uuid": "4490ba4a-5a91-4b95-b758-08e3fbdd53b8", "comment": "Malware payload (SilentBuilder)", "value": "38769214064b49b2a1700f7442021a74ca86c3067ae65e7a36f129b1f0471cd4650abdee87047360c89ca200b1915660", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569310, "uuid": "58a6cf30-ddbe-49fc-b661-822575bb99ba", "value": "T18EC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569310, "uuid": "0d658f60-19f2-4411-850c-63fc60850c56", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCI:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648569310, "uuid": "b66e360c-ba08-4195-86e1-62603dc5e763", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648569310, "uuid": "051a2157-8e8d-4a64-a2a8-4e5b18773e2c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569310, "uuid": "6d38d765-49f3-4316-867d-6d113f5050ad", "value": "8fb38830230eeff72c5788b80017900b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e03336e-af3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648543837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543837, "uuid": "5492c6c9-c76a-4bb8-b6e3-c0c5c0664235", "comment": "Malware payload (Loki)", "value": "2452325885751050fd5e987386068a06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543837, "uuid": "cf1fa3ba-cf3b-4372-b327-513969905b8c", "comment": "Malware payload (Loki)", "value": "390e205dd5b36cc2139bfaf915ed7f036a63ae32c3e843b54c174d13a8cbe3e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543837, "uuid": "1d0c97a1-08f9-4298-a9e6-50244f284aae", "comment": "Malware payload (Loki)", "value": "bf1a2bcf84b781c72b7bcc56a7299a7dcd84ee60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543837, "uuid": "7439c832-3298-4fda-88e2-b18914ceb2e8", "comment": "Malware payload (Loki)", "value": "a0241cd4d23212c20f458b04728a11bc6ccb2f6d2d2163fe64285a6899fb650de5e9fe49db2cfca8be80da3b986a8ebc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543837, "uuid": "4e4fe197-59eb-4ef6-86b6-77ba24625102", "value": "T19C341216AB24D57FD59347B84D39ABAB8BF9823A14911A5A47423F3D3D232C0543FB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543837, "uuid": "e147a9fc-151f-4b5f-86c7-19e5a8c0fec3", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543837, "uuid": "06121173-4ba2-4e43-ade2-b2357bfc2aef", "value": "6144:mbE/HUbqo0PPDD23IpvQEO5OiLpfrAJgXv3JANMQmV:mb/sPDi3GvOzMJgf3aNXmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543837, "uuid": "e5b0c5d2-7739-4dc3-9198-1370ee05bc66", "value": 249546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543837, "uuid": "1746e0b9-4480-476a-8a99-6aeec9558b6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543837, "uuid": "66f965aa-3ef7-406d-94cd-054a116ef3c8", "value": "2452325885751050fd5e987386068a06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6572c4f5-af5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648558050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558050, "uuid": "24c61dc0-df3e-40dc-b1bb-598ad2830a87", "comment": "Malware payload (Heodo)", "value": "94511c6ec69b3bc5c702d3f0c9c74e47", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558050, "uuid": "8691df18-c672-4c5f-bb9e-957e8163d5df", "comment": "Malware payload (Heodo)", "value": "395277c0c6537feb779ed55b95a368c87ee7c42de5da5f26490924923dbe65dd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558050, "uuid": "1c7c802a-6ffd-450d-9226-1e6cf9378dba", "comment": "Malware payload (Heodo)", "value": "276e5701c3c96bb1bbc8dcdc363334ddd900b592", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558050, "uuid": "7ca83e17-ab5b-4c34-9941-919486adf4df", "comment": "Malware payload (Heodo)", "value": "bdee9520e2a9fb7937ce6ee9c729a4e5562e524cae64a39273bcec4e957d37450b3607d916d3fd1878f525f1fd50eca8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558050, "uuid": "4d5fd2db-f7c7-4faa-9f7a-2f0759dce39f", "value": "T128C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558050, "uuid": "577b7b96-7ba1-4b85-b339-10904100ddce", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCs:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648558050, "uuid": "c24f9af0-874e-4532-b9cc-63c0781cda61", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648558050, "uuid": "15326a87-069b-40c2-8ff4-575e7d3a9a36", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558050, "uuid": "270a69c0-5b38-469b-8203-b63dc4d45600", "value": "94511c6ec69b3bc5c702d3f0c9c74e47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffabb2c5-af66-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648561745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561745, "uuid": "ec2e08bf-1f6e-4068-8268-3cd50e7feacd", "comment": "Malware payload (Mirai)", "value": "2d44bb11a89e74460c55e4ea9971f964", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561745, "uuid": "680e6226-160e-45c4-be24-5290767672eb", "comment": "Malware payload (Mirai)", "value": "39e6db100c6a53d045ad3ceefac6df58acc14430c40dd2a63391ddb526f1171a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561745, "uuid": "d60faaa5-8ae9-4014-b5f6-a6d930ca21ea", "comment": "Malware payload (Mirai)", "value": "a30ee2750cd44505ce49abca5d1818dec7b894cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561745, "uuid": "f294f3ca-e406-4a17-948b-cad0e586f656", "comment": "Malware payload (Mirai)", "value": "1b6bc335fe4b2779e9f72fcd935ab8d7494c61fbc686b566a04f28158c54712544a5d169ef4c00eab007a01e52ce105e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561745, "uuid": "db08385f-e104-474f-849a-3d5ccced0cee", "value": "T1EAD2F194DFEE6A44DCC831FB6A14AB9CF7804DA046B48CC50143D2E7A7960369F16F1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561745, "uuid": "a6a9eb57-4f2b-452d-b49f-15cd61be964a", "value": "768:v/K91qtU4F54Yb8ixTX6LSFDZqSuzubhwCjBXfLb56F2l9Tcn:nK91qtU4F5Nb8iVX0SF3CsjVLboIDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561745, "uuid": "85f408a6-df78-49f2-bee8-6df99cc85ad6", "value": 28816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561745, "uuid": "bf375347-b7b8-4526-b48c-63eae32f20c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561745, "uuid": "eb195cd5-6062-4d6f-9aa1-c937ba571c8c", "value": "2d44bb11a89e74460c55e4ea9971f964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf07b6e3-af71-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648566388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566388, "uuid": "796509ea-a93b-4b13-9724-a93da8aa6714", "comment": "Malware payload (SilentBuilder)", "value": "f905b3173209683942d189354d7a6946", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566388, "uuid": "172e0f11-29ac-4d9f-8dfc-cbbba7e25618", "comment": "Malware payload (SilentBuilder)", "value": "3a6cecb154c56030899e87ee4a0eace7cf598c93aaea1c167ca2eed54e85ae54", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566388, "uuid": "db622341-0e9b-4d68-a2d8-90406e266c93", "comment": "Malware payload (SilentBuilder)", "value": "e8bb2c1ac7f4c13ff1a31f3429b989acd71e3138", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566388, "uuid": "80884ca8-da7b-4723-b677-6f42f5da343d", "comment": "Malware payload (SilentBuilder)", "value": "13871ed51eaa23663c44c6e8f76ec0f35ebaac83250aa9ad0b9c99df213413322157bd49a280d0a3a12511676c38c162", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566388, "uuid": "e477e967-bf62-4644-a5da-39e707305ccb", "value": "T162C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566388, "uuid": "135da395-6d29-484c-983b-82c7bcfbce97", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648566388, "uuid": "f3fc8b7f-17b2-4a97-8cd8-84e466cd7e17", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648566388, "uuid": "e1df4124-da97-486d-be53-f3218bd98d7a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566388, "uuid": "a0ab1ec5-89c7-45b2-8718-baa08355d8ff", "value": "f905b3173209683942d189354d7a6946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b609af4b-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648573218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573218, "uuid": "4923d6f6-cff6-4d05-a324-552dfd51ef8b", "comment": "Malware payload (SilentBuilder)", "value": "822d93d0cc635c64579fd9f2c52ae9c8", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573218, "uuid": "6fe45570-bfb0-4af2-bb86-16e000c9c2ad", "comment": "Malware payload (SilentBuilder)", "value": "3ae70ca231fc68caf9b069513aeeed261edae36013ed6fe2f2e5d3ced1e80adb", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573218, "uuid": "ed8a9c4a-814e-4599-84da-b51636177505", "comment": "Malware payload (SilentBuilder)", "value": "35c3127f82114395f1850cd4cc195a31b569ce8a", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573218, "uuid": "3d971df9-28c2-4baa-af6c-63aa211b3f88", "comment": "Malware payload (SilentBuilder)", "value": "f035e1a3601e1807ce785a15c3dcda05e647d00b2dd03a7a94fef8063e9e526f3c17563729d62560f23f179ce134e374", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573218, "uuid": "d7e2d4e3-a383-4a6d-b025-2b4fd775496e", "value": "T163B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573218, "uuid": "8070a3ba-4c12-42dd-93d6-ce2684a4f748", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMU:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573218, "uuid": "f3d840ad-12b5-4b44-bf3d-d31174251547", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573218, "uuid": "4df8a39f-2528-475b-8a84-83aedf762994", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573218, "uuid": "b33805c1-f289-4bf8-a899-37fd3a24cb2c", "value": "822d93d0cc635c64579fd9f2c52ae9c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd4a412-af56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648554866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554866, "uuid": "d8467019-fcd0-4379-bd5c-08b3a1004425", "comment": "Malware payload (SilentBuilder)", "value": "f043d85f88b1f5b3d5c0961b761cf810", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554866, "uuid": "26b110ae-4951-4c40-8136-9d8903944c27", "comment": "Malware payload (SilentBuilder)", "value": "3b6b3a4d75f286339c871c914fb614d99a8683bd078b7469478a06f94986641f", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554866, "uuid": "52212650-069b-436f-ae46-b84b337e7116", "comment": "Malware payload (SilentBuilder)", "value": "9594827ff286ee51ce1435eedb6ae465614fda35", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554866, "uuid": "103cf3d8-964d-446a-a7ce-4c3a932103ad", "comment": "Malware payload (SilentBuilder)", "value": "8723ea3d9bda7d9ab0cccabbbda75ae1c18fe3f89647381866d7c464c025c26054f03f791e572b3304f57b5cc92aec31", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554866, "uuid": "50c7b769-1271-4bd7-bb5e-c952d60952dc", "value": "T109C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554866, "uuid": "a24af6f6-951f-4e19-95c3-029ef9bb7a53", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC4:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554866, "uuid": "2f2ee3a4-02cc-4a11-b2de-f4a5867d66fc", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554866, "uuid": "b6aa1f95-baa0-4bdb-8559-d48df540c34a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554866, "uuid": "663fc7c0-d144-4593-8d62-a2682eeb0b19", "value": "iMedPub LTD.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa97617-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648561871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561871, "uuid": "8ee87b1f-48e1-4145-8a14-a7e96f61f36e", "comment": "Malware payload", "value": "980e998e778989a4b881e7367f21283c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561871, "uuid": "49b2a620-771e-4b2e-83f5-e09e4a360cc9", "comment": "Malware payload", "value": "3c3c094cd35523aa6af1d6049b0c1ad72d2d80b2c2a31ab30c9fc5ee408e7544", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561871, "uuid": "0eb22bdf-d17b-4e85-aac3-fe96e0f3b8b3", "comment": "Malware payload", "value": "66f61502ffa3f03920f01fa2f8d3cb1fff94e985", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561871, "uuid": "027c0f7c-d260-45e0-b35b-205f5879a148", "comment": "Malware payload", "value": "54da2ec2a9d7d7b67d358127ab0b64715545ae9251e932bb9d5278ba19eb01c84730128ce9b882c7b3c11f0dfbaaa91a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561871, "uuid": "9ed68dbf-99f2-46d3-bbd3-940a1420cecb", "value": "T1ECC3119C534A516BD58B089FE725BF26C6B01B06EEDC404453F4B8F83FBCF0A985466A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561871, "uuid": "fdc7ae15-5af4-4063-ab83-ed8203d49dec", "value": "3072:1yZ/nst4awLwqya8Ryy79nOnW+Nh4+P3fkdYkBm:zwDBNh4+P3feYkBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561871, "uuid": "d9a40f4a-b8ca-4463-8a18-c33ccabe626b", "value": 124191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561871, "uuid": "7196ee7f-a3fc-4b67-afa0-22ad7824a6bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561871, "uuid": "dda635c5-7bcc-434b-8623-d35a15face9d", "value": "CTMue.PS1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809b7357-af49-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648549076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549076, "uuid": "526f8b16-0d31-437f-ba25-ac0b19ebfec9", "comment": "Malware payload (Heodo)", "value": "f70dc8fd7cb7d71ab2c57cbbc0b5f67f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549076, "uuid": "78c4c221-cce5-4aae-be48-02de5e7ad613", "comment": "Malware payload (Heodo)", "value": "3c751f1b0d1f3cb4ae51350b0213afdcc841841be3acdf465195c56cf3b77bb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549076, "uuid": "aa1c1209-3c50-457b-9438-69adbfad6833", "comment": "Malware payload (Heodo)", "value": "4966bbf76021b07f1e466e89df9cc8525fdbfffb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549076, "uuid": "c0f27abc-da25-4f8f-b3bd-683aee20b3f4", "comment": "Malware payload (Heodo)", "value": "56b129a47bb89c412386e84b4347ba0e6c2f037ca73ef4df5a5b0537d39b5102fd19f39648cdaf15fa73f62c9c273b8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549076, "uuid": "412838f8-d215-4de7-ba2d-c38105c11002", "value": "T126C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549076, "uuid": "91b2a081-52a8-4242-8fc3-0592cf615858", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549076, "uuid": "f2cfd2d0-b369-45f4-af6a-75ba90840810", "value": "12288:iUV7ciwHX3ew9aYU3pkc9inFijaQeL+nZBb:UiMX9Imky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648549076, "uuid": "2ba0fd00-67cd-4e70-afde-e1038af8da69", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648549076, "uuid": "2c6452ce-7f1e-4776-b706-17fc845c0feb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549076, "uuid": "6a538772-7d0f-4e4c-a0cc-faa896b8e3d4", "value": "f70dc8fd7cb7d71ab2c57cbbc0b5f67f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6bad24-af2c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648536458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536458, "uuid": "eae384db-a1f9-4255-a0dd-270bc19b268f", "comment": "Malware payload", "value": "72dd1033cac53169bf999ef52c230d99", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536458, "uuid": "1254833e-8691-4f81-b31f-2c07514fe70b", "comment": "Malware payload", "value": "3cb7612a7e4a9f460ffb2118bfd213075ec9f01bf49aad020aad9cfc00bcb6ac", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536458, "uuid": "7034d75c-7fd1-40f0-86b6-628f24d1cbc5", "comment": "Malware payload", "value": "8b958e78be875f58939fabb54e35c9aa03ef4118", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536458, "uuid": "9c0c9ff6-2c11-477d-84b3-e02390b3e4de", "comment": "Malware payload", "value": "8a1e95e6f56775d1d9b792604735e3542ac08d5ad298aa3079e1ba562b93424c0d9a4560a41bc9ffd1cf94230e8c9084", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536458, "uuid": "6aed4046-598d-4d74-97b6-528f634cbf62", "value": "T1A4A567F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E5651EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536458, "uuid": "118b45f8-c661-45c2-a6b3-e8af0b6b393f", "value": "12288:rEB4nZ2nkYR5UxLEpyI28DpDwHVfsDpEq3EnCpug3e:rKXkYR5UwyI9pg5Y2q38CzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536458, "uuid": "d5c66174-6c13-4a14-832d-b05610cf9f3a", "value": 2137530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536458, "uuid": "11f810d3-7d04-49a5-921d-4b9e1ba95dcc", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536458, "uuid": "1a1e0f31-18de-4aa0-893b-ca151da4d86a", "value": "ADNOC ORDER 02243.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efbf4f5-afae-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648592453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592453, "uuid": "1a4e882d-b17f-4e03-9828-27d96a79c38b", "comment": "Malware payload (SilentBuilder)", "value": "5b15f58c5dafced4214dacc04689585a", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592453, "uuid": "231443d0-3ed5-49eb-8b0f-280826b78509", "comment": "Malware payload (SilentBuilder)", "value": "3e97f09fc53890ba2d5ae2539b5c8df372ed2506ed217d05ff2cf8899d15b8e6", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592453, "uuid": "9dc5ae85-bf78-45ad-93b4-360b000e68ae", "comment": "Malware payload (SilentBuilder)", "value": "85ec91fc0c5045daed43fffb11599aa314197f97", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592453, "uuid": "a31823b9-b4ea-4525-89f2-a56eb973db7e", "comment": "Malware payload (SilentBuilder)", "value": "1684ea40a3abdac4424a3cb4fab18b901ee145b7073ef373b3369e040aae928259b8a2f83003b23a246b5244bd67c012", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592453, "uuid": "c3db0ae2-c195-43f7-92fe-7029fcaf36e1", "value": "T19AB39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592453, "uuid": "aebf0e2b-2945-47dc-a739-c81031c44d0b", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMe:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648592453, "uuid": "5490aa50-09bb-4409-8e5c-1ed4cac0d351", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648592453, "uuid": "a16b4462-e69b-460c-a50b-1be3059e43ac", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592453, "uuid": "67029aef-9e31-4d62-9c1b-0138ae768406", "value": "5b15f58c5dafced4214dacc04689585a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873f6e95-af0a-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648522029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648522029, "uuid": "8a851e5a-0a39-49d6-915c-08f3f8b88a7e", "comment": "Malware payload (RedLineStealer)", "value": "1080b82a1ff4cbec291ae3f211c329cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648522029, "uuid": "9938ec54-6767-4d6d-8450-47b2cc953dcd", "comment": "Malware payload (RedLineStealer)", "value": "3ed09132d1da26eca39b4584e8207eefc332670ff897f2e933a46c0ac98ba926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648522029, "uuid": "979450a3-eade-42d9-abf4-911a46fe6ce5", "comment": "Malware payload (RedLineStealer)", "value": "e663d99c1434cf079854f382ce11254cb33c908e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648522029, "uuid": "3bf29f47-769d-4043-94de-a5bb4ff94d52", "comment": "Malware payload (RedLineStealer)", "value": "5c976faa44a9d2daaa9579a35e097139e14162be9713d2596cda392006064192cc7d5576656b234234e6a40b896fe296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648522029, "uuid": "4964ad2b-b158-4aad-a8dd-241f4ea62744", "value": "T10A25BD8280870D50D8241F74A225A93996AFAFFB3E35E1C69DDAFC7777B31A05170836", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648522029, "uuid": "3854ec30-efe5-4b8a-9a20-351f792ad8fb", "value": "61ffae010ce8fc804af04adc26c6c926", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648522029, "uuid": "40630979-4512-4a24-9257-2ff362b9f5a3", "value": "12288:eJBVqnNu7e4IOlQg4VzpJ6ZnKJMvGUFqhyyNYv8tBch+:eJBkNSBIQQg4VFgZKH71Sv8s+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648522029, "uuid": "2942a8b1-30c7-4e7c-9ed9-11303f219d1e", "value": 981592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648522029, "uuid": "ae78819f-b9ef-47be-b33d-21f909928557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648522029, "uuid": "f76213a0-f72f-424c-9bc0-bbf3f2ec34a8", "value": "1080b82a1ff4cbec291ae3f211c329cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6975d3-af10-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648524425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648524425, "uuid": "fa550169-ce12-49c3-900a-b0fbff6fd25d", "comment": "Malware payload (AveMariaRAT)", "value": "2ef892cc677b7abd1f152ab288373e18", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648524425, "uuid": "c4c50ca0-af9d-42b0-aa65-aa292b56cf52", "comment": "Malware payload (AveMariaRAT)", "value": "3fde1e49973012edb45c7010ab78a81163dc7a1be8833374c8bcaa0ad4694990", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648524425, "uuid": "78bbaa6f-921e-43df-9b82-0692dbc7a202", "comment": "Malware payload (AveMariaRAT)", "value": "82f9e6f385872c592541c07f8c1027d9bb980c8c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648524425, "uuid": "104a22f1-8880-43df-8478-c77c4b681a81", "comment": "Malware payload (AveMariaRAT)", "value": "ce7d45b96fd30f887819a788d98ca51f3c354f66e95cf83e55a150d8203efc04fd766baae6ee99e92982f045922e3648", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648524425, "uuid": "c264116f-bed9-4b08-8420-9711c5801b1e", "value": "T1E225012513D88195EABEA7FEF4B044018B31792B5527E71E95C128EE1EB37C0899F363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648524425, "uuid": "aa8c41a9-20dd-4ebe-9924-5f6d7f5f8555", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648524425, "uuid": "e9248f5c-38bd-4f91-bef5-d7971dcf3b9e", "value": "24576:mNegLxmDTl019notjOuqibxRNwdDIDwzfjL8b9AD76:mNegLxAmr3KTwBFsA/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648524425, "uuid": "469cbf14-4c5f-4712-912f-71f5434fda25", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648524425, "uuid": "e3af8e46-bcfa-45c3-b7a2-98e5f4daca2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648524425, "uuid": "89f19c13-400a-49e7-8cbb-00baab908a9c", "value": "Order329863.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ae2ed3-af5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648556326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556326, "uuid": "50ac85c3-5675-42b9-9cf3-4e207756e918", "comment": "Malware payload (Heodo)", "value": "9fb73cc398a8408b5565858c2a32063c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556326, "uuid": "f6649428-8d81-49d3-9aeb-eab06f4df548", "comment": "Malware payload (Heodo)", "value": "408206fb36ef3ef7e56c8ecbb047c4f2e8ff7a30ee9d57ef593ce4cbd691f622", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556326, "uuid": "6a9bd273-c390-436a-8eba-418b3850445c", "comment": "Malware payload (Heodo)", "value": "83454877227459fade6ffa31191916943ea8edfd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556326, "uuid": "05760ae2-7917-4527-a059-0de23c14109a", "comment": "Malware payload (Heodo)", "value": "64e7b29c7b57dc307eb91dc775990a90b69f381f538ffeddee3611294ddec288b8af9acbe4715372bfcc24f920c947dd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556326, "uuid": "cf759640-8119-4dc9-bc43-11a08d8a81ec", "value": "T19AD45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556326, "uuid": "0d239515-10c0-4512-867b-e0eada5176c0", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556326, "uuid": "76c9aadf-695c-406a-adb9-7cedabe1f760", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzoipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wTooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648556326, "uuid": "e1b22bef-8ffb-4dbe-a985-3ac1fef73a4f", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648556326, "uuid": "f235f084-4450-479e-887f-3f9e8d1e2965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556326, "uuid": "1287b9cf-e95d-4444-a2bf-c79d545ce73d", "value": "emotet_exe_e4_408206fb36ef3ef7e56c8ecbb047c4f2e8ff7a30ee9d57ef593ce4cbd691f622_2022-03-29__121840.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae920ff2-af13-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648525960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525960, "uuid": "3e7c719c-bfcf-4be0-b208-816861330df4", "comment": "Malware payload (Loki)", "value": "0c0aa2acd329cf0601caf536afdd17b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525960, "uuid": "de7429fb-8600-4acf-9836-2e66768b374d", "comment": "Malware payload (Loki)", "value": "415a9c01207b9ddbf3c41b94896e4c2dd719aed955fafdc1be81fa40b7260ea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525960, "uuid": "03f3a9b5-3fe0-449e-93c3-3d53eacfeb83", "comment": "Malware payload (Loki)", "value": "e9d92180a02c94c9009eabb161e8c04741d33f4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525960, "uuid": "110962d8-eb04-472b-a1e2-53411d7491be", "comment": "Malware payload (Loki)", "value": "f9f3cbc947a2c5df2c86832f4f994600f46fae9fef9673564cce66f526e02c98a7a4927386ed91ff67272aa163108108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648525960, "uuid": "55d52be9-acce-459b-adea-c6d23bab290b", "value": "T1113412006BA0D49BC5274F7259FD23BB6BBA56666179A34F0300AF473F2BD81892D364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648525960, "uuid": "2d331793-9614-4e07-aed9-0beebe48d6fa", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648525960, "uuid": "55cdf04b-a501-4f67-80c1-5b02a57b9760", "value": "6144:HNeZm8lhLDggZQ0roQxMjrR5QUTBgb3BKb:HNl8z5WSo0+RyuBg8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648525960, "uuid": "c33c65c7-f644-43c7-9d89-8fd75b220110", "value": 240290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648525960, "uuid": "618efe88-7e38-4086-9f86-7d23db30321d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648525960, "uuid": "b63d0f81-c546-496e-bb52-78272762b1ef", "value": "RFQ-SSAN4262386-00465881-l400881-4277786-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302f630a-af52-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648552807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552807, "uuid": "d3a0722c-6a81-4895-90d8-814417b27f09", "comment": "Malware payload (Stop)", "value": "d4c9cf9abcda239f300e88f05148c3c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552807, "uuid": "fc1fd0cd-deb7-42e4-869a-4f1e4fa90ac3", "comment": "Malware payload (Stop)", "value": "41de03ca89e7bc4f66cf30cc7223eabf25ab4af29d41738afe1fb26b105be66b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552807, "uuid": "4050b96d-08d2-412e-bc37-b67e1d5a0dcc", "comment": "Malware payload (Stop)", "value": "bdc65c48c075fca059afe5e917f3fd1245b8b0b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552807, "uuid": "43c12e07-0184-41c2-ab38-27c0db466d2a", "comment": "Malware payload (Stop)", "value": "0037f0637ffcc38186354f0fa2ce2bbda8d1591b995129371681406cfb9ff4a0c2a36ec8177f6fe5f813e98a4f53bcf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552807, "uuid": "cba84064-a09c-4b9f-8134-9b4ae91c1e5a", "value": "T1A70512613490FD32E75812317872DFB069AEFCE45866560B77842B5EAB333D27A2424F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552807, "uuid": "244edf61-0b35-40c7-abd9-335d2d4a6b11", "value": "8ee4f2cace7854793aad420556d77bc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552807, "uuid": "29950896-359e-41af-99b7-f2e4a72d17cc", "value": "24576:o57Y2dz+lV5Hem1lXwoJxc7l/tfHQTfWFkJuR:w7Y2dzQ7HhjXwr7ptoDWFkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648552807, "uuid": "23f6cd9f-32da-45ff-9b2f-3bf257008247", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648552807, "uuid": "a957c884-44a2-4c30-aaae-998355c36a35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552807, "uuid": "63dfb389-aa91-4ea8-bebf-38eb9d32e24f", "value": "41de03ca89e7bc4f66cf30cc7223eabf25ab4af29d41738afe1fb26b105be66b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4347c5-af31-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1648538573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538573, "uuid": "78d75823-5fd1-4fa0-9d00-a77e6428be7d", "comment": "Malware payload (AZORult)", "value": "905ec243998eb83d984d7c84ba7c4ffe", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538573, "uuid": "bb51abf5-e6b8-4bf1-a695-3bcd9b4f8519", "comment": "Malware payload (AZORult)", "value": "41f44a05f602b8f6693d7c81137ca01bdc934c6f51a51c332377b666afe0fd8e", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538573, "uuid": "8807b5a7-3d94-4b52-8943-fa3fc0234251", "comment": "Malware payload (AZORult)", "value": "463ca0b648888e3df3f02a62b021d32212a19a19", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538573, "uuid": "df5583c8-7a7c-48f5-9008-f1f4a328cd05", "comment": "Malware payload (AZORult)", "value": "4b4398241355e651eed9d83958bba6eac0a780434cf7e419c99be0b8910caa2dcc4e046f021f37c893c375bf1aed791c", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538573, "uuid": "0292e81e-e5ea-4f60-a072-9e526ccc32c7", "value": "T16D51305E705F702962726FB3FC1F54CCE5734743923906813A1AD6CACD7A26CE29082C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538573, "uuid": "e219855e-38b3-4008-b7fd-968c34aa54c6", "value": "48:zQAqPwZaP31mvSN6J+1rSkp0SWVHApITzc0BdoT:zQAiP314J+1rSkpg5LgLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538573, "uuid": "8f5c3c91-730d-4b62-b2db-1a3b82fa09bd", "value": 2733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538573, "uuid": "1e10cd53-dc54-4073-b7fb-7242f048dcce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538573, "uuid": "d7ce61a5-04b7-4fbb-b0c6-1de969dfb59d", "value": "factura impagada 5110.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff89e61e-af5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648557020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557020, "uuid": "0f100c6b-0b42-4728-ac2c-38a34d8dea32", "comment": "Malware payload (SilentBuilder)", "value": "1a9a574ed362f968b90afac9639ab259", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557020, "uuid": "c4e75edf-ae1b-43f6-bc6c-3df5af0b4ac5", "comment": "Malware payload (SilentBuilder)", "value": "42b8d07d6e3aaf1ce7bbef3afc922b750ef0418ce1c1cd5405313ddb65083ae6", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557020, "uuid": "acf6401b-930f-45e6-881d-59342a0c67d5", "comment": "Malware payload (SilentBuilder)", "value": "d64065969d72cf808f945fac4eb83cabff8ec2a3", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557020, "uuid": "c5831c0a-cdf5-42d7-83b2-91cb3dfe18ce", "comment": "Malware payload (SilentBuilder)", "value": "598bd08e8a0799f696a6e2a73badbc8f37bcfd4993fce2bb3d6f9a76a3a62a337724e21bcf4fb60973325c63ec532286", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557020, "uuid": "783bb6c0-259b-4013-a3bc-00ea0a5853fe", "value": "T1F1C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557020, "uuid": "fa0eed58-262d-47ab-87d8-dd160f1f598d", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCM:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648557020, "uuid": "4868eac2-f4e0-46a4-a878-7aaef31a5862", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648557020, "uuid": "67a8ba34-3d20-47a6-9815-e0c5a2a88fcc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557020, "uuid": "d13d76e0-ef56-44e1-8a55-8df232d8cd01", "value": "SCAN9223_00055.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96691989-af4b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648549972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549972, "uuid": "80288250-e3eb-47f6-982a-3b8c59aaa4ee", "comment": "Malware payload (AgentTesla)", "value": "0881248f12d065a0cef257f8ae7849de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549972, "uuid": "53982524-2a62-4346-a947-1f34365e0cef", "comment": "Malware payload (AgentTesla)", "value": "4327aef2ef9bc6d3c531505e56e4514c8b3bc8ee4d361689fb5e902f4af7d965", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549972, "uuid": "8c0f53fd-0e50-478a-95bf-fcb04fcb2187", "comment": "Malware payload (AgentTesla)", "value": "0c07d1634df703a16d0004e73454f4ae1d2a0b9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549972, "uuid": "045db234-1253-465a-a13f-5ff77fde3c33", "comment": "Malware payload (AgentTesla)", "value": "9bbb849367a957b8c2cf814727be7096e984886aedd79b16b21e9bc043a44e34b835797b0885b6a403eb8461acce44b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549972, "uuid": "a09f6318-5a10-44ef-ba2e-28bca5dcdac5", "value": "T1C355BE36F7898C09C6799BFA85BAC7004F75AC4D5813DA8D27C537E90A32FC6660D227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549972, "uuid": "0d9ceef0-9fc2-4efa-b255-42d5bc450cc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549972, "uuid": "b5d0feb9-8a2b-453f-b720-7949ef0c449d", "value": "24576:+3p36DI2Z/WV060itcl+/VJrBz+1Fy88L5f6rhQBtceYE0iAsI:+EDI2Z/WV0mZfBVzLOhGX70Jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648549972, "uuid": "df28d8e7-6720-43a9-acce-00f3a3076eb1", "value": 1323008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648549972, "uuid": "83beb64b-a942-4ac0-bb1e-3bb20efd114f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549972, "uuid": "1be86674-4dc7-45fb-94fc-439cfae7a5d9", "value": "Accounting statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54bddff-af25-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648533676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533676, "uuid": "90465a2b-47ed-4974-a6e3-ed2307728398", "comment": "Malware payload (Formbook)", "value": "3bc65893430e67379b60b66301197ac5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533676, "uuid": "4e3f55c8-1f37-4716-89bd-71b8fee1279c", "comment": "Malware payload (Formbook)", "value": "4339b55c1e2d109c1c1cc31fc71f0d3fdf9c15bd8ff144ebbfa7c5e0b4bdba67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533676, "uuid": "23bda43b-eb0e-48db-8f1f-18cfbdca6ae5", "comment": "Malware payload (Formbook)", "value": "c620800f498eaf5916e644004b79b4fae29fb7f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533676, "uuid": "181aaad1-95b7-47bc-8cbe-faa81e26f412", "comment": "Malware payload (Formbook)", "value": "650cf0450c6721e8488588a45b6c4601358452f8b09a500a741f4d6f222c6929f69a5e2d47dfac9fcfef1ad898fa4e7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533676, "uuid": "0190483e-97e0-442f-bcd5-323019cdf1d1", "value": "T1B0558ED023B896B5E2DDD3B1D439690835BB9C6387649F2E50E5B2FA0CE23479405FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533676, "uuid": "85b959d8-c1fc-44ca-9b73-3af40881c3b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533676, "uuid": "13d76557-31b1-4de9-bfd8-b6b5d8f82b08", "value": "24576:C/aCnuGkkkZemEohdLIOoEJPpaUIh8k8GGAWk2YWCu5G6717O:C5PrkkoDrVp95kRGb6WdGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533676, "uuid": "e6a87b0a-e81d-458d-ba96-712d33a2e15f", "value": 1379840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533676, "uuid": "af11fd16-258d-4590-af56-d3b7a7cb42d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533676, "uuid": "e0f19960-1374-4cd1-a752-e7f79a28833c", "value": "Documento de recibo de DHL, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007918e3-af97-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648582362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582362, "uuid": "6366fa69-4e6f-4089-a6da-4d3fca29e5f9", "comment": "Malware payload (Heodo)", "value": "d46f31bd0c6e8a2727ac4b7cf705eb05", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582362, "uuid": "acf95134-3bd5-4e81-b890-891c6f27f5ed", "comment": "Malware payload (Heodo)", "value": "4437a61632946815a6f2b9137afe26f2c64ca6a524e92bcd185fa185070b59f1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582362, "uuid": "75f7d06b-2dfb-47d2-9ff3-4da73a95fa96", "comment": "Malware payload (Heodo)", "value": "fc6bd827ab1aeb1ef7a98ae87ec9c30809b5a115", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582362, "uuid": "360e8c72-7aa5-4775-bb25-abcf53a7be43", "comment": "Malware payload (Heodo)", "value": "519de6b21ca6c2050c6b5195536cb7b28a5b946d1392c24e7745617e31c3b760eba816a25fe3bbd03e14fe44aa3d0864", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582362, "uuid": "d67054d2-ea79-43e6-a4f9-a0be8c89e1e2", "value": "T194D33BC2A776416AC96A55703D6DA4B6E7A85CBACF384EE793E3DD8D68331C0083114F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582362, "uuid": "10d21fa6-b85b-4ba4-b3b6-643c500b6952", "value": "28570bd8351c62f6e0c8e6211e57a6e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582362, "uuid": "d85788cf-e6d7-4d9c-9408-fe6fd5c78a9f", "value": "3072:fwalRy7iA/KQVYhv359+DnWnbD6zKnUe9hICvXbFy:NlRwMhx9+6ncZe9y+LFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648582362, "uuid": "5c36add4-d15b-446f-8837-7f11e909f8de", "value": 139377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648582362, "uuid": "b5f83bd1-ed25-4f37-9bc9-3c46352852d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582362, "uuid": "c088015f-661f-4ff4-a6bb-2b2fd4dbd408", "value": "443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375280e5-af28-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648534780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534780, "uuid": "317ae1e7-f0bd-4334-aea0-0ab3b0b8bea0", "comment": "Malware payload (RedLineStealer)", "value": "44190ba0aca367c665844c7b35c416cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534780, "uuid": "1b8d1243-0a13-4643-8ba0-28ff47aa34bb", "comment": "Malware payload (RedLineStealer)", "value": "4443be84e1b4ce006bba6ca9d2111168b2f2a7b367293eb5a95b357e971c0970", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534780, "uuid": "b5473d84-2e5e-49c0-9a7c-11376b434a59", "comment": "Malware payload (RedLineStealer)", "value": "d70515f84d25b599611e2e502e1302945d8d8902", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534780, "uuid": "fb44b167-5cc9-46b4-ba52-405407b945be", "comment": "Malware payload (RedLineStealer)", "value": "44aaff1a6be67bf326c70a10ca17659be53f42fdd21355b712f6fe11d406d5d747063f311da50c599ccc2c7d1f867497", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534780, "uuid": "b353e822-c88c-4eae-b507-8c6ada08d8ec", "value": "T1BFC4233FAE782AB5D0960DB271B2CF7A7E453D4A4A64839F379034064DBEF01676A017", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534780, "uuid": "45be17bb-8fb9-47ed-aecb-494d655606af", "value": "83e960948b7700b5fe70a8cbc5fdb2e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534780, "uuid": "78b3735d-147e-48f1-b210-dcd9df129931", "value": "12288:TyFRIHLj3Xjvg2Dx/6NKUHIsW7Vr2HWBQHdAgIM1cCq+xTH:WcHLzTI2F/WK6W74WB8ddI/F+xTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534780, "uuid": "ca886e8b-64b5-49db-bd66-661001fe4051", "value": 589336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534780, "uuid": "e458ab67-becb-426a-8d17-e20df3d27d38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534780, "uuid": "7bf06d92-f7e5-4905-b37a-78d33cd6bc96", "value": "44190ba0aca367c665844c7b35c416cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30157b5-af3a-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1648542718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542718, "uuid": "72ce233b-9caf-479e-9b19-18762522d908", "comment": "Malware payload (DCRat)", "value": "0d19dfa408f155c7ade427e2043de24b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542718, "uuid": "35f4640b-eb76-4f2c-870c-10774f22c56f", "comment": "Malware payload (DCRat)", "value": "444e7c8dd5956905bac2e3ece402db4d722ba63acf21553c5da54d6b3e02b466", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542718, "uuid": "a72fbc8e-580e-4328-a2bb-1709474534d7", "comment": "Malware payload (DCRat)", "value": "12d59a5905f2364b6d5c6840a901a49eafc124b3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542718, "uuid": "b975784f-9c72-403b-a9fb-1315385919b2", "comment": "Malware payload (DCRat)", "value": "c52599c88bd588d3b50d730d89568e405e582366ccb7003365c2e31376a92ea31a57e22e1d273d1fe056d0445c85e3ee", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542718, "uuid": "c06b6c05-770b-42e7-94cc-b1785b063d8f", "value": "T10A559D127A45CD27C0661B33DADF801847A9BD02AA27DB1E7E9A375E16013B79D0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542718, "uuid": "46cadb71-5e04-415c-8f0f-56aecc7264b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542718, "uuid": "3df1e732-ebdf-44a7-a6bd-65ba1016b8c2", "value": "24576:vHQxd1DXodUpZ5NHrmmN62X7s2s16qSXQjE2US0vqvg1T/ByO/yF50:oxYUPPrdLsjRSXQjEnqGNrY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648542718, "uuid": "78ce60da-6719-4fcd-a8c9-5c4200c436e3", "value": 1372672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648542718, "uuid": "fa8c875a-d121-4151-91c6-7d2b2f8d97c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542718, "uuid": "f2c7af9a-6471-4d04-84bc-300387e39cb6", "value": "0d19dfa408f155c7ade427e2043de24b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf63798-af65-11ec-8e58-42010a9c0032", "comment": "Malware payload (nccTrojan)", "timestamp": 1648561307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561307, "uuid": "5181e99a-a9a8-4cb4-ad99-3701c90b9b34", "comment": "Malware payload (nccTrojan)", "value": "94af1b400fdbdebd8eda337474c07479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ncctrojan", "colour": "#CB0EDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561307, "uuid": "0f161316-84a4-445c-be31-af32e497cbf6", "comment": "Malware payload (nccTrojan)", "value": "451e5a4c4849ed948431accc30e1664ee13b8edb132a7fa15d8a6826cfd290ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ncctrojan", "colour": "#CB0EDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561307, "uuid": "8cdba2b5-4a19-428d-a824-b911831683fb", "comment": "Malware payload (nccTrojan)", "value": "5486e35a93a9fd0c19b14f8dd7d684e826120883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ncctrojan", "colour": "#CB0EDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561307, "uuid": "0649b2ea-c4b4-4460-b56c-ec90a3384253", "comment": "Malware payload (nccTrojan)", "value": "8ffc301b6847ef5b0f982485caa8c2163b8156f5ac8f27001866710c990396186300fd1ad3daca4af60881f97ceb4531", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ncctrojan", "colour": "#CB0EDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561307, "uuid": "afc277bc-ee9d-4826-a1a6-eb4cf1256291", "value": "T1C4D38D1278C0C4B2D17619310979EBB06E7DF8311F746AD76398173AAF201E0AE35EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561307, "uuid": "799cf74e-8e1f-4270-b083-c63d6c42cc91", "value": "3b418ab87e14a908f53c717df0779377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561307, "uuid": "0e24360f-772c-44b1-9ce6-4b8d171f1bba", "value": "3072:Vs8m7j33ccjwXv1hA1xrnWVjKe9Exa10dcyadZ5N:VSjwNWxqRKDjCdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561307, "uuid": "da0efa97-0f74-4d6f-b0b3-75dc004662f1", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561307, "uuid": "6361eca7-bd1d-4d7e-a0df-f83701802522", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561307, "uuid": "51f3d32a-7cc1-4471-a40a-e23ed56c6d52", "value": "94af1b400fdbdebd8eda337474c07479.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8432fc1c-af2f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648537915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537915, "uuid": "708c4f83-ee2c-49bf-b3e7-0248e1a1efd4", "comment": "Malware payload (AveMariaRAT)", "value": "56633eb5600431eec3fcd19fc8d4b724", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537915, "uuid": "27fe17ea-ebc6-4cc6-bc18-655b58c58845", "comment": "Malware payload (AveMariaRAT)", "value": "456911beeb696ff1f3ba54d2d6166bb99a8b9ccae4b1eb4319235376eb18a3dd", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537915, "uuid": "efe33857-a314-4b6f-8bbe-89bb480f31da", "comment": "Malware payload (AveMariaRAT)", "value": "399f7a519f3adcb4dd8bcedf52e19addc2e954b9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537915, "uuid": "262ca898-643f-46d2-910b-4a9ca2c9f11c", "comment": "Malware payload (AveMariaRAT)", "value": "a0c53b20a666c1524e4d91ec12e81a507c2dbdc3c682f2854921bdeb6a795d4dc39a09298ce1b58ee3323aa9708a3ca8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537915, "uuid": "8f1dcd73-81c9-4440-a7b3-bc0fd392a1f2", "value": "T15B156BEEB8450096FF1B1A33DC612460A29F15D9D5CE8E5E3CC66ACA24677813B37F18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537915, "uuid": "8177407d-3996-4a42-8115-bdbe2505f5b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537915, "uuid": "26bf929a-18ea-489e-8382-21461a7f6185", "value": "12288:DgMlEguvMW5pkEx3fPw3I0TEciO3o9KWjmoNWlWgB9lyAKp:ktvWwvYzvRY9KWjmCmlWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537915, "uuid": "7e69bf59-1a44-4745-a51f-34b102855368", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537915, "uuid": "c51cb8ab-aee9-4cee-9889-6fe9bee8c190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537915, "uuid": "7e9b56b4-ac71-4b5b-8a05-db5f3b9a1ce5", "value": "DHL Receipt Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c54d15a-af42-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648545875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648545875, "uuid": "2f2377a9-d8c5-445d-8d1f-0bdcd3380bc7", "comment": "Malware payload", "value": "42eebad134186872be5a285d38c1fc22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648545875, "uuid": "53515faf-f759-4f12-b5b0-06d229241dfa", "comment": "Malware payload", "value": "459f575fc0749f2fa3ca0d49a17ff50339b97d9762782a0fead692389fe4869d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648545875, "uuid": "01228676-dff0-411c-a110-1cca27c710b2", "comment": "Malware payload", "value": "562cac13692b78f46eade73f7df8d3546b0ad879", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648545875, "uuid": "741830f1-d564-4a85-84cc-5246d3855b51", "comment": "Malware payload", "value": "ce0064e950c59345d42969a31fcc90fe016ca4dfdca616b3e3297c6acfc5f884539be6ff4fbccb802811cb02d414b18d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648545875, "uuid": "7e380afd-bab5-44a7-9f88-b20c51ddf5e8", "value": "T1CD84F164BBE8D15BC0724730BEB6E875A677BE102D14AA2B3240775FB434253DA77322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648545875, "uuid": "87d5b9ea-8f0f-4eb0-ac4e-f6726e05ab15", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648545875, "uuid": "5306c15b-25e3-47a0-a08b-4900245a484c", "value": "6144:XYa69WY0Zl/oow9HfWsVefcaPcoL+Bxz+BzGXOEJwr6zn663X:XYSYglK9+snOzL0xzJXFmInZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648545875, "uuid": "2321e8f9-e02d-47a6-bb15-4d1b7ec7ab8c", "value": 389080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648545875, "uuid": "fde4c224-b8a3-43b5-b0e9-c610b11d7b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648545875, "uuid": "a59f6feb-2e53-43fc-a71f-4db329fd284a", "value": "ESTADO DE CUENTA.pdf.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0adfd1-af37-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648541309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "4e4360af-6c31-492a-8c76-071b483ce577", "comment": "Malware payload (Heodo)", "value": "8b28f15893d623a6a5da802c466fd973", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "6409429b-2c18-46f7-906f-40181d891754", "comment": "Malware payload (Heodo)", "value": "45b403bad8897e855df2a689a5fcd4a9f6b902ee36ec2b0454b45d91253a879f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "8f47c99f-8bfd-469f-8443-423363a7e07d", "comment": "Malware payload (Heodo)", "value": "fad242c296731f93ff564c43cf0687f93b7ddf1c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "b1ae006e-23df-4d33-a019-8edc7d12b80e", "comment": "Malware payload (Heodo)", "value": "832fceedef2e20cfc302cffdc297ec1bdcb94d79ab566231bce9d7c29fd970474ea332785f7b4da50b2293f1e4c7b149", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "9c8d5d65-d638-4459-8fd2-fc5896d9b61f", "value": "T166C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "0e266f16-4011-49b4-a132-7210d5eb7148", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "16ce0640-0816-4ad9-add3-f6013200174c", "value": "12288:iUV7ciwHX3ew9aYU3pCc9inFijaQeL+nZBb:UiMX9IIky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648541309, "uuid": "8cf18a1e-01f7-4e96-9596-fb89bb5cf831", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648541309, "uuid": "ad888e14-8ff3-4fcd-91d1-eefde3f0bca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "744d2fe1-a683-45ce-8b63-2cbcbf21cca0", "value": "emotet_exe_e4_45b403bad8897e855df2a689a5fcd4a9f6b902ee36ec2b0454b45d91253a879f_2022-03-29__080822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f491b9-afb5-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648595551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595551, "uuid": "7d0bae0b-f8f9-42aa-a365-98bc8b855f4c", "comment": "Malware payload (SilentBuilder)", "value": "1fc5bddcde132c877a71dd839bd92d24", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595551, "uuid": "7ddc4a94-80f4-478c-9e12-1471ed087b8c", "comment": "Malware payload (SilentBuilder)", "value": "45f6bf56cf57a244bf50afd9a1b14c2e630c4c42dc893f000f424ea8ec341c3e", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595551, "uuid": "523daadd-12b4-4ce3-91d2-9727434bb844", "comment": "Malware payload (SilentBuilder)", "value": "a38154d4ece619ad6dc0ba10d4c0062103a7184b", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595551, "uuid": "2dc094f2-2ac8-47ec-927d-eb4ec0578187", "comment": "Malware payload (SilentBuilder)", "value": "b48d3b1ef906fa9b4650fb0d3544c2761002eb1a0a18ef4278822af7c434f416506ffb6c3072f06a65f2663484423f0b", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648595551, "uuid": "64331a3a-d490-4c26-896b-d21c9c39102e", "value": "T10AB39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648595551, "uuid": "3f3aa50e-440f-4e4a-aba6-4960e43d69eb", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMC:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648595551, "uuid": "e5dc77b9-b720-4b54-aacd-8811a5308f13", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648595551, "uuid": "a6452ba2-e36d-49f9-ad16-4e334f11f217", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648595551, "uuid": "8ca18de6-3877-4dcc-8717-04468717d8d6", "value": "1fc5bddcde132c877a71dd839bd92d24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092a99d4-af39-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648542004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542004, "uuid": "b53cd1fb-0ef0-4c84-a8d6-8bd2f61aac5b", "comment": "Malware payload (NanoCore)", "value": "7c3dadcb6ca2a74c38f8740a58bcb123", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542004, "uuid": "c1b746ff-56d6-47e3-9bd7-d0c16fc75b86", "comment": "Malware payload (NanoCore)", "value": "4617aa97b1b815d8a6f1ce8e7ff775bac357910e012878afd1aa03b276a55552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542004, "uuid": "f3b232a7-d1c4-4530-953f-b266aa2fad9d", "comment": "Malware payload (NanoCore)", "value": "3b319139559d0525ccd22ceba85375aaa92e31df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542004, "uuid": "d4687347-0b35-4f7e-bcb6-12a83e2b40b9", "comment": "Malware payload (NanoCore)", "value": "b2c63688054349c1a049781300b9dfa421911fdacd275369d8928c0977c4e76129a8496953f18dd887df435151928718", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542004, "uuid": "eb1305c8-5865-48fc-882d-e7f334c3b2fd", "value": "T12435121813F89650EEBE67FEA4B444404F747A2B1616E70DCAC928EE1E733C19A5B743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542004, "uuid": "2f57e634-c326-4c83-9d5f-63977f99870c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542004, "uuid": "833c9472-e74f-4143-b207-22ad8b51b54f", "value": "24576:RMehq2wCtrSYt1mJpqyW4sLG7XiIKkdGbby0EEbiV:RMehqsrSYc7W4scX5GbbnTbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648542004, "uuid": "cefdcbe4-4749-4711-8a6c-100096837a56", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648542004, "uuid": "1db9fcea-cb60-4968-b814-0620f0416663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542004, "uuid": "de6487e4-b70a-487e-bc9b-7fc4e7b4d5df", "value": "URGENT REQUEST FOR QUOTE_____Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79cafce-af57-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648555235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555235, "uuid": "5a023e16-8c40-4b37-b33b-4b261c6f8a28", "comment": "Malware payload (Heodo)", "value": "24695d272bbad32be08c64a15eec5090", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555235, "uuid": "7c29cb29-23fa-4453-a4e3-a5e0a710ca80", "comment": "Malware payload (Heodo)", "value": "46372eb79af340b5666bf1e57195ff5af4966c97a2942e094c92cb20b7c399e0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555235, "uuid": "e60637e3-b57a-46fd-9111-32dd748d6205", "comment": "Malware payload (Heodo)", "value": "58d1a5db3dd8258ae54124b3201ab85f138fad75", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555235, "uuid": "f1caacc4-9cb8-41a7-afef-103196e30cda", "comment": "Malware payload (Heodo)", "value": "dc5657305418853d113ee7e6c4cd103b2ad444affbe4c9607ecc4cac78ec3c3aede582f860a3343487d944fbebb98959", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555235, "uuid": "276c4219-7b49-44c2-899c-357450ca7085", "value": "T114C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555235, "uuid": "3d2ed62a-9b50-40e6-b9ea-b5f6d90b6d9c", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555235, "uuid": "fa060565-2d34-4156-9ef1-a268bbf69ec7", "value": "12288:iUV7ciwHX3ew9aYU3pRc9inFijaQeL+nZBb:UiMX9IDky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648555235, "uuid": "3809786c-dff3-4720-933a-356738efa660", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648555235, "uuid": "d15cffe9-7827-4fb0-840f-1f0503b1d359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555235, "uuid": "82e7b919-fb00-4f3e-b39f-578a8c682f77", "value": "vPKmIlr9s1S6ItDe1XgRkDwazKSSZee3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f6f81d-af38-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648541814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541814, "uuid": "0021ffa2-5fba-44c7-a152-399794507c48", "comment": "Malware payload (SilentBuilder)", "value": "ae5d6665fcd3b4139a949c72f4508de0", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541814, "uuid": "f0f5abeb-b507-48e5-811a-dee1efb4d96a", "comment": "Malware payload (SilentBuilder)", "value": "4680077399b55501434a4d2de9af3b92bdc74cda0c48330e18d41c62b254cc76", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541814, "uuid": "20911642-498e-40ae-b151-15b9944b9c61", "comment": "Malware payload (SilentBuilder)", "value": "ed14fa142732921052bddc085ad87d0d1c7bddd9", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541814, "uuid": "08fef85a-6576-44d1-a5f7-7c83f98e720e", "comment": "Malware payload (SilentBuilder)", "value": "93ccd7bdffc5d3ebf2b5bfcd88501d227e047e50e30b0770a5999436402fcb8a34a130f64880bb506105bdfc1b84abf0", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541814, "uuid": "10e42b34-4f21-4df9-b15a-330f0df0c9fb", "value": "T1B9C3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541814, "uuid": "42cdf0a2-b742-430f-8352-0f7546c9c617", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCR:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648541814, "uuid": "1ff1ebe1-9286-4447-b6f4-55c516fb2998", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648541814, "uuid": "57b97f4e-8f66-4b2d-9d16-475b54982f9a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541814, "uuid": "8124d1a9-e106-4259-b073-f181c111d399", "value": "SecuriteInfo.com.Exploit.Siggen3.30291.4048.21801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08126eaa-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529117, "uuid": "a502d0e9-b5b1-4ec2-b6a7-129a263ecb00", "comment": "Malware payload (Stop)", "value": "42e96ad85b7da89b0ad5f028a62ca261", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529117, "uuid": "2c7d23f7-6362-453e-8190-0ae80c201c7c", "comment": "Malware payload (Stop)", "value": "46d9afd6bded40cce91aedeb42a534cb65852667b6176eb924b8bc80094ca956", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529117, "uuid": "c0d8ebde-0b39-4069-9b3f-5c4c84543671", "comment": "Malware payload (Stop)", "value": "e6b2f1d8cdac2029d96bf4dca3c9a9876c062f85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529117, "uuid": "7814ac05-e5fa-4526-b267-c4f15d75d3e0", "comment": "Malware payload (Stop)", "value": "537579af8b8018e37a58aeefdfd047864d8cc1a46969e3dc9a7b628e39b166c72c5f31592fa94bbda622bb5be4c939b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529117, "uuid": "9afa29bd-dd3b-4dab-8126-2c5901104311", "value": "T104050210B790D034F1B726F589B98368753ABDE1AB3491C762D56EEA5A347E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529117, "uuid": "965a8f16-438a-4d92-afd0-2ea070f39df7", "value": "9dc95cd500d9b0e61eeb42c26e483caf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529117, "uuid": "6bd56665-4b99-49cd-816a-632e4616dce5", "value": "12288:nLM4n5RuWcW9A5mzSO1MFstXpnDLHvPEQCRxiBicp/PNwPOhQHQOmdKbWdoCAI11:LZRb9ByFoZ30QCRwBpHhVOmcbWdoztW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529117, "uuid": "f52e542b-c3c6-4b5d-b95a-4169b8b013b8", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529117, "uuid": "5350615a-4409-41e0-90fe-c12722044f10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529117, "uuid": "fed2f3a2-27f4-43f8-9e44-cfc3cac5ff3b", "value": "46d9afd6bded40cce91aedeb42a534cb65852667b6176eb924b8bc80094ca956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cc94b1-af96-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648582055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582055, "uuid": "b62b058b-17fd-48fc-975d-309b18e20cb5", "comment": "Malware payload", "value": "1ecf30e45e5f019a0e282cba79a0048b", "object_relation": "md5", "Tag": [ { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582055, "uuid": "227e4780-a654-4e4c-ba93-0e99a99cc399", "comment": "Malware payload", "value": "46e930b3da10be43df27d6640a4be567819f6de33f8c1d97d503e7caa548105b", "object_relation": "sha256", "Tag": [ { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582055, "uuid": "24aa1465-ddf5-4e0c-a582-46ba7a0dec0f", "comment": "Malware payload", "value": "c5ede6eeaabc2e3c80d5a639e663b05188f46a2d", "object_relation": "sha1", "Tag": [ { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582055, "uuid": "ff6c52f7-df99-4cf2-9f56-2e729e1d9109", "comment": "Malware payload", "value": "b2d4ca3a40e9126422edf4f517513e30dedf03fd0788f1d95385ab3ef2e5493976e545d2d799fc06bb558eee45e6ab70", "object_relation": "sha3-384", "Tag": [ { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582055, "uuid": "f11e132f-2e4c-44d4-80ce-1a51d095bfa1", "value": "T122A2BC7EB69B8E4CEA07C795041ABBA5166DF91C63C480C1B7BCE7347D1C94B8B21638", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582055, "uuid": "3a91e2a8-9fd9-4520-8a3a-d5e9f4ec8325", "value": "384:KYeJo8pjPBdGaV796Fk3nZJdFUgICfAmJzma699AOP5g:FzgpdBn3ZJdFBICfAm1ma699NP5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648582055, "uuid": "0d015410-2493-4d9a-857a-99959dc7077d", "value": 22524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648582055, "uuid": "f009704f-7945-4a3e-b8a0-32535ad4b8a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582055, "uuid": "952be702-d22b-4a7f-adc0-98dbc1419034", "value": "abc.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb140364-af56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648554865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554865, "uuid": "4a7dea4d-2e6b-417a-95b3-7b98d9cc2e18", "comment": "Malware payload (SilentBuilder)", "value": "246a11787933a0a547c3bf9c8b57749b", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554865, "uuid": "70667ccd-ba8a-48be-8dfb-51d443a02c3d", "comment": "Malware payload (SilentBuilder)", "value": "46fe67faed266100f875c3bff55f0cfaf74b028489a4cd311d36d12c105fa38c", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554865, "uuid": "993eebe5-d05c-42b3-9815-73dc4f646837", "comment": "Malware payload (SilentBuilder)", "value": "963ed843efead7f4ea7393eba3543bfe72c039f8", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554865, "uuid": "63b3da0f-73fb-4bc7-a949-1f95598c35a8", "comment": "Malware payload (SilentBuilder)", "value": "ba741f8bab22fa70db6fa31935c03051864e1a929071d19fd1420990f1f18afe31e6b4b38bd4b64b36f88c9c41fe3ee7", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554865, "uuid": "b32c4c24-fc87-476c-998f-0c62d6b24494", "value": "T140C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554865, "uuid": "6572b278-3998-46dd-a7ea-0a3308072b9a", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554865, "uuid": "0f850b4f-75e3-4818-bbf4-2c39c105cc12", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554865, "uuid": "44be6e5e-f603-407f-82c5-125978f5b82d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554865, "uuid": "db8f0025-d2f6-4a36-bb42-b0577f86861b", "value": "iMedPub LTD_2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03579399-af69-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648562610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562610, "uuid": "81a85b2d-5b6f-41e3-aced-a8450174385d", "comment": "Malware payload (Heodo)", "value": "9529a8664b919b293a62bbb239498b24", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562610, "uuid": "a2cd7737-e174-4c7f-9951-427750860617", "comment": "Malware payload (Heodo)", "value": "47375e5a6088eeef4ea4a4b6de993971c524ac15550749490220f005f26546bf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562610, "uuid": "3bc65b50-ee87-435c-b4cf-3e8c7f5cb310", "comment": "Malware payload (Heodo)", "value": "550fc58f526c52a048c06b70605bcd3174ddbe53", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562610, "uuid": "e51d4468-5250-4d92-96f2-acfe609daa6a", "comment": "Malware payload (Heodo)", "value": "59e824ad4a122a73f981c067f0ad996a12d562a6624c35901648d73c7b02c1a682603e300ce2f9a285e01572d43ce94f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562610, "uuid": "724f9b63-294e-4387-810c-723cf21e25e8", "value": "T126B47B217691C836FC9A0F313583866D1FF5BF649AE48257EFD43A0DAB735018A252C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562610, "uuid": "7dca1c01-4c6f-4504-82a9-8c1fd9b2f3ee", "value": "196752bd65f33bc6f5dd0426f39259ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562610, "uuid": "a7515962-f82e-4fd0-8306-76affc7fbdd4", "value": "12288:bGptged525pthqnhB+RUKyTpoOvHuf27x:Ch525DhqnhympvOf27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562610, "uuid": "c4217efc-fe24-40b0-8657-2c9328c3b717", "value": 496125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562610, "uuid": "86107203-46eb-4861-89aa-fe9c7edfe067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562610, "uuid": "b02daa5c-ada6-4b3a-be15-76610d5eb024", "value": "emotet_exe_e5_47375e5a6088eeef4ea4a4b6de993971c524ac15550749490220f005f26546bf_2022-03-29__140325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71ce19f-af56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648554858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554858, "uuid": "6e476b05-cd55-41d8-aa65-a47a6fb5b81b", "comment": "Malware payload (SilentBuilder)", "value": "6b31207b65ef54c6237606a7cdb5cb69", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554858, "uuid": "764e6e9f-122e-481a-973d-e5a98cf61ecd", "comment": "Malware payload (SilentBuilder)", "value": "47bfa1b42db01c2231bd28201ead8b8b442d7bc8d279381adfe622c383e1a276", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554858, "uuid": "c5fb234c-00a0-40fb-9bf5-07ecd39c08f4", "comment": "Malware payload (SilentBuilder)", "value": "a62b55265b3b3e7a415f9c628c446664da503555", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554858, "uuid": "b18c33a1-9bb5-49c8-bf1b-11a883d2c433", "comment": "Malware payload (SilentBuilder)", "value": "e0d5cb44a87f36a10a9946ebf09b20c3c353cc2569011ad996bb5c2ee43374237e862842ef0f7bb4c234b78854d13ebf", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554858, "uuid": "c1056d4c-597a-426e-8a38-3782b1d56d0b", "value": "T12EC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554858, "uuid": "ad9eddcd-7485-40fb-8995-caf54316dbba", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCI:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554858, "uuid": "c0ba95cf-0b3e-4bb7-843e-c3e0b82ee46a", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554858, "uuid": "de6a1475-f6e5-4ae9-bc1c-e8f20693a200", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554858, "uuid": "10931273-9a25-46c8-93c0-fc64ef363055", "value": "Details to update_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b8c39c-af27-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648534447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534447, "uuid": "b2847e6a-9a5b-4e24-8077-149b1b45a7e7", "comment": "Malware payload (AgentTesla)", "value": "33f406c1287dc23b7146646be5ec6b62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534447, "uuid": "90eacdda-e5e7-48f5-ad46-2dbc6e796c09", "comment": "Malware payload (AgentTesla)", "value": "49526812402e3af2e4e3326e080b892f491a9ebf960939e97d750ca1c4d962ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534447, "uuid": "3f2dbac5-ab7f-41a5-bb73-8f8b8dc482d4", "comment": "Malware payload (AgentTesla)", "value": "b26dc691b187bc2a9e19121ed6c0a48a08324c37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534447, "uuid": "53eec545-98ef-43cc-a1d6-1ad5fbafcb8a", "comment": "Malware payload (AgentTesla)", "value": "d1c5520ce6ac2f087f74266b4f4b8c72292e8d207b99bf03b3686c3afd2bcbf930ad8cdb781d7871091827718fcfd806", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534447, "uuid": "ee4fa2c4-cfe1-4acc-8b35-4824953095e8", "value": "T10D5423E1198E0EA3002540D7F713B277CB8128398A7990773435A4D6557C7BBEADECAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534447, "uuid": "2c1ea19a-8c70-463b-811e-e8760bc0f05a", "value": "6144:x0YQtIC8ZYz7psSz6qo2TD9zM+bEbtyk4tViOlfMhr:DmHnpAOD9zOZYVihhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534447, "uuid": "456a7621-0e51-4e0b-a6d6-9438ccaaa495", "value": 303200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534447, "uuid": "c0f3458c-f06b-4a01-97fd-726456d68b33", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534447, "uuid": "f20dc942-c532-42f4-bf55-be37ae55e301", "value": "2222093748098765434567898.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33127107-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648536061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536061, "uuid": "7b3396c4-1f2a-459a-a60e-fe88e2e475b6", "comment": "Malware payload (SnakeKeylogger)", "value": "44a1ac8fd06283098665510e368d8506", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536061, "uuid": "cfdfc3d1-2503-4765-9b3e-2c1f1d9dd995", "comment": "Malware payload (SnakeKeylogger)", "value": "49891e3580a13926e92ef8c033faca0d1c404cad4755873c39fd7d887c3b1e78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536061, "uuid": "f0f04889-62d8-47c9-b055-bc79652271c7", "comment": "Malware payload (SnakeKeylogger)", "value": "1876c64fc4abd6e7899f001a25d5dc6d0d247331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536061, "uuid": "3446a657-080b-4b1c-8d6a-9f8dc6e150b8", "comment": "Malware payload (SnakeKeylogger)", "value": "41c0377967c4877101d88576bea3d6200dac9bafea727e613be431edb062f671e0a44abe598623b038c5dfb04579adcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536061, "uuid": "87c3586c-0f8c-4820-9acd-bc36771b1ed6", "value": "T13C556B99365071DEC867C972CDA81CECAA207C665F1FC2076053329E9A3DA97CF146B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536061, "uuid": "7ee25455-ba17-46cb-a2a7-754fd60f8cec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536061, "uuid": "51cbdf27-cf9e-4960-86a7-6157355b75a8", "value": "24576:r1R5p2cKmJXXaa5IzZNKJ/Sf14mbcYqlWZ08nxTzzdyJNGR/WwbdO9IC:1pDKaXFalwdSf1nRqQ1RXMDGR/hA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536061, "uuid": "e89d76b3-ab24-4b7a-a232-ec8140a57f07", "value": 1359872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536061, "uuid": "584ac045-36d0-4a8a-8b35-ab4f0cd4d872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536061, "uuid": "58621345-7544-4808-8ebc-206dbf159792", "value": "Purchase order of PO CTL-BEC21-004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1ef3ea-af6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648563806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563806, "uuid": "d9a13015-7573-420a-b303-aea959e27a44", "comment": "Malware payload (Quakbot)", "value": "e11d8072bcd027ac94b972b34876ddd0", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563806, "uuid": "3c86b7e9-e1ac-4a15-9cfa-d4e5230724c6", "comment": "Malware payload (Quakbot)", "value": "499f869b93aa412fa94d8a58eb5e72f1041bd41166bd33c5890daab3bbe6b4b0", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563806, "uuid": "c76458b9-a047-4c2d-91b8-54991f4c6140", "comment": "Malware payload (Quakbot)", "value": "ec9820bc166de546d8ffc7a4037157667ada8eeb", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563806, "uuid": "0b846825-1112-480f-b3ea-930c9460d34c", "comment": "Malware payload (Quakbot)", "value": "845c6764cec971f515c6a67905e6f671ff555cf00ac85fd85670222b9d0eb9ca0e9407218579ade34ba1d6916079fc34", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563806, "uuid": "78de2ad9-9457-4676-9297-2be4651b1adb", "value": "T100451267D6D2B052C9E4823C43052883691799D650A8FE9848F1FAE72FFF1AE1C5C1BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563806, "uuid": "5a17132e-40d1-4689-888f-02fc6071a8f0", "value": "24576:OdM3J1a4NL1SkQDjTC2JCQDjTC2JsQDjTC2JqQDjTC2JzQDjTC2J9:yM5Z+kQDhoQDh2QDhAQDhFQDhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648563806, "uuid": "edf8139f-2192-407f-946b-05cea0cbe561", "value": 1218913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648563806, "uuid": "8743ef3f-dcf8-4023-a5fd-45d92800b4eb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563806, "uuid": "87acbbb9-99b2-49f1-9ad6-b86ae5ce10cd", "value": "cicasuamlsoul.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d20bc71-af2e-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1648537420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537420, "uuid": "cbe41a30-3ff7-4341-afe1-c33e63e7dfcb", "comment": "Malware payload (NetWire)", "value": "e725b62921196767457563145dfdfdf0", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537420, "uuid": "6e818a78-3dce-4ab1-9bf2-f0a3162a1e50", "comment": "Malware payload (NetWire)", "value": "49db2b639effbbdc56404629cc07420b0284bd115659d8d9ea36b35ea7cbfc72", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537420, "uuid": "810eb133-34df-41a0-8c99-a123fad3cb45", "comment": "Malware payload (NetWire)", "value": "952007e1e59210a57068b3c353953a4d3a1b8e4b", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537420, "uuid": "76a54ebb-24fa-47bf-8e26-c08891ca3965", "comment": "Malware payload (NetWire)", "value": "9f748b8bc69429a5d4ffc01abc424bd6ec80fc41528a6a5c99c8f6d8277e9915ed6c955afd7ad0c2dc688a66d3f48dd9", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537420, "uuid": "1497e575-c169-4b93-8964-5e556a1858c7", "value": "T19A4171EE3047A825271B08F2D81B5C5F8D662223C2794880B308EFC85E7855FE26296D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537420, "uuid": "b301adf1-c16f-4331-b4f7-1be87c37e928", "value": "48:sLotgvGwFCXdGqrnD+Ae8deEUjR4ZJlZTmMAc6I:1GZsrnDfjejqZJ/mRnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537420, "uuid": "209e4162-6572-4367-8215-4605d31a9c4a", "value": 2152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537420, "uuid": "f7fcb9d8-d475-4af4-8adb-cd2f5d55e525", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537420, "uuid": "bfea2637-48cf-486b-ae35-0ac595f430a0", "value": "IMG_WA2803396-Sales Contract.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9cba7a-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648536879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536879, "uuid": "55e604be-9800-47bf-85d4-0f11acf2e37a", "comment": "Malware payload (Loki)", "value": "0a06feab992c58d04c9d3f2c298b0f32", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536879, "uuid": "828ecd72-df6e-4a46-accb-87796f92bba4", "comment": "Malware payload (Loki)", "value": "4a31afcf9f0c33b81da601d9819d128cf2cf48d3dc809c102a1f1b36321d5b8f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536879, "uuid": "5c5c30ea-819b-46bc-a36c-b58cd21054a5", "comment": "Malware payload (Loki)", "value": "896f4ca5e711f2691a566f62dcae68a07539eb87", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536879, "uuid": "858f302a-50b4-4ba8-b264-d262faba2eb7", "comment": "Malware payload (Loki)", "value": "0c985d878aee74a67c5511fecc2951ea6dfd4b1298e3b873485054f03d3fb4a6ed157fe041666d9717a61b843ea520da", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536879, "uuid": "a75a3c5a-f9f8-4f86-9a16-84bb1c842619", "value": "T11B14020AE76867BDCCA9633629F9039DF9FFDC4390168AC140163B5F2A7D4056123E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536879, "uuid": "7577b54d-0fc7-47ce-adef-b5394c310a8d", "value": "3072:7vULAtn4Jv5yYje4eMO6igBEzRhNoVw7dNCT2yssfwATOZpj2d8NUJFIwJU1E/Sz:LttGxy/4ZBEznNOw7d8C2TObzNxaU1Eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536879, "uuid": "23bb28e6-5d7f-4f59-89c3-2799f0682aa9", "value": 193624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536879, "uuid": "1535ba79-110f-4abc-a76d-56d2926c598b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536879, "uuid": "0d61c7d6-5968-49e7-9a5a-f3047f3d9117", "value": "Payment advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f91fc9-af9b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648584230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648584230, "uuid": "84906ae3-0ab3-41d4-9bf9-3f8fa50ee0e8", "comment": "Malware payload (SilentBuilder)", "value": "681b8c459cf468b843ef6c8543aa2f82", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648584230, "uuid": "b22854b7-8d4c-48d1-b0dc-3b7b91e5cb42", "comment": "Malware payload (SilentBuilder)", "value": "4aadcc867edfd31c7b38808b0cbf59f97bece320ccc624c24e4bb3a4c9dff7ca", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648584230, "uuid": "9b266987-1410-4b4b-a2ae-a3795756b7b5", "comment": "Malware payload (SilentBuilder)", "value": "54cd6e0b660083f72ab91c5a8cd08a28d53502fd", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648584230, "uuid": "a63e0de3-5b12-4326-a779-4bf1e3b733f8", "comment": "Malware payload (SilentBuilder)", "value": "dadf82f2472a1a47f655adcc6b87cf058adc9dc5a9967c86f7c755cc231f42ad1df7e32c688137c3840071df8a187fd9", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648584230, "uuid": "b812b383-47c1-495b-b244-838e1c0585d1", "value": "T11EB39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648584230, "uuid": "1684f4c4-3206-4b72-b09b-b22e1fbb00c8", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMT:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648584230, "uuid": "5a65b0e9-6e84-426a-9c24-b61092b2988d", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648584230, "uuid": "1f9b16f7-994d-4bde-bbb7-ded7b3987100", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648584230, "uuid": "0f88564b-57d9-4dce-86c0-2b1e91cceef4", "value": "681b8c459cf468b843ef6c8543aa2f82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029e328a-af7b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648570340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570340, "uuid": "2dbd999d-4c3b-4fbe-87a4-25507a0ac2a2", "comment": "Malware payload", "value": "b218049fb1e0a83b803d3344749a28f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570340, "uuid": "47462a73-e8da-4664-94d5-f39c597622c4", "comment": "Malware payload", "value": "4b0f3abe3b0c7a9356687b4c29c68f9bab4247ca92cf5c37b42eec2881d3d2ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570340, "uuid": "12a4d163-5513-4e55-ae69-a6f4ef6a89c6", "comment": "Malware payload", "value": "23e18e618caae3d34b734c0cb13a0750d73656f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570340, "uuid": "5c737853-4d47-4d25-9d8b-6dff8afa06c7", "comment": "Malware payload", "value": "22c0bb296d6efacfb730d293e155077016ff9b11c96afb40440a8011ce186cbba15689ada32b2dddbc59132ccf0daa22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570340, "uuid": "1227385f-ba46-499f-b1e8-fc868e46f2be", "value": "T111351211F1BC09FAD66606F989344180273BF72B421DD70D32B2719E6976BC212A9F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570340, "uuid": "9c126791-779e-4eee-87cd-d36797ea78b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570340, "uuid": "08c09b21-99f0-4654-9c35-9733458fc2be", "value": "24576:+gjjjrlmuyyhU6aZSs6EG0QxsLZ4As6TLKewD67S:L3xmuRdEWx4o6/Kf67S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648570340, "uuid": "bc4f7d00-0877-48a1-8b5d-f3946676d07f", "value": 1118720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648570340, "uuid": "a3f2e810-5b7b-4cc0-9d67-adf0e2091137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570340, "uuid": "f3a4880a-d405-4aa8-a03e-74b3cb8d2f11", "value": "eVtkS8gn7klc0B7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baef034b-af19-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648528558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528558, "uuid": "7a2b3323-589e-4387-af51-2ce87866300e", "comment": "Malware payload (AgentTesla)", "value": "ab9d99156f2ef9cee9de5def94272106", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528558, "uuid": "4b25ab0b-4082-4865-9ace-5e8e3df41eba", "comment": "Malware payload (AgentTesla)", "value": "4b5b09ddaf5f999eca11a9c5be254f2be6a984356aa21006bef049812ad86cba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528558, "uuid": "6b9b7be4-a24e-494e-a64e-765496d96637", "comment": "Malware payload (AgentTesla)", "value": "68e9f14b9f64d1c652ba15c29db3817e06aa24c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528558, "uuid": "ba60c079-e2bc-4600-916f-03d30ea0db05", "comment": "Malware payload (AgentTesla)", "value": "7ffda3cadbae5db56412b031a81d6849455bcf77f035fa61f44ead2bdf77b768454da128ef70763c5b5236d8cdb8f720", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648528558, "uuid": "03bb4e95-7dad-42e2-8129-3ddac1a29716", "value": "T1CD45DF65FAE4841CFA7D86FA58B0B2D08F206F161927D7C953B139D9C9FE3412D4E282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648528558, "uuid": "a73cadb2-a8a0-4ad3-9e15-c7090cbab6e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648528558, "uuid": "503cd1a7-c44c-4894-bdb5-582010785e47", "value": "24576:1Ne0rRG3fIfDcerPkV7Y5Nph4Pqgu7DBUIdUowLpz6S:1NeN3fIfDrAV7YFcq5fdUowLN6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648528558, "uuid": "2c4ff51c-406b-42ac-97bb-28fbfa21646d", "value": 1263104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648528558, "uuid": "7d009bbc-fc21-4bf4-91bd-47c333ce980e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648528558, "uuid": "98bd5694-c81f-43c4-ba0c-a82e7d7c3502", "value": "SoA & Invoice copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfefb46-af5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648558464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558464, "uuid": "619a4be4-1260-49de-a065-7c5e3f18ccc7", "comment": "Malware payload (AgentTesla)", "value": "1fbc67185c35b76fe4c1ee3afe87bfa1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558464, "uuid": "e7a93843-9657-4382-80f0-83c40f75f4e0", "comment": "Malware payload (AgentTesla)", "value": "4b8422a66ca0a28d8bebaddb15a97b53909b9240cee9f64873ba7b54df76a179", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558464, "uuid": "568d8fdc-d077-44d0-9e07-884e22bd378d", "comment": "Malware payload (AgentTesla)", "value": "8f370d970e4764286853a315512c093fbffcb017", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558464, "uuid": "d2986674-930a-41fb-8730-e074edf31c71", "comment": "Malware payload (AgentTesla)", "value": "0c1a68597b0be717bce1d1e924c33f0e393477403a4335c419e9a7dc502c8a7f584f8cad01cd8111dea83143f1228366", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558464, "uuid": "e2a7d788-5bf4-4577-82a0-6ff4e20c8370", "value": "T159B423C9905F59D4BED15C62340622DA4539E060F9FF4EAF2326E2B0AFBE4B459180CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558464, "uuid": "6f161d18-abdd-4536-ad15-4fdf857054e2", "value": "12288:nlDmyXLFiFnH3DtNSlyKOXW/TsYk1QGlpSjbBfX0ImIKSyBYO:nhmyXLFinXBNiOXITs1TlMjbFX0IaSyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648558464, "uuid": "fbf407bc-1dc4-4d3e-bf87-3695a9c78c81", "value": 540708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648558464, "uuid": "218efafc-2c37-4934-bf3a-e4e1d67e6519", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558464, "uuid": "89819d37-00d7-4c13-beaa-86e4e24d49e4", "value": "Doc 62262314.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c638ca-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648573276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573276, "uuid": "f9ba720a-3af6-42c4-b659-d6887a6c1420", "comment": "Malware payload (SilentBuilder)", "value": "5705a87f3c73015bcde361fdc28e29c9", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573276, "uuid": "a44b1b8f-4d34-4831-a09b-97692a0e9820", "comment": "Malware payload (SilentBuilder)", "value": "4c5383ffd6ae7cdc8f45354d2dca02b8f315980d3baab72da93884ff322c55d4", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573276, "uuid": "f1bef815-7468-430f-860a-da95c2159ac7", "comment": "Malware payload (SilentBuilder)", "value": "e2ce7843c9d36a4b0dc7c69a46439d1abc43e0fb", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573276, "uuid": "c60dcb5c-3ad6-4cc2-8bde-73e2f3a1a504", "comment": "Malware payload (SilentBuilder)", "value": "0f05fd96db5d6e23794d740c13d2eaef4e63f0542d93035db7f9f9b1ef83e0bd750041559bc3f387cb4cfa2d4a6de781", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573276, "uuid": "cf7f3cdf-ad52-4caf-9374-be89914ce547", "value": "T18DB39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573276, "uuid": "a8d1e19a-f1a2-4e2e-816a-922086acb440", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMx:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573276, "uuid": "09480a9a-a7d8-4009-951b-c8400f20dc2b", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573276, "uuid": "5ebaf89d-ae5d-4d8b-bdd6-5cc4abaa8120", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573276, "uuid": "81354334-49bb-458c-8396-fd1794f4a217", "value": "5705a87f3c73015bcde361fdc28e29c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6135e864-af5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648558043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558043, "uuid": "fef5f274-9478-49ae-a3f3-390281767acb", "comment": "Malware payload (Heodo)", "value": "4244f046af1c92521dd09760e7357b71", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558043, "uuid": "8f14bbd5-6ce9-413d-a2df-411141ffee57", "comment": "Malware payload (Heodo)", "value": "4ce73ed7e49fc596adc461bd8dd4548c6842c5bcc8ea96c3cf711a11a9e5ea1d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558043, "uuid": "af864965-d8bd-4e3f-88f3-55ab5c6e12e4", "comment": "Malware payload (Heodo)", "value": "cba89907bab07e4ee574eb14feb9bfc615fd6651", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558043, "uuid": "311d8052-ed57-4762-8a36-ba916c0242e0", "comment": "Malware payload (Heodo)", "value": "3af6b62788da9bd9502b96e1a64bdc2a690374daa1486d2fa08e00f53b9d63c4fbc566f0aabdb8a2f94bc3d4ac1a28cc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558043, "uuid": "f0cf3248-1dc8-4893-8e55-bb830e5dcb68", "value": "T1FBC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558043, "uuid": "c907764a-9e85-4f97-b9a2-71857818579a", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCs:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648558043, "uuid": "e583939f-658e-43ec-b841-bc77de7bdd76", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648558043, "uuid": "687f981c-1b5c-4606-80fa-a9a137a801e4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558043, "uuid": "291b3261-e111-47d7-ac42-d2dc67d31780", "value": "4244f046af1c92521dd09760e7357b71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8025de7d-af63-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648560242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560242, "uuid": "2b60e8c8-cfe0-4e41-be3f-c7159e669eb1", "comment": "Malware payload", "value": "17ef28c0efb4d5aff7484988aa906a0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560242, "uuid": "8842f3cf-bf39-47ca-b716-cd9295519c18", "comment": "Malware payload", "value": "4d1e78141f3a1319a3d6074493bc633eab3bc4504220a52f5f8f5faaa9be1bd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560242, "uuid": "0c43eb77-4d1d-4038-8cd9-f0c51cd4d7e4", "comment": "Malware payload", "value": "9cfe6218e0073abcd2c8bc5fd79d328222448b55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560242, "uuid": "6eb5d686-1f60-467f-b10d-d018fb5fe30a", "comment": "Malware payload", "value": "103b4ddebc43f8609764ea7a99ca7e01b3b96b5647af29281758cd34a92f02a0ec14b5f7fed63304e33960cfd17cef17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560242, "uuid": "12b99428-bfcd-4e93-a1da-5d7810f74453", "value": "T1B73523CC77DD4B03C6FC1BFA889444015BBA2D2BA074DA5C8ECAB5C65973B429B46E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560242, "uuid": "8d3ef6a2-1446-4028-85e2-039e0e1e1b68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560242, "uuid": "bf1b0d4e-861e-415d-956c-17dc0663653f", "value": "24576:VbRt78d4cSTEPnfRt3wwKusuRpFrpNdDPo/0scLGjLEuJSc:dRtBcXPnrgwKzu1FNdDPohcL+grc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560242, "uuid": "cd5dbfe5-2578-46ad-af20-bbab097c7f8f", "value": 1125376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560242, "uuid": "6ab8522f-1d53-4bd1-8c06-3cfd57d3d14e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560242, "uuid": "26f1e758-73bd-464f-8b9d-ad0702354b3d", "value": "PO NO 1203232022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b005cf7-af37-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648541309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "994ed790-43b0-4f03-82f0-b2897522d13d", "comment": "Malware payload (Heodo)", "value": "79845ca915f9d9accd0d80f11e5a4f03", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "901263aa-cecf-4c13-9f2c-8e54e0157116", "comment": "Malware payload (Heodo)", "value": "4d4daa01dba3a10c7eefe7f816ca938acf92d5f2a979778959545b81a8c6b155", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "b56f5b37-8335-46c1-915e-bb3799b2bdae", "comment": "Malware payload (Heodo)", "value": "39187968908c5372198af9ff9143adb4baab236e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "85471390-fd7c-4b62-8b8c-2352a4153c19", "comment": "Malware payload (Heodo)", "value": "e4b6c01b4744908e8587abb3cba340dc833ffb1c1fda4a7f25d87ec59e0666f34c2f2223c7bb84cf243c31d4a74bcb9f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "9f49d5db-939a-4698-aec1-faf02e92cd59", "value": "T144C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "7141d3a1-c44f-4f3f-b7bd-92cb6d639cfb", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "e8e67166-8515-4326-8a69-5ebaeb1f0dfb", "value": "12288:iUV7ciwHX3ew9aYU3poc9inFijaQeL+nZBb:UiMX9Iaky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648541309, "uuid": "62d10669-7c31-42bd-9e4c-9e6b25911543", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648541309, "uuid": "0ce491bd-a737-41d6-b66d-05f6c7818cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "d72ecab3-fbd9-4938-9340-db8a64fee8a6", "value": "emotet_exe_e4_4d4daa01dba3a10c7eefe7f816ca938acf92d5f2a979778959545b81a8c6b155_2022-03-29__080823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f514d5e0-afa7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648589644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589644, "uuid": "32c7c8eb-4339-4fb8-b881-2e142227951c", "comment": "Malware payload (Heodo)", "value": "000cc5a12ae6fe376eab5e290c6134d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589644, "uuid": "58cc0c60-8ed4-418e-bac7-085836b18340", "comment": "Malware payload (Heodo)", "value": "4d5a1af07c03cd7c6ed8fdf96904518aaad3de08fd7810d32f4b754ae8682e89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589644, "uuid": "cc4f28f7-731c-4c64-ae88-41284ea28568", "comment": "Malware payload (Heodo)", "value": "8d6f08f0b603c9bf0e4ebbf058b8b3a9bd20b310", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589644, "uuid": "7d9eb92a-bff6-4033-8762-93e074fc6626", "comment": "Malware payload (Heodo)", "value": "b4932550ff2321f4543b39c185fb295d9371fd90c6ac46577d38cd9978a75dc952803824621ca83c0b386fbb132849ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589644, "uuid": "9ee3828c-6f45-4548-a0d2-4b0699e5dba0", "value": "T112A49DC87582C132DE7B4B75C552CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589644, "uuid": "75861f15-953d-4271-a70d-94d6a020d5be", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589644, "uuid": "5317d20e-b4c5-4a4e-b213-5525bdb674c1", "value": "12288:myXvaWo3sPddfrk/EpBLsORdPDpFlrh5W:F/as1dDkGHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648589644, "uuid": "2106989f-dabd-4ef0-9057-2d3e27224b72", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648589644, "uuid": "3c2501a9-6ee8-4ae9-ae63-90d33c5f1c5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589644, "uuid": "5fbccf35-a121-4198-830b-43e765c689a4", "value": "000cc5a12ae6fe376eab5e290c6134d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2710f7a-afa5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648588673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588673, "uuid": "d3cac4f1-018a-40c7-9a05-a2098d6135e1", "comment": "Malware payload (Formbook)", "value": "22dff8e424ec09fff3c741cad62d844a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588673, "uuid": "a69ce5c0-850c-4b20-b5d9-db7097ff8109", "comment": "Malware payload (Formbook)", "value": "4e44da40fdcc993d0d678016ba7d80ff23b552a3ed1da2f9d4e4c87daa597d20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588673, "uuid": "bc1f9286-31d5-40cc-b91f-3287bd54a04c", "comment": "Malware payload (Formbook)", "value": "c11f3f309826f02654e8ffc6d41f15ed964b9955", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588673, "uuid": "945c9087-372c-4917-ae04-89a8e03b5104", "comment": "Malware payload (Formbook)", "value": "7fd8b4f5f19553c3387a08f76acd29467141d88e7dda6e7fa37f218d46aa50fe3c9f0e270a7c9e8590eaf35702d9a1d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588673, "uuid": "04121dda-8198-4ed0-8aec-a7633cf7edec", "value": "T1B4351212F298469AC4295A7A64334D001733BF2F5D1EF74E76B2B48B29B33C21166F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588673, "uuid": "1f40561c-f7d7-4a44-a194-699236822bf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588673, "uuid": "a2dc2210-23ce-4ba9-ab33-0379800338ae", "value": "24576:QgjjOuifHhq+NA2TeULmsRV48zc6r3SoguC/X90AW:RdCBq+NzTew9Rzh3pZQ90A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648588673, "uuid": "da0cd8bb-8e7c-447e-a107-46f0070532ff", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648588673, "uuid": "d4e0c136-0147-40be-a0f3-993b338d8f0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588673, "uuid": "5c9415e4-3dda-40d1-b3fd-d4a76a209f49", "value": "Purchasing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ac4f7c-af2e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648537674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537674, "uuid": "69449649-7315-4776-97d1-cf0b2145548b", "comment": "Malware payload (Formbook)", "value": "6403569f222640afc2d34aaa91dc6a3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537674, "uuid": "8402c8fc-3115-40e3-9c08-42f6c0c10b2a", "comment": "Malware payload (Formbook)", "value": "4e928ac3e9f7561e6ffe01ded9a72973da0282a4fbb07c3f94cbc2b40bdb13f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537674, "uuid": "ee401a9f-418a-4b43-b496-dfd8c24bca3a", "comment": "Malware payload (Formbook)", "value": "75adbc3b6c0695067beb0856418f6b50d00f3ba8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537674, "uuid": "da38278a-9093-4304-a9d7-42669c88d63c", "comment": "Malware payload (Formbook)", "value": "1311dacd84dc137f4dddf393cac30c11d0d0dd897598c29dd5d4c9b4963cd6eae746e0ac75b4026d8b2b0286daf71374", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537674, "uuid": "5b5da709-44ba-4828-b7aa-0e3d9ad5ef5b", "value": "T149341249B4C0507BE39B0F71727367BAE338E69216472B97038C7F7E1942A660D49DA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537674, "uuid": "998d5763-a56e-4a83-ace1-4489f44dfd84", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537674, "uuid": "9f3818f0-6aa3-4915-9fb7-d08e11ed8acc", "value": "6144:rGi/yRzuwnZ7YQOimlz49QY7KJLIyU6wqRLPnTchICpOCLIG:Ly1uwnHOHz49QSKJLbw8HyZAzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537674, "uuid": "b876669a-66a5-4448-8e96-454700dfb6be", "value": 248751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537674, "uuid": "6bcbb764-e74c-4c16-8d8b-a207578a4be5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537674, "uuid": "b188ea2a-0c53-4f41-9777-cd8096f5b695", "value": "6403569f222640afc2d34aaa91dc6a3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d19c32-af93-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648581054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581054, "uuid": "c632a87d-5fe6-465c-9a4a-c46a25a9cc9c", "comment": "Malware payload (SilentBuilder)", "value": "fd09fc09eee3f246cd0f859409915a6d", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581054, "uuid": "f8140835-6c02-4f3b-93cd-eaf4bcfa6f40", "comment": "Malware payload (SilentBuilder)", "value": "4f1869d19f696a47571767172377c704e4026fce36bdd69cd3899239843c647a", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581054, "uuid": "bbecf803-11de-4141-a42a-f8b2be527658", "comment": "Malware payload (SilentBuilder)", "value": "01a1bfe14318ba76ca06e6e3cbbc1bea9b709d09", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581054, "uuid": "db2c5ac3-c447-44a2-a155-3b8fc1ae250e", "comment": "Malware payload (SilentBuilder)", "value": "a1657f0d82969a8a55f3fcfb1e0383afcf1f8f166a0cfd94107a57ef2bb0cfb3ea927fa6bccd667379abf83874ab20ad", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581054, "uuid": "a6bdb5ea-49bb-4a57-9c67-99be863aee72", "value": "T11FB39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581054, "uuid": "44df2667-3ce8-4859-81f2-d20e91447bf0", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMJ:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648581054, "uuid": "338c0cb1-dd52-49ce-b7e4-8b90efbdfff1", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648581054, "uuid": "0c2621b2-241a-4cde-9b66-cf0c665e1430", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581054, "uuid": "df871270-e113-49c0-b379-bf5e6174238a", "value": "fd09fc09eee3f246cd0f859409915a6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5d600a-af39-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648542195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542195, "uuid": "cb60347d-01a0-474b-9b41-fefdb84695c8", "comment": "Malware payload (Loki)", "value": "30f9e7f45059f724055b97ce29f6d54c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542195, "uuid": "53e05a06-eae7-4b87-96f1-f70d47248b5e", "comment": "Malware payload (Loki)", "value": "4f70fa8bf5714fbe32ab97bd4ca31d774bfe3cd6f76a69ddff7aa76a4e8b1dc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542195, "uuid": "fdd043f1-b0bc-48e1-8ec8-cca37e69243b", "comment": "Malware payload (Loki)", "value": "e1c37dd910888dec8c75edf689198120c876559f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542195, "uuid": "d66e78a2-bcfb-4777-a9f0-7be44967f89a", "comment": "Malware payload (Loki)", "value": "294a695026ab097b60f29d46a2bac99743cde435e5a538107dd6657c772ebbdac3f8c5078d92b1b4517ff1aba536650b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542195, "uuid": "e27ce1f7-a65d-4284-a18e-1e4544dd55ad", "value": "T10225026C27E88050EBBE5BFFE8F154108775B52B1237E31D898229EE0E267C18A57357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542195, "uuid": "58f0dba8-ba04-4c71-87a0-95e541010469", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542195, "uuid": "0b0ed3fd-bae2-4970-b527-55ff984f4388", "value": "24576:QppDel6hFO+EDiKp9v7n9heXLHDp3zBEH9:QTDeMkDLji7jrq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648542195, "uuid": "f4237995-5902-4b05-8f39-626c07ad983b", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648542195, "uuid": "9faa2218-ac0e-4304-b4a7-48ec856d4914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542195, "uuid": "4bd563ca-4ed7-4e7b-a1f3-e83aeb0c2000", "value": "30f9e7f45059f724055b97ce29f6d54c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "748c2fb7-af63-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648560223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560223, "uuid": "bd1f43dc-132b-4060-b524-6bb91fbb50be", "comment": "Malware payload", "value": "3379cd709382c7406286dff2bf941477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560223, "uuid": "ec424fe9-015a-43c2-9b9b-aa876f9907dd", "comment": "Malware payload", "value": "4f7d9ae4dffd86b34f0f12432e5dcd7ac67257fadd589a149c2242c9c38d01c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560223, "uuid": "77ad4071-6936-466d-a2ce-d595141a7735", "comment": "Malware payload", "value": "b7ace5977550d339f16e393ff6c10514191b57a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560223, "uuid": "d8bc589d-6496-463a-b9cb-f58202a83cf2", "comment": "Malware payload", "value": "0b2534671bed93fd4d51d8d0e70db50cec1803774fb43739784d1adca74f1376b8be26d07e91db4e6000743fbd56e1ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560223, "uuid": "880e0876-0515-4f9c-9d50-77d6a37a2880", "value": "T1CE74C012233EDC07DA5326B5CD62D6FBA274ED1025A4CB0361B1BC6FFD69A93ED08149", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560223, "uuid": "02bd063d-da70-4dc8-9f02-e240214e35b7", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560223, "uuid": "ca71896f-a142-4ff9-9007-2a1a0583f7aa", "value": "6144:nbE/HU8xwuTUQXN4+MRL8GIwZH5bjMMov4rs7jq4ZJiIhlrPIz:nbypI+M98GIAjMMov4Mq4KahPIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560223, "uuid": "8ba6a878-28f8-43ff-9e1b-d11d4fb61538", "value": 337208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560223, "uuid": "977c79eb-009a-494b-aacf-3bed56dd269c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560223, "uuid": "3e78d641-9e24-4cf8-96a0-34c959d0aa35", "value": "AWD~39873653637-309387653456378.DOC (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7130acd3-af32-11ec-8e58-42010a9c0032", "comment": "Malware payload (LoaderBot)", "timestamp": 1648539172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539172, "uuid": "a5fd5472-1c4f-43fd-bd64-09cb22580dc1", "comment": "Malware payload (LoaderBot)", "value": "6e42ffd78e2b9d82ca6c543ec01063b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539172, "uuid": "639e64a1-66a2-49ac-a415-c4f3af18fba8", "comment": "Malware payload (LoaderBot)", "value": "4f9e91d7b3a30bb8b9e125b9921207fd40b5ad7aecdc544f214a7f6fb85c94fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539172, "uuid": "dbeda4e4-815b-4b34-9aeb-d5362db2c5c2", "comment": "Malware payload (LoaderBot)", "value": "c82c9bdcb09ef5aaed8e613613f7ba8253e0afe7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539172, "uuid": "cb00da02-0b6a-4965-89fe-667c412d0377", "comment": "Malware payload (LoaderBot)", "value": "f3635e01dccf2177ba99f9a610a24df92803c43514b62a1df729433781217bc9c4b620d78ef517b0878798ce6e8b259c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539172, "uuid": "198a410f-bc53-4ad5-9f19-e5713ba9c8ec", "value": "T1AFB5D042BFC08F63C16A873599FB87162339EC559F435B076284B61D2CB27A43B936D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539172, "uuid": "62a3a38c-b8cc-4e0b-b332-fd0664e7a69e", "value": "24576:kHnNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+RNqN+7A6R:kHNDFFPJu8fBsVE6ij+RNg+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648539172, "uuid": "f29cd95f-6372-4f03-8218-4d0ab2336655", "value": 2449753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648539172, "uuid": "604b08a9-2bb2-40fb-bffb-71a86aeaac7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539172, "uuid": "37dbe6f7-98ec-4625-bb85-6ab1f2597d7d", "value": "6e42ffd78e2b9d82ca6c543ec01063b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c448bfc-af19-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648528292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528292, "uuid": "684594ac-2d3c-4807-8282-4be2b1f83bf9", "comment": "Malware payload (SnakeKeylogger)", "value": "878c986c44abf857f9fe4a6d48c1f0a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528292, "uuid": "5981e863-46cc-4d05-b6cf-f59dd1ef0f5b", "comment": "Malware payload (SnakeKeylogger)", "value": "4faf777c10dd803bf568dae9a4d27f4db2fcfeb54df64fa37b0c883fb0f029ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528292, "uuid": "d3d5be12-75a1-4b0d-be25-b62c193fe19a", "comment": "Malware payload (SnakeKeylogger)", "value": "18b3928c5f602b4dd45a5075a6480fdac54675fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528292, "uuid": "23358ec4-72c3-4310-8551-30e3766d8f14", "comment": "Malware payload (SnakeKeylogger)", "value": "d17402f8c5a090046cb0ba236310e6482255f0d2d8a85cbb197cbf9be2ed17c5dcaa576582f9a4978bf1cdc1c36803e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648528292, "uuid": "30540dc5-8958-4130-9a84-17746934ec3e", "value": "T1062502681BD88591FABE57FFA5B480108B35B52B6637F30D85C128ED0E73781D69A307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648528292, "uuid": "7feb2694-46ed-4378-aa37-2a27daac5e34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648528292, "uuid": "5b962b1b-1a8f-44fc-8dcc-2f77200bb251", "value": "24576:bXdeJ9tJBFzYk5n9mcqku+oCAwXKVxCoVh5bb:zdejskCcqd0PJo7Fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648528292, "uuid": "48978aec-f54b-46aa-b9c5-1466572e91f3", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648528292, "uuid": "d65b533a-777e-4200-b49a-88a7eab87457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648528292, "uuid": "608dcedf-e04f-4efd-ae99-5c586fa91df0", "value": "SLPO19847,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081e7554-af86-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1648575073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575073, "uuid": "c11393b3-27c8-4b82-b407-6eb06e981213", "comment": "Malware payload (DCRat)", "value": "042d222df06b89c47f715297595b28a1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575073, "uuid": "64b13470-7e82-4ffb-8624-508b5ed417f1", "comment": "Malware payload (DCRat)", "value": "4fc9a63acc0f70d05e72fa6fa3d4ec578a798b18e539a4e100db0147e0a7dc80", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575073, "uuid": "a35d1fda-578d-4734-8161-c79d7c391cce", "comment": "Malware payload (DCRat)", "value": "3b739dcd1211db5f9745217b2753a9fa747d1d78", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575073, "uuid": "ffd0def8-2873-45e8-97bc-b892ed557c3a", "comment": "Malware payload (DCRat)", "value": "34dfe3c4f35e9247fe274610c4ff4581f5f9ff5105054e713eb964a4d48df1babefb09207c0886caa8db70dc0e5f95a3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575073, "uuid": "a863553f-2787-4898-92ec-93b871b004ba", "value": "T193559D127A45CD27C0661B33DADF801847A9BD02AA27DB1E7E9A375E16013B79D0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575073, "uuid": "9542889b-79ab-4653-8582-d8a5e9f14fc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575073, "uuid": "cfdd5ab0-1e89-4d2f-b657-79c8100e4233", "value": "24576:ZHQxd1DXodUpZ5NHrmmN62X7s2s16qSXQjE2US0vqvg1T/ByO/yF50:WxYUPPrdLsjRSXQjEnqGNrY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648575073, "uuid": "42908e76-e412-4d8c-966a-c626ecb01b86", "value": 1373184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648575073, "uuid": "6d673109-5561-40df-96ff-467f78593701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575073, "uuid": "84d25e14-57bc-456e-96b1-a1551e5d40cf", "value": "042d222df06b89c47f715297595b28a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313ccb54-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648536058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536058, "uuid": "909927d4-9875-40fd-874c-caa1629acda2", "comment": "Malware payload (SnakeKeylogger)", "value": "aa1c0d8eceac6c4dc7604064d121e4c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536058, "uuid": "0a35e592-bb27-4c18-a6ab-e37196fb650f", "comment": "Malware payload (SnakeKeylogger)", "value": "4fcb2f07521077077f50ae8068724da515e6d5594cf7a8cabf193300fee5bf79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536058, "uuid": "f04d6f27-1d65-4369-bfae-22f2034c63cd", "comment": "Malware payload (SnakeKeylogger)", "value": "3900f7f43e254a88789f46b984bc4224e863d632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536058, "uuid": "b7184f58-98d9-411a-8738-8337e51e6463", "comment": "Malware payload (SnakeKeylogger)", "value": "76256eada1d6a479878e8c65991a4c7af2dcbe9984372588a8abba2db5e3e4ce670d085b67fe1fae4d3093a171c9aa23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536058, "uuid": "285ee464-ddbf-4150-a444-fe75b23d488e", "value": "T12C35F09D364076DFCC1BCE769A682C60AB60A4B7570BD203A45712EDAA0C6DBCF115F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536058, "uuid": "df60d2bb-64ec-44d1-a303-04fdd474d0a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536058, "uuid": "9691d35a-0c94-4c47-ad0b-7656ef5587b7", "value": "24576:FRairJfAqerk/yck8FZXwuX31FTNFfxPtYQdGG7:vnrJfXersnk8FZXw6DTNFZPJGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536058, "uuid": "fcecaabd-c834-40db-98bf-55cdf9eb5a99", "value": 1079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536058, "uuid": "2a769135-756b-4611-a380-a610af84d8c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536058, "uuid": "15f5110a-2e5a-410f-9a57-ad7aaa8903c9", "value": "aa1c0d8eceac6c4dc7604064d121e4c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1781d21-afa7-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648589638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589638, "uuid": "79737044-055a-4b83-8934-46ba3afa27fb", "comment": "Malware payload (SilentBuilder)", "value": "90f4eb246d7c0befbf7796db346ff1ae", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589638, "uuid": "0e3454ee-cf76-4392-b334-8947923f6a58", "comment": "Malware payload (SilentBuilder)", "value": "508514677ca98463993df2e4b8cecf85b5e766d36899f33d3a2b6f4d1694acd0", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589638, "uuid": "ca0f733c-a739-49cb-8728-ce429e3dc65b", "comment": "Malware payload (SilentBuilder)", "value": "947f3144626e659ee0b8a996fbbf366b2785fbbe", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589638, "uuid": "31a0a3cd-c5a0-4f79-851f-9428d7244b33", "comment": "Malware payload (SilentBuilder)", "value": "ded8b7a97d72091cdda16ef0f27218c4cc2034a6991bdb159932901d269d8e0b3ae0d1da7c1a87583e64e69fe726ab26", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589638, "uuid": "3816a13e-5d24-4058-8edc-91245f3336c8", "value": "T1AAB39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589638, "uuid": "b00abaf1-ea48-4a9c-b014-644cd47aff9e", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMy:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648589638, "uuid": "191f234e-9c60-44ea-a3f4-42d4b91f85b5", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648589638, "uuid": "46a18e5e-db2c-4437-9358-2b3552872ef8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589638, "uuid": "2213712e-5499-45cb-8338-fd2da22c815b", "value": "90f4eb246d7c0befbf7796db346ff1ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3522a465-af25-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648533488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533488, "uuid": "c2cb0cfb-e231-4c3a-a9c7-bedc744f835e", "comment": "Malware payload (AgentTesla)", "value": "9ef15e938a7febc6bf7878d130bf1f62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533488, "uuid": "6c3e5344-898f-453a-b5df-8838a514325a", "comment": "Malware payload (AgentTesla)", "value": "516606c42bf13eb7992cb4f629cdf1cf0b6e8441dc0de94136b3489701ee1675", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533488, "uuid": "97ab093e-8a16-431f-aa26-b7203da42fa2", "comment": "Malware payload (AgentTesla)", "value": "1bfb3f5225e9852fc484cc4443a87e752157c2cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533488, "uuid": "e6e4d46d-0479-44c9-95b9-b7fc29543cd4", "comment": "Malware payload (AgentTesla)", "value": "00ee7789890057e2cfe7ced3c4ef515fa4d9485ae757d692ca33254c913557d6684c9f493b6a7deb6ee2825033559651", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533488, "uuid": "d0d406d3-4918-42e7-8425-607b6db9ddfe", "value": "T110657C59325071AEC867C976CDA81CECEA207C665F1FC207A053329D9A3DA97CF146B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533488, "uuid": "47eef463-5c19-432b-a472-c10e2c0d6e30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533488, "uuid": "e8aab5d3-efe8-46da-a2dc-c2f4c8a50466", "value": "24576:c3yJn/V+b9FWG6jNBftvMlpz/Kt+9uUAxrW+Z6em6QBbvUDyUj+cPnY:nn/RASY4WEK6ibUDjj+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533488, "uuid": "b4caf165-6d86-4441-ae4d-a46a58adfea7", "value": 1443328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533488, "uuid": "bf9f55a5-ecc5-4516-a8dc-da92fe30f08f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533488, "uuid": "44e667f3-9834-42f2-9dd3-14e5a3edd040", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb145fe5-af5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648557013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557013, "uuid": "50839059-168c-48d1-97cb-854afeafae22", "comment": "Malware payload (SilentBuilder)", "value": "6ac3e4407f9092eb0b7aeb43df9e8b2c", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557013, "uuid": "68f0244d-495a-44d0-a0c8-e85e1fe70913", "comment": "Malware payload (SilentBuilder)", "value": "5171a15b76730c4c60f6c8d4a57d68932f14a312ba4b53fe0c8b2496467660eb", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557013, "uuid": "b5c4bfad-826d-49a3-a6a6-96186c4cd34e", "comment": "Malware payload (SilentBuilder)", "value": "52d7e76a84866fa383f09819b263821304ce6b99", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557013, "uuid": "4ca84506-b876-45a9-ab2f-8c6d8cf12b0a", "comment": "Malware payload (SilentBuilder)", "value": "a66338f1014c36a1288b72e53c0bdbdcdd7f4e542ca56ef7a0067f399fbb0e304110e445b720654274fe8608316aecca", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557013, "uuid": "ccad280f-6821-4aa2-9877-c7dfc5d25bf2", "value": "T1A7C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557013, "uuid": "6077c658-0484-4644-9a48-4032284f002f", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCM:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648557013, "uuid": "2fa6adf7-445a-4174-a0ba-6c31ee35d5a0", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648557013, "uuid": "0da2b39a-9ff5-45d8-a8c6-65fbff9a7dbb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557013, "uuid": "bc97c64c-ea5b-4117-be02-adbdd268424c", "value": "HLI64723144993179077493.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631c1fc1-af42-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648546020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546020, "uuid": "e02add7f-508a-4f21-8e9d-412051419788", "comment": "Malware payload (Formbook)", "value": "943cae40ccc382396e53d1a5463fe64e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546020, "uuid": "7f83a881-423c-4088-ad7a-f45ccc55c186", "comment": "Malware payload (Formbook)", "value": "51ca9a86ecb638b2805cd27a752159a05d4a3317c11ea43fb0f0cca78601c8dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546020, "uuid": "969a1acc-d305-4eb4-992b-70b2875d0c9b", "comment": "Malware payload (Formbook)", "value": "659757495126fd94a0d4088a8c0fccebc0963511", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546020, "uuid": "bceace1b-95e0-4e1e-be94-b7c4cd618ed2", "comment": "Malware payload (Formbook)", "value": "bf3f377d6e4283bcdd766ee4739658b8905073bdea17a334687960372034d1f027b8c8cece299fafc236edeb2da797e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546020, "uuid": "0469ebf9-6c26-4713-8592-b6c8170e8867", "value": "T157441216AA90F567C8F20B76583436BB8FFFAD3962B5290343502F5D6D336C29A3C650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546020, "uuid": "a02c4ac5-1d10-401a-8050-9d80c2d8d676", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546020, "uuid": "9fd6231c-5405-4798-8afa-4203449b1d1f", "value": "6144:mbE/HUbPPiXLygcd4wULhFuKdAOWP9rqz42cZYiqiUb:mb/SXLygcd3ADvdAOE9rkViqXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648546020, "uuid": "139c2018-5883-44f6-b931-85c9ca8632b9", "value": 256550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648546020, "uuid": "53edf304-cb6d-4dbd-8302-c0e620781ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546020, "uuid": "99b7df96-2c7e-46b5-8c64-ecd103e3c321", "value": "943cae40ccc382396e53d1a5463fe64e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4fb2429-af35-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648540655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540655, "uuid": "428157ec-5a49-4162-b4dc-a5a685dfd337", "comment": "Malware payload (SilentBuilder)", "value": "6e883d796fad8b59bcab03952757ad81", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540655, "uuid": "6b74c405-3bff-49cc-94bc-0db48c616991", "comment": "Malware payload (SilentBuilder)", "value": "5209ea6d5641eef796f99b9810fa855e445ee890ec4063c24f6212a2c9f86025", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540655, "uuid": "85b98d41-a17e-419b-849e-db6ab0ce5c1c", "comment": "Malware payload (SilentBuilder)", "value": "3df17621a2db7cbc250f9eebcf1cb344b160d8d3", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540655, "uuid": "e830c01e-bb7b-49c7-9d44-843961dc59f1", "comment": "Malware payload (SilentBuilder)", "value": "c2873634ef1368e91aa6955db41c1bdf238dfe7a8e516374a7c3e671339731fecc7b760834b3ae3facac9ce86ce44161", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540655, "uuid": "6f920984-34eb-4cc8-a1eb-c3657e39c7c8", "value": "T1C0C3AE8BB659486CE921877489DB879A7363FC354FAB47473214F3366FB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540655, "uuid": "7c7f8116-12cc-4a5c-9724-49e462f55e45", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgj3Siz+3z4Icu6hlCU:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648540655, "uuid": "99d4b1e3-f148-4c64-8a93-1e83bf6539e7", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648540655, "uuid": "00d26adb-6223-4292-bed6-69b225593e01", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540655, "uuid": "e4e040a9-93f1-4101-a56f-c92252525e4b", "value": "opastonline.com_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58887049-af3b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648542996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542996, "uuid": "4f400f23-f94f-47a3-a224-723dff101461", "comment": "Malware payload (Heodo)", "value": "49c4bd9a30b69136001d26934312aecf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542996, "uuid": "65eaf3e1-bdb5-4773-a6d4-1f9441cedab3", "comment": "Malware payload (Heodo)", "value": "52327d5c95800716c27afce4315f989f92824b2d4066f33cc720b0cb05719728", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542996, "uuid": "aad96f3f-f690-46e5-904f-45630778ee69", "comment": "Malware payload (Heodo)", "value": "11a223692e057239b9fd4b18e4de160d4bc09dab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542996, "uuid": "55fd8f32-fba3-4483-9fe6-52af7aa9f84f", "comment": "Malware payload (Heodo)", "value": "c3a1537b06d788d4f5430f94707ab3652d5f47df8ed0f4a7ab83ac249235c957b6198ad349c9564e24961e445a88de59", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542996, "uuid": "06c7156b-2a8b-477d-8631-bfe19354b4ab", "value": "T1E4A44B0173C390F0C657A574840FD525ACB7B83C6B19857EA28BA26F4BF78D09A346F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542996, "uuid": "2103727b-417a-4c7f-be97-6d7ffe65bb2e", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542996, "uuid": "08b0ab49-b33d-48c9-991a-f9a2725c431f", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7B1yarhj7ArkqBoEimFmzUM090/DHr8cQh:S54yM33d3q3Z7BogIreNmF+U/9Jc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648542996, "uuid": "c2a915ef-09b4-4d18-bd00-2eaf58e4a62d", "value": 476786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648542996, "uuid": "ac6a7e6c-5f3d-4c1c-8928-b49460cbbf07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542996, "uuid": "a2a84f7b-a7bd-4ad5-aff6-aa1b4df94aa4", "value": "emotet_exe_e5_52327d5c95800716c27afce4315f989f92824b2d4066f33cc720b0cb05719728_2022-03-29__083631.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc642c9f-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648536399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536399, "uuid": "81424100-e70a-44ff-8ed5-5e8ab68127bf", "comment": "Malware payload", "value": "1a6cee64066011b7dbd83a3190c99000", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536399, "uuid": "87a06b25-dbb7-486d-a4c4-74fd51341e2e", "comment": "Malware payload", "value": "52a55642974b0f7de09eb1cb6fce4521654398b104da8bc951a69a7c969ebf82", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536399, "uuid": "46597cec-5d00-4580-a9b3-e153f1806a42", "comment": "Malware payload", "value": "16cc87858a68477c2774df1735b7bc34afada5f4", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536399, "uuid": "d373ab08-aa86-4577-9670-9e2ab0b15f87", "comment": "Malware payload", "value": "7c6e29b4f9b70c9b02cb9e746a9eb090622f464e7d89311f272461047e396f03cbf08df47a11e8cde7b7eb2ac3687d2a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536399, "uuid": "e5a63000-9165-489d-8969-697a1346a79b", "value": "T18A7557F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536399, "uuid": "c67f969d-60e8-44d3-ac27-9b172a20bbbe", "value": "24576:gekDWIJMDLnmgGEuebjkuWPxYwehenVWo:g3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536399, "uuid": "42ef266c-084e-4501-bf4b-3f498ed5c671", "value": 1668020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536399, "uuid": "84fe2694-75b6-4c4d-8ddc-2eb506f489fc", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536399, "uuid": "717c14fe-9627-4ae9-8bb4-98fb6f901de8", "value": "DHL.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4649a855-af3a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648542536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542536, "uuid": "dca684d3-31ea-42df-a57f-447ed5e29fb8", "comment": "Malware payload (AgentTesla)", "value": "e1463b37301ed5f83f3f82b52ad1a367", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542536, "uuid": "659f9f44-7c9f-4cc8-be1a-2bc9537dcd3a", "comment": "Malware payload (AgentTesla)", "value": "54760af4088f4381a5f313abc2d29203389cf2b0c2259be5fb0a24cb2563567c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542536, "uuid": "256be786-6589-4ce3-a609-35ed41ca2e5a", "comment": "Malware payload (AgentTesla)", "value": "9b66b9a380dafaa9790c52c24a0240572cf72814", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542536, "uuid": "ab6f05aa-a3ba-4056-93f6-bfc0f39680dd", "comment": "Malware payload (AgentTesla)", "value": "3d8c436e92faeae17678a6171c0c1287b264e979b3b138add6e8fb31658fe99cacc1a213233bf9f875953f21a470feb5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542536, "uuid": "8644e65d-4ba9-4825-a89b-7ae18fd279c3", "value": "T180F4B3ADF2F075EFC857D0729EA81C68BA5075BB931F4103A02715ADDA1C897CF14AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542536, "uuid": "ef56c5e6-3ce6-4626-93c4-bf97ecc290e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542536, "uuid": "feb28ee8-2fcf-4f3c-8abc-27bedf549ecd", "value": "12288:2MmyZLDYMde8vzLm5h3E4Yh0IH6z3UuBnHVz0tPptAcJLIAn4BvwdR7RXFJQxTGR:xmyZLDO8mgjjLOR+TATTXGjtVP0ySuyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648542536, "uuid": "3d8d5b0b-a7ad-4bf0-ac2c-501a17c1eeac", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648542536, "uuid": "66abd7f4-9b06-4f9b-8da6-44d421b17831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542536, "uuid": "d18e6804-c210-45a1-bc5f-cd1d139516d2", "value": "Doc 62262314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1603e76a-af68-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1648562212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562212, "uuid": "f3b48baf-e5f2-4da2-a4c4-d46ba9f667f4", "comment": "Malware payload (DCRat)", "value": "0844ee7751dea0e21482cb44339e4c5e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562212, "uuid": "25635049-d6c1-46d6-a680-906bf4b8b4f9", "comment": "Malware payload (DCRat)", "value": "549ab47d848db8f4a1976397016a58f1c17e348c18a59a573b6e6ec87828bfc4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562212, "uuid": "a87da8b0-70a3-450d-9310-a2e1567e2fad", "comment": "Malware payload (DCRat)", "value": "7b46878e357002259318f823c572f6bb9283adb3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562212, "uuid": "790eae31-80a1-4dae-bd89-abc12438f159", "comment": "Malware payload (DCRat)", "value": "4a1643349263b9d2993a4eabdb039f671303129f5f8efa634f7485c6221a66e8dd31ca2e6df26fa3e51221e16dc711fa", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562212, "uuid": "4ae7d34e-491e-4e20-af92-2a8d2d675754", "value": "T16F559E127A45CD27C0661B33DADF801847A9BD02AA27DB1E7E9A375E16013B79D0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562212, "uuid": "2dd79220-ad49-426f-842b-969402700f76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562212, "uuid": "1f3c38fa-95eb-43c6-a9c8-e389c72e4f87", "value": "24576:vHQxd1DXodUpZ5NHrmmN62X7s2s16qSXQjE2US0vqvg1T/ByO/yF50:oxYUPPrdLsjRSXQjEnqGNrY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562212, "uuid": "61782299-8168-4544-8dea-6a1b028a01fa", "value": 1372672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562212, "uuid": "333a597e-71ce-4a94-a0ee-9f9576bc2922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562212, "uuid": "f2fe44d9-e7b2-4f07-a0cc-f38b3d05b119", "value": "0844ee7751dea0e21482cb44339e4c5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b17b65a-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529122, "uuid": "e952c95a-3c70-4722-b149-dd155549d409", "comment": "Malware payload (Stop)", "value": "e1f30fe35b115cc55046381fa03ddc55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529122, "uuid": "d49470ae-c2a4-4c1b-9ac1-bfe20bbfa421", "comment": "Malware payload (Stop)", "value": "54bd7123dbf17dde4e0c1e7d40f756988ba7577d039397c45ac15c766d4d7b2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529122, "uuid": "38deb864-2beb-411d-ae58-ce6073f00372", "comment": "Malware payload (Stop)", "value": "ca05c49d20c82e305d3a36ad7a2f014cfe496186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529122, "uuid": "7120bc18-ee74-41ba-bd69-f05c6cb7cb16", "comment": "Malware payload (Stop)", "value": "9ccfdd660795b978b75a51b207cb62c670f608cf9a576931b9cb23e1e7ab4a19e83e14173fa3f8828394949b1ff6b774", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529122, "uuid": "93fc27e3-37cb-45f1-a73f-6ce725a804fb", "value": "T19D05122239C4C433D56152FD8C06CEB45A7DBD754F205B4F6B983E4BAA332829A9538F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529122, "uuid": "909aba9b-3f3e-45c9-8fb3-bd1271b95812", "value": "e5c179e1f9502263973e4310e0826274", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529122, "uuid": "74cbe5f3-f32d-46ab-8ec3-02f20dba7aaf", "value": "12288:1zY5q6WvKIWCVSWcykS5ad8wZH5n+ndLhUueEysM9xd1XWK84kGocPgHcR:uE6WvpVS7DSAdhZ1+dNUPoAXhkAPg8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529122, "uuid": "8fd872ba-b042-42d6-9b6f-3a1e87c26939", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529122, "uuid": "129b185a-5d54-4daf-ae67-b057eaa4b936", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529122, "uuid": "a710624f-602b-46a8-8fb1-ddf81c0e6c77", "value": "54bd7123dbf17dde4e0c1e7d40f756988ba7577d039397c45ac15c766d4d7b2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa692d17-af93-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648581063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581063, "uuid": "c99015f6-2bc7-4817-99a4-9c517486b296", "comment": "Malware payload (SilentBuilder)", "value": "6257e80a1ab7a6e349c23457aa4ecae9", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581063, "uuid": "bb6b9b0f-24a8-480f-9524-355ec852f693", "comment": "Malware payload (SilentBuilder)", "value": "54d08522ffbd96a675e5aea3d3658b9aeafed3508940f376269fdebe9a930237", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581063, "uuid": "8261cd29-1001-41e2-b65a-511f20ada825", "comment": "Malware payload (SilentBuilder)", "value": "e63d5291919b3be7ab9bb1f6dd8261562fb378d8", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581063, "uuid": "7b7a1af3-b533-40ee-8884-a7f03dabd6ec", "comment": "Malware payload (SilentBuilder)", "value": "f176e8c4305663af6b76f9b369fa3e442dc50121d8de22a5b2211b357f084827d529933cf6a070430ed78d5cbe03f4bc", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581063, "uuid": "6d9dfcaa-2309-4b65-95aa-9fcf28ce401a", "value": "T136B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581063, "uuid": "be9795ba-c919-4594-8806-dddd22b051aa", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMV:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648581063, "uuid": "fdb3d05c-2472-457f-9cf6-217236b6d395", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648581063, "uuid": "03a5ff5b-6082-4a57-96ea-732ca174528f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581063, "uuid": "1bff6783-1370-47f7-a3b1-312e8ecad1da", "value": "6257e80a1ab7a6e349c23457aa4ecae9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d6f5c3-af2f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648538002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538002, "uuid": "31f30094-a590-4601-8c6b-8ea37ff28fec", "comment": "Malware payload (AgentTesla)", "value": "bacb576116857e048df4c51a72714625", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538002, "uuid": "5fbec221-d326-4257-9f74-88f7962580ab", "comment": "Malware payload (AgentTesla)", "value": "555224aceab8abfb20b06e6310d97df87f1828e0e48a4b93d2cbe834bf3ba7cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538002, "uuid": "b7b0bc8f-7006-4dd6-9c84-9a125ff34ccf", "comment": "Malware payload (AgentTesla)", "value": "2ca13658d9d4f300ea0edd2e115d2394e30c25d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538002, "uuid": "e32e288c-2fa8-4d5a-88c9-eab7c9d612b6", "comment": "Malware payload (AgentTesla)", "value": "812594e5290fe126815441ef627e3c2f506ed8f2fb4ff6ac7667dd63cef3fc2d5fae6372e2ec40b30ae3c733a2eb8a21", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538002, "uuid": "b1ec8e2d-6791-4eb8-8a0e-6cdcefbe0c03", "value": "T16A35125427E88050E6BD53FEE8B490409B71B81B257BE30D8AC168EE0F767C59A1B71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538002, "uuid": "3d3ccbb5-082c-4f79-a610-4a1e4e37fc30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538002, "uuid": "8978231d-342b-47a2-8638-4635f8a442f2", "value": "12288:bJtxcvveiBGslXznlUuDxRyRaSq/9aHHNuKnpw3XKDpZ9dKOvb/CAtjEBN9Rg9de:4veiBHNGExRRSYyC3Yb9lHgHg9dnTni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538002, "uuid": "d599732f-45f2-4eb6-8e79-4672c2a42000", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538002, "uuid": "7d01e600-e7f4-44f4-9dae-9ce315756cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538002, "uuid": "e938639e-93ed-4abd-b615-1138e7f8b6de", "value": "TEKL\u0130F \u0130STE\u011e\u0130 HK NEMKAR \u00dcR\u00dcN% Sipari\u015f TURK75BS\u0130l_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1731cdee-af32-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648539021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539021, "uuid": "dfdba02c-d871-4169-9e42-eeb0f4b2e335", "comment": "Malware payload", "value": "70611ea04403efc5693d8aa1ca3b6ed2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539021, "uuid": "87e0dc2b-1ca0-4124-b92f-d3e6c069dc66", "comment": "Malware payload", "value": "560375a6a60db1f07a4ad8712e780ec7f4bc358a6ad8adf80acca74120102fda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539021, "uuid": "d5da6833-111c-44cb-a83d-16c4e414d91a", "comment": "Malware payload", "value": "18cfe0c6d348789487ba9a9f73d2b468d5a0db5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539021, "uuid": "9b961823-bccb-4e61-aaac-8b619b620a47", "comment": "Malware payload", "value": "606003dda59d6e7070e55d0b36be3d1fe3e6043a1bdb9725fc2362175caa14b36752442a9490a1007a99218059225458", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539021, "uuid": "0a9b3895-de19-447d-95fd-1cfd47a9dcc6", "value": "T1C3D5AE42BBD08F63C16A877999E787163339DC549F435B076288F2193CB23F46B926D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539021, "uuid": "ad5e8c3a-7f42-4e39-805d-f57674f8ac8f", "value": "24576:jnNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+RNqN+7A6RdexY:LNDFFPJu8fBsVE6ij+RNg+UK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648539021, "uuid": "ade473ba-9286-45e7-aff4-81fc28a74dac", "value": 2872063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648539021, "uuid": "7f355e56-572f-423c-9eb7-0afcbf8223e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539021, "uuid": "c0c2dee7-ce8a-458f-897d-9dfa7da1dde7", "value": "70611ea04403efc5693d8aa1ca3b6ed2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5488ac2-af31-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1648538830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538830, "uuid": "b95389de-6287-4c38-9a56-0193a0d2d4f9", "comment": "Malware payload (CoinMiner)", "value": "29a102e6f6bf3b94186664607d6bf8b4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538830, "uuid": "b5fd84f8-1b8b-4488-95a9-92923e4589fb", "comment": "Malware payload (CoinMiner)", "value": "564027dbda1d9a7bf8c09e26c8e2dae0b629a9af6b1e07cb58f3fd294bf9391e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538830, "uuid": "ff9737e6-8e43-4e09-8d0d-cc019c7ef325", "comment": "Malware payload (CoinMiner)", "value": "86721165b4126994654898d717a567fd7a06b662", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538830, "uuid": "4eba3bfb-28e7-490b-9cc7-7b2af4927f82", "comment": "Malware payload (CoinMiner)", "value": "67065e1a2888a202b485c5b480dbb72156d7db8642d9c05d3042951c4954c85e0c7004717a53f677f983c8fd6611d951", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538830, "uuid": "5e2ba983-b88f-4a33-9bbf-2854b2b62d03", "value": "T1CBC522A91368739CC40AC4B4D533FE8AB261131E5FD458BD36CA7AC17B6E841F681F86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538830, "uuid": "18fbdcc6-f8c5-4806-98be-abba5c2c2ea2", "value": "4e4095a0d90406c8428c5d9a9c6b05b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538830, "uuid": "1b5d3e2d-a9de-4cd5-92fc-1ec289d04bca", "value": "49152:dc5OW3a7ZCGEyFaxhWob6SbZz0aGjmR/z14FU8PgQFFgVTmSHO0d:a5Or4GjFanWoO4Gjmb4PoyFomwOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538830, "uuid": "44b1e796-d704-462a-a1e2-336965cc92de", "value": 2501375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538830, "uuid": "d3987822-825a-4f11-919d-570da0f4f56d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538830, "uuid": "e9770a04-fb52-4b16-b231-42c480b9ebc5", "value": "29a102e6f6bf3b94186664607d6bf8b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab815d4a-af32-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648539270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539270, "uuid": "64871dcc-6822-439a-9e64-1f872b86f634", "comment": "Malware payload", "value": "0be51de12909a2f20a0bb94fd652efdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539270, "uuid": "4c457e95-748e-4f57-87a7-82bda7ac2387", "comment": "Malware payload", "value": "565338b2aa6b506c719cf169cabc7a76047536b288ed2da6c29a8477ef62fcdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539270, "uuid": "87dd0664-5232-4089-b0e3-3273b986fbc8", "comment": "Malware payload", "value": "f4d7f0da9eb5bc294d3a088be523d8edc5a81fe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539270, "uuid": "0ef7d730-c53c-44df-a41f-4b3ac1c3551b", "comment": "Malware payload", "value": "94f575f0f177bc71b4e6f0557ae5efc4b8fa0b34aaf9a4b70dbb91d23b58260c07dc300977f9f67568d60f5f1a9606de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539270, "uuid": "6dc5c42a-d26f-4c85-a5d1-f20b14ddea55", "value": "T1F1C5336D4AF769A9C9C7A0705597E233E2543E94F9CC2E871EE63F7BB8E5901E0C4840", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539270, "uuid": "3bd70b65-5264-4556-bacf-94e7b4c4a6f7", "value": "01d1b984e99e67b6f7ae46199d7dfd92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539270, "uuid": "213f7d23-c90a-419a-ae5b-e658f506a010", "value": "49152:K9SRQo3DNrOKFcHxALBpIHo9HYdZvXYEj4UDEbVhqTig2Iug/xRW:KMRQo3DNry23M80F4WyhqTi5Iug/xRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648539270, "uuid": "cf5e82b3-50e4-47ce-a3c3-39cadb42ccef", "value": 2584340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648539270, "uuid": "c814516c-027c-4850-b66c-d2c7d33be842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539270, "uuid": "87068601-9459-45b1-af6e-9df2bc3ee614", "value": "0be51de12909a2f20a0bb94fd652efdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fb7eb9-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648536905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536905, "uuid": "f6305102-f415-4cc4-968f-5dd9dfbbb33a", "comment": "Malware payload (Loki)", "value": "e397610ff929b2fd14636aa3977fbbea", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536905, "uuid": "b3fc8b20-115e-4649-86b7-c3cfcc159cc9", "comment": "Malware payload (Loki)", "value": "56659bd5cf5964f1a441a992b24038d060501903c8d4c4922ca33dcd2901ecf2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536905, "uuid": "ce618b01-72ab-43c0-ae4c-5fe59d3d2dbf", "comment": "Malware payload (Loki)", "value": "bdcb3b188874c38455f0080fb0f50ed65ef28750", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536905, "uuid": "b93df748-c662-4fd0-be19-9f4c503a482e", "comment": "Malware payload (Loki)", "value": "040fe559d0be866796be1e3af089477cfb1486ced154d532d9f0e679a84f554a5425f9a76cb70ba0c0c2f8a9031dea28", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536905, "uuid": "b30fa39a-0a7c-4930-9027-67d4e43df0f2", "value": "T11414120BBE208568D042F7FA5A74DE748169ECFD3615ABB6BB24BFC66CBD0034C0045A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536905, "uuid": "1d1b89ea-ff3a-458e-8593-988a982e08ef", "value": "3072:mRXPD1smnVcFbX86V71nfRhjTfxqRzviHoemQNlYUFzA4ky+q15PedvzX5kvW3Wq:6Xr1DVK86V71fRtTfGviICzYUFsU+CGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536905, "uuid": "329ef28e-17c5-4a5c-bd34-a047f29a2c1b", "value": 193112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536905, "uuid": "45f850e2-fe8a-4a1e-9349-60c807579c30", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536905, "uuid": "9d995394-4041-4900-a2c3-86f212c257df", "value": "SWIFT Transfer 103 SE07802203259942.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afbbb1a-af37-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648541309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "6d12adeb-638f-42a4-a100-e753d7aec052", "comment": "Malware payload (Heodo)", "value": "cab0e24e66486f2f38fc6c84ae670a8d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "71f5ae57-e0ad-4a6c-bd66-a0f65da93a81", "comment": "Malware payload (Heodo)", "value": "5675ee024b4c4d6ed0a8963e1614961c7773c7faed735d24d96351e8201f02c7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "36149427-1593-48fc-b2e5-d3b055e40716", "comment": "Malware payload (Heodo)", "value": "ce179efb5bd6e1e962139385acf6989207fad14b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "71f5e140-4e85-4a9f-8eb8-acf1adfdeb89", "comment": "Malware payload (Heodo)", "value": "5a04a7fb8f2a4691c91bad00571b8192c0b7f1b98f6210424c6f91428d5409a26f5fc1455ee35084a9455ee4d7c057b4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "05244081-cacc-475c-8e9b-6fc2cf7d6e6e", "value": "T1D5C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "3409059f-686e-453d-9796-80a9a8944ecc", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "541a4994-a9f8-49c6-bcf0-0143431d4f5a", "value": "12288:iUV7ciwHX3ew9aYU3pVc9inFijaQeL+nZBb:UiMX9I/ky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648541309, "uuid": "f976ac46-9644-4bee-91dc-5cc8e66dbf12", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648541309, "uuid": "5f3fec3b-a3a9-45dd-9cbd-529d2c86271c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "7875b9a3-53cc-48aa-be27-bcc62584cde5", "value": "emotet_exe_e4_5675ee024b4c4d6ed0a8963e1614961c7773c7faed735d24d96351e8201f02c7_2022-03-29__080823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cc178d-af85-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648574776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574776, "uuid": "947f1532-0fb2-4d29-81ef-35fa5e08e0b1", "comment": "Malware payload (Heodo)", "value": "b62bff25af9954c6fa5bed7f7f3fa7bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574776, "uuid": "b4b3a38d-e697-4c31-b128-1cd4c62cba06", "comment": "Malware payload (Heodo)", "value": "56af0b5bc11372e6ba080b0f7d0a3702562b30950aac72b9d16d4e88ea1ba6ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574776, "uuid": "f60003e9-f4fd-478d-a23f-2124e73f242f", "comment": "Malware payload (Heodo)", "value": "a95d9efc570368f989c251a2d9eceabaad982273", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574776, "uuid": "27895964-7326-4af8-b80c-d09eba2d90ad", "comment": "Malware payload (Heodo)", "value": "0935a177e458a4c0db176e92446098a6b2fe5b234380aeb4cd47171ce5e6697932595684df3d3731088c3a227d4da421", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648574776, "uuid": "6ca93d78-2b19-472b-a79e-f9ccb72a213c", "value": "T10ED45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648574776, "uuid": "ef1cd3ab-d3df-48f6-95bb-8056607d9294", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648574776, "uuid": "6e6f846e-cfe0-45bf-9f50-fbfdf67fdbf7", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzwipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+w7ooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648574776, "uuid": "4be1f262-5de0-4748-9abf-0dd2d0a9ec91", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648574776, "uuid": "b3b254a8-6680-47fd-8fb6-44e6d1c90d2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648574776, "uuid": "905e19b5-886f-4ae2-8c0f-caa54802e7c3", "value": "b62bff25af9954c6fa5bed7f7f3fa7bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ef847e-af96-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648582099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582099, "uuid": "3fee767e-bf43-41ce-912b-6cba88b8044f", "comment": "Malware payload (Mirai)", "value": "b67297a0e4ae5cf0abae56fa75d429c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582099, "uuid": "7871392d-b2b6-4c6a-9d75-aa655bd44dab", "comment": "Malware payload (Mirai)", "value": "56ccf13cd679274dd6cce3bd894fe55928015b3fada2240cb733f3013e58f387", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582099, "uuid": "01a183be-5d81-4408-b496-72b8e900bec6", "comment": "Malware payload (Mirai)", "value": "e127c116432984de3794f73ec344856805de945d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582099, "uuid": "e77b4c4f-db17-4e62-a07a-d34ff09164f0", "comment": "Malware payload (Mirai)", "value": "9d39cda99ce43db47b371c5849d65dfa48b0cf3f8c69a37409479c60cb6da6382c4b2727a2ee022253d58f6e9c4490d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582099, "uuid": "11efb087-36f0-4036-9736-a7de22772b44", "value": "T19164F1D6EA11BEB6F4D141B4BA6F034CB3718B99D3C7B201F214CA29399D24A4F7A1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582099, "uuid": "da67c740-a85f-46fb-919a-bc08cb2b8f72", "value": "3072:2glZ3FtCKXhkmHtZ9TEKzjfj/WMngyIfsJ0F7xPtoisKqqwPa5POdOQ33Q:2IIKXhZtL7jOTyIG87XLsKqqfPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648582099, "uuid": "2fdc70f4-f69e-4a02-a25c-68499619fa11", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648582099, "uuid": "bebccaf8-8212-4b88-a8e1-d51177125c4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582099, "uuid": "927f9d91-a01e-43a7-b610-a43fb18105d7", "value": "50cc.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f7bab1-af2f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648538005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538005, "uuid": "41096206-6d53-4828-b5e3-5bc5252092d9", "comment": "Malware payload", "value": "a35302c1fdd2ae738f632916468fc0c3", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538005, "uuid": "81a8b76e-ba25-44bf-b223-cd607f5e3cd8", "comment": "Malware payload", "value": "56f96ecca274322dc06486b99110f05f2436fe1b183d5b57b4fcb35086ad8d9c", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538005, "uuid": "d143dfed-c799-4b62-aea0-ca7372f4cb20", "comment": "Malware payload", "value": "f52efcc37cb016e3993fa4add9caccceb05ee80e", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538005, "uuid": "105cd7ab-5fd5-41d6-a575-1238ee38c8f4", "comment": "Malware payload", "value": "c6aca64dbe95e15e2c188f1e053c8f394169378b668d9f4e96cf17b3cac9972a90f68f80e2199319002290c70ce39fd3", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538005, "uuid": "0d84dd7a-d3dd-4232-905e-8c7137e8187b", "value": "T126C49E57F6D77A65E6AFC2BAC6B1C92D66B3309602B0C3CE774055492D22392483DB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538005, "uuid": "414ccde3-8ba8-4a50-8caa-4e2eb20f9c89", "value": "f20a8db3e4a8c03c1ab177b2660fdd78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538005, "uuid": "8f02222e-0620-4b66-b71e-6fd5bb4d500d", "value": "12288:GzLjlZHAt+AZrkOCH8bzbBSreIOi1uWD242S6+4:GzLhltAdkjcX1bDWeS6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538005, "uuid": "fea654b7-0f9d-4c1a-8e37-dc50797bdc36", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538005, "uuid": "9382c7af-8203-4784-86b0-c933ad322d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538005, "uuid": "1d37df2d-d010-4892-b290-9db5d2414327", "value": "BL DRAFT-COPY.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6ef5e7-af2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648536753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536753, "uuid": "c0c8da02-242b-4977-9799-14f9a72f099e", "comment": "Malware payload (Formbook)", "value": "c2ffa408e37ded8970d18d0247a330bb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536753, "uuid": "806753d2-bc1a-4676-9856-70b02d17a8ec", "comment": "Malware payload (Formbook)", "value": "57216b3d5ee7a840fe5743cae8d6ad1846c10c42e365c74a80c497cf705cdaaa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536753, "uuid": "ec86afd3-06f7-4947-9895-42ff04be3282", "comment": "Malware payload (Formbook)", "value": "3cb981d747bebd4e42b8a87f2115f8053a175e05", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536753, "uuid": "372d483c-bd5c-4744-b57a-64db144d9fb1", "comment": "Malware payload (Formbook)", "value": "fb8a63685dc673333c3f052643890eff26d31db9633c1fd03620bf42129491fcb0f48e19215dab1f1104aa4e79261ac8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536753, "uuid": "b05e5bbe-cdaf-493d-a906-472044f234a7", "value": "T1E5141294B799AE4EC8D32134CA1037C9C615EC86EC4DA8A0B2DF76C7AC73DD78E54854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536753, "uuid": "d553321c-c08a-4012-ad0d-f1a5ce967b03", "value": "3072:bOomWsS8tU0SmmbbYAZcsiV+/vWl8WQWZsty2WFn+rQeOzQRZfKRN/8cd+KI:SozH726VjiVyM8E6slYLRdKRZ8BF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536753, "uuid": "68bd7b30-4fec-4f89-b9fe-c7cb3bf12658", "value": 193464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536753, "uuid": "51d4e982-6ffe-4eae-aa22-10acc7af7377", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536753, "uuid": "97787bd1-dce5-4400-8168-a35de47671a7", "value": "PO7467627626637.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7bd622-af64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648560773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560773, "uuid": "68ad846a-0b0c-4bf9-87be-32cd154b5377", "comment": "Malware payload (Formbook)", "value": "ddf217967aaa60671a833f8fba86729c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560773, "uuid": "a7a39ebf-2ab2-4e36-92b7-cf3650285ad7", "comment": "Malware payload (Formbook)", "value": "5759b13137e1091398f834fc26b2b681adcce1dfaa83b9a0ab399b1566b9e69b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560773, "uuid": "6e23ccc9-b453-4fd4-9daa-8d9cd198c3bc", "comment": "Malware payload (Formbook)", "value": "7f46606c58be0c8f696fabc364b93ea0db4d8499", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560773, "uuid": "80facc69-dba8-4df1-984c-9b88270756fb", "comment": "Malware payload (Formbook)", "value": "94c5488413aaabd15c906e26ec4aea0d7754e53e45977e3170658ca40d0495e471a73989b3c937b76a8e3dcaeb97a620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560773, "uuid": "a2a1bea5-d4f4-4c3b-a6dc-99612ea0d1bf", "value": "T14825021427F88551EABE67FEF5B050108B35B51B652BE72E858229EE0F373C18A4B353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560773, "uuid": "14e6f749-22ad-43be-acc2-f4ae1fa7054d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560773, "uuid": "cc9cadd5-9ec4-4063-8e87-f210c98d7bfc", "value": "24576:bqeZVr28rke8IAJjErhddXdV1hd+evOlNxQ5uzQCC:bqeZo8rke5AtErh3tVL8XlNxQI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560773, "uuid": "328cffd6-2a25-49f4-98e0-e1f4def0973d", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560773, "uuid": "2aa5f3bd-3c30-4ff0-b364-2a14977e8e6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560773, "uuid": "9d844604-9a19-49a5-b35c-f1f77006ffa8", "value": "AWB_006647837575.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8dcaae0-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648536286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536286, "uuid": "f0c7cfea-f22a-46c5-aea1-92493c47ecf4", "comment": "Malware payload (SnakeKeylogger)", "value": "a9d338770a177d3cecb3e8481b7deebe", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536286, "uuid": "f4f42880-89b3-44cb-9434-693d140d13c9", "comment": "Malware payload (SnakeKeylogger)", "value": "57872e73fbe04d577949d86771f47ed10f90b4186e8f9ebb5195e74e485a80bf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536286, "uuid": "ac863d3d-ff92-4054-883f-6b3f6b3f9705", "comment": "Malware payload (SnakeKeylogger)", "value": "9ad0767f4ce00ea7dd628914c76731aaa029f85f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536286, "uuid": "4273cf9e-ec61-46ac-a602-2d37e76cf2dd", "comment": "Malware payload (SnakeKeylogger)", "value": "c836063fed9728aaa04d8d3ac24aa15de43863c56d5b8a5b2884e9dbb7aa99469e68b7e853fb28bb5941c6ce5f3e6ccc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536286, "uuid": "887dbadb-55d9-458b-bc87-659b8a19eccc", "value": "T1DD91186847680911DD999AF3DCB6BE5A02C2F59184CB26C1759EFFB00F27320A302E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536286, "uuid": "6e315263-eb66-4d90-b093-47a27c5e7e6d", "value": "96:pZLZJCKhy+JT6RYuby9kHEu8LIysc5jMZ5oM/7LwCni2V4q5AywjM:pDJCKhHWDzkiOI+k7LnnRV3W4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536286, "uuid": "b575b1e5-05e9-455b-b629-2802939d4ea7", "value": 4602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536286, "uuid": "44dcfa79-d2ce-4f12-bf7a-a6a9f00bd847", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536286, "uuid": "0ce3841c-a9e0-4e44-8173-da5f73880903", "value": "Order Specifications on Hydraulics and Oil.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee705ad7-af99-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648583620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583620, "uuid": "896c8b32-24b4-48b8-8290-3d1cd5903901", "comment": "Malware payload (SilentBuilder)", "value": "fde985939736724a304369094a406188", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583620, "uuid": "1c7264b0-c56d-4031-9154-f6482a081768", "comment": "Malware payload (SilentBuilder)", "value": "579b9ca94b070e52e1ea611749b06a93fe22a1fc8f87746d1e27984f13bd00a9", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583620, "uuid": "526b1b01-a656-4cdb-9e7c-12c71e12c6ee", "comment": "Malware payload (SilentBuilder)", "value": "d1c59da1f667929772a27a83b810e5f6284d532f", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583620, "uuid": "80ec6004-9beb-47a1-ac17-935ee69a1ae6", "comment": "Malware payload (SilentBuilder)", "value": "9ca28f508b8c5b1f56f925c2be2573423faa335902562085bf0dde5ab8c8985d2418e484f2bde72ad6608fffae4e0c85", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583620, "uuid": "34ea87ed-b06f-4085-8321-d0d83602e17a", "value": "T1BEB39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583620, "uuid": "18623da3-88ab-4666-93b2-16eaf16b6867", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMV:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648583620, "uuid": "06969019-52b3-44ad-b9da-f50e5987192e", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648583620, "uuid": "57c104bc-b62b-4664-b6fb-d47d1dad6d62", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583620, "uuid": "d2e640ae-1b76-4b90-b1e2-2e0f370963a7", "value": "fde985939736724a304369094a406188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a29583-af71-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648566419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566419, "uuid": "1cc35180-a8e6-4a1e-9419-42445f7c962a", "comment": "Malware payload (SilentBuilder)", "value": "7a0740741dea570216ab403e9e8165cb", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566419, "uuid": "c82d5272-7946-4257-8857-086c2286b294", "comment": "Malware payload (SilentBuilder)", "value": "579e2862831265f924368a1a99b50a704aa326d4aa1d02d931edc9cf5665801c", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566419, "uuid": "75ddb044-506c-4aa5-a384-33efb7ae91a8", "comment": "Malware payload (SilentBuilder)", "value": "18b5390c9a76348f091e5e7d39508b822cc748bc", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566419, "uuid": "9b9506e0-317b-4f30-aa2a-3daceec1d63c", "comment": "Malware payload (SilentBuilder)", "value": "be5a1c903766630e215eb8afd99cf10986799a2cfc58ab24f095e1d72fad111089bdea1bfcbd4e3fcc094a990d45a1ea", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566419, "uuid": "0014b451-2b52-4f56-b8b5-a6a5ddd6713f", "value": "T103C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566419, "uuid": "eef40bae-c198-4951-9122-00d5a0c4617a", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC4:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648566419, "uuid": "2c6ed757-9cd8-4a6e-be92-08c7396c29c7", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648566419, "uuid": "ad4fb34c-2039-489f-964c-a91c5471956b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566419, "uuid": "63152a7c-9f5a-46fe-8748-1718cd9c3a87", "value": "7a0740741dea570216ab403e9e8165cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ad0e07-afa2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648587236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587236, "uuid": "449127f3-ef27-45e9-a8bf-6376b286fd10", "comment": "Malware payload (Heodo)", "value": "f46d3d534b89fb7c05858574304dbf12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587236, "uuid": "2a53be0e-3cdb-4522-8a7c-988f1f83d77f", "comment": "Malware payload (Heodo)", "value": "57a5aace45043a7d64cad4a98e170e5cfbc5f26de8c35853c68445cbb948a2c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587236, "uuid": "1b3e5b18-ec84-4e63-9766-5a3fdae13a1a", "comment": "Malware payload (Heodo)", "value": "d3d009a383afbc75f9315d5ed028a5d1cfa966eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587236, "uuid": "eec1060d-7916-4cca-a390-d9e7aceea9d2", "comment": "Malware payload (Heodo)", "value": "ed18c25a165fee96b4675357c92a5a19ebf6f9e422f89e3b612a3403ce49f406c4251ffaa6b0ed70a66cd29e2ea56b1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587236, "uuid": "da0bec80-8f8f-4da4-acb7-8f3aa44623b7", "value": "T1E5A49DC87582C132DE7B4B75C552CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587236, "uuid": "58fada2c-99a3-4739-af8e-82a8ce7a92bb", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587236, "uuid": "6acc5679-52a4-49eb-bc00-60e460d44486", "value": "12288:myXvaWo3sPddfrk5EpBLsORdPDpFlrh5W:F/as1dDkwHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648587236, "uuid": "0df814d7-9120-4cf9-a9a9-a91451fd2724", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648587236, "uuid": "08d9c406-7a12-464b-b8d2-371b3cf5c556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587236, "uuid": "e036a776-cfc3-4bb9-a4f1-9baa7df7e31c", "value": "f46d3d534b89fb7c05858574304dbf12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33687311-af77-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648568704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568704, "uuid": "4d7a4c08-bbe1-47fa-aa54-702278d2e24f", "comment": "Malware payload", "value": "a1cc1e03f68bbe196f1c852c9a851e95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568704, "uuid": "77a3e468-08b9-4729-af30-c50af9ee45c1", "comment": "Malware payload", "value": "57c38984bd22e15b6b0ae6f05e03159e4f53b18692b2300c098c9094e631146f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568704, "uuid": "6e0de383-fb24-4323-b993-70d26ee89f10", "comment": "Malware payload", "value": "60f77b7dadb2319551ce6d9b99a33ba6b08e5dd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568704, "uuid": "69943134-1006-4b8f-9c3f-020c55573cad", "comment": "Malware payload", "value": "b82ca87ba69ef4c7a7642e78cb0b69e7e100f2a5032a0d14bf559840d8dafbfe7b656c3c4d42311beb9ef3f362d27300", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568704, "uuid": "d59d81d0-6dfa-44aa-92c8-ada67ac5eddf", "value": "T177550148F2948AB9D81946B4687188101376BF3A546CDB7D39B572FF2BB33C21116F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568704, "uuid": "94239f31-f3b7-4901-a7a9-4c1aa3ba85ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568704, "uuid": "787b72c3-fc4c-41ab-ae5c-558602ac161f", "value": "24576:MgjjsXHYxirKfpBDjN30gdI0N1Os58U6vmizlu3:V2yBdjN30ULOzmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648568704, "uuid": "0bb097d1-06e0-4941-982d-e97bafbefdd4", "value": 1297408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648568704, "uuid": "4d111902-4fd2-49a3-b912-d4a8f26224ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568704, "uuid": "04bfb5d9-c9ff-4481-bacc-4831e706973d", "value": "Draft MBL + HBL - #22E03SPE02030.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e64516b-af5d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648557528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557528, "uuid": "579a3a44-0080-4c93-8c1c-3b592f2b7590", "comment": "Malware payload", "value": "504cd296b179deb18a2d776cbbad53c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557528, "uuid": "3ed26fa5-1c8d-4058-b865-b7e3c03cab57", "comment": "Malware payload", "value": "57caca34e3b88b43872e32534bccf5292b7c8f8b7569fcae8f49a20a422cf600", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557528, "uuid": "1a370443-3b1e-4c5a-88aa-83b0624b1429", "comment": "Malware payload", "value": "4421a5d300681e56ec9e99fc2f63f36ab98597be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557528, "uuid": "89cde629-c701-43e1-b826-4d113db6d2a8", "comment": "Malware payload", "value": "7dcbe21f6aa62577d8da8547e4aa5fce61842c576e958c94bdfe5e029e8858a8f684fa857cf81711f5bcce3a4f974d79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557528, "uuid": "d4621626-6250-49a4-ac89-34c58c1092db", "value": "T16D446D5AA3E50995E9BBC5B9CD93D21BE7F234091A64D34F53B4CE966F03322B21C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557528, "uuid": "82f51ac5-8ad4-4e1a-a555-b3d41ab66d31", "value": "6144:1jOc9lLYJm9qCR8h2O1CCP1GzzBpbf7KWtM55QKMu:139VYJj0g2eCCP1GzzT7KWt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648557528, "uuid": "3ab7269a-2087-4a0e-89f5-c1be80f3e254", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648557528, "uuid": "44f08bd4-25cb-42af-94c9-7fcf35e01470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557528, "uuid": "4833acf9-9636-42f7-8b0b-13bebbedd021", "value": "d2c0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5d3d8c-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648561771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561771, "uuid": "93622735-85c6-45e6-a0fa-c96bfe5d3f9d", "comment": "Malware payload (Mirai)", "value": "bda1400205b861b3208ac3b62eeef778", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561771, "uuid": "b42ed3f4-0113-4926-bae7-1a0c5019bce0", "comment": "Malware payload (Mirai)", "value": "57da2b4011dff056b0b97c2a81c4990ca3f6870ceddaeb3a4af6a38da94e1d92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561771, "uuid": "a10f3561-2654-4d49-b656-5da82e78e987", "comment": "Malware payload (Mirai)", "value": "3419314611af8f85fdd74a0d2c034c37892d7fa6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561771, "uuid": "87f49e93-9e01-4a3a-a02c-6d954a178802", "comment": "Malware payload (Mirai)", "value": "0d409d09a70b42a1756f35541033d50b00bddb186fa61511755e29c641a8f0e4bdf505b2728f37e2a937bf0f29165518", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561771, "uuid": "794d7dd5-d992-4b49-a9e1-a2b499d25f31", "value": "T145D2E0E848506077E7F71836304F852EBB9FAC89B3DEA2315375DB84C689914638B84B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561771, "uuid": "8d0179e0-6268-4a94-b814-53a1f3a992c2", "value": "768:gOdInYJgbqZxj8d0j1VWfhdUnCnjdBxfjF:gOenbqjwwVWfhdUnGBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561771, "uuid": "f086776c-346c-4f91-b9d3-3f1edd5f265f", "value": 29636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561771, "uuid": "aedbc485-91f8-4a95-87d5-a1a4c8f781c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561771, "uuid": "37023038-c67f-487f-b27b-318a07585c86", "value": "bda1400205b861b3208ac3b62eeef778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bb22fc-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648536876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536876, "uuid": "9cd38c06-c30b-4a60-a2a4-df023fa75689", "comment": "Malware payload (Formbook)", "value": "217ad3d17a0016afa78c6c341ca6776e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536876, "uuid": "e2d20e9b-2c12-4b3f-a6dd-c83beb9ace42", "comment": "Malware payload (Formbook)", "value": "58747f28eb363c9252c741f95f82ba95fbb5ab7038059a6f01ebcaf1e71f798b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536876, "uuid": "5122d7cb-d467-4fa4-b986-95dab96c1a38", "comment": "Malware payload (Formbook)", "value": "b86651a479b7fa6e17709be222db96e4db4e9ac1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536876, "uuid": "92fbdd1e-d043-4018-9a44-345068ed998f", "comment": "Malware payload (Formbook)", "value": "2107580230be14426baabc49ef04339e42282c988dcc36e7eb7d46cc3ea13f251788ed859c9a206f4b7aff53cc2950d4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536876, "uuid": "b2d45c53-d27f-451b-a439-e2d5f7c77a83", "value": "T1D3141229E641B4F9FC338C3DB2D8E9E420ABEDB8F3DB5B451559312A4DB112A4E76102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536876, "uuid": "aba54dff-fe13-4796-a201-c96b73d93029", "value": "3072:LecD3PJUI4ALJkwYR+2glQGLQohceyTMD4iwBqepmbwYBLoqIdN3AIbMgA41S0ae:acjPerAgYlQgQyceGqecwGIz3AO9DaC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536876, "uuid": "f04c1bd4-b495-4898-8001-33373c0a5f2c", "value": 193624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536876, "uuid": "ef1116be-d3ed-4bdf-b822-bd105097aee4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536876, "uuid": "79395ce6-c993-488a-a026-9902c62b307e", "value": "ISF03282022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd71b0f-af07-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648520829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648520829, "uuid": "5f4b5b20-94e3-4a6a-a477-f07527e6620f", "comment": "Malware payload (AgentTesla)", "value": "cb8776792639413f4fdb735727df0a9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648520829, "uuid": "6ed47693-3872-442f-ba44-782201bb76b7", "comment": "Malware payload (AgentTesla)", "value": "59672e55ea0e69536f0acca8600ab4dcd4ee7d308853567b0bfa46ee0b97627f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648520829, "uuid": "7410d357-e10c-4529-8eab-112a246f22fe", "comment": "Malware payload (AgentTesla)", "value": "b582dd9871cee08c8c0162f0834fdf49defb3e22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648520829, "uuid": "0b6b7df8-48ca-458b-9fe1-357635179805", "comment": "Malware payload (AgentTesla)", "value": "b4dda33a8c758edd0636b3ba89ffe3020d14f8fd11c26b047c778fbc557b2cf4ab8cf5d8d045a5f8cbc79f71e7823f6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648520829, "uuid": "7a1c2620-fde2-4116-9b35-62343952a348", "value": "T1CEF4B3ADF2F076EFC857D0729EA81C68BA5175BB531F4103A02715A9DA1C887CF14AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648520829, "uuid": "8870cda6-2f7c-4993-8b65-502e8afa3031", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648520829, "uuid": "87d7a49d-ba1a-4318-8ae3-0147891261c7", "value": "12288:SA0vuuP1+h5klsDXi1ifQYlN+6mjX1NT5LQUL99+YHvAWhGfKoAnmdI/gjjLHKcn:SAycI/gjjZsQZ5zJeFfIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648520829, "uuid": "95bb8e01-d934-44b5-b5cf-5645d0a1c153", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648520829, "uuid": "eb4d875d-fca6-40c9-a87b-1492ffd4f744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648520829, "uuid": "0cba5bd0-1f90-417a-a8cf-57db900f8be7", "value": "Marketer Global Harvest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23204376-af3b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648542906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542906, "uuid": "d1ccabc4-0a2f-4cd5-8681-66cb490d8ee4", "comment": "Malware payload (Formbook)", "value": "08c1da8ba9db5112d19abf36c7887267", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542906, "uuid": "61baadef-f88d-46cc-8408-4ce866f30d2d", "comment": "Malware payload (Formbook)", "value": "59df4a1b740a668c3fab683f2b19b3178980e01348bc20db0cecc7c076c28b81", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542906, "uuid": "45d2904e-9cfb-4fb6-a40b-2c3e4943b49e", "comment": "Malware payload (Formbook)", "value": "0bc256ae6be8865b49c60427fe2f0218085e1037", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542906, "uuid": "fc445e56-505c-4e9c-b9f5-e49271f39a07", "comment": "Malware payload (Formbook)", "value": "f47d5927135c69f6fb311aab117eff40070db885aa4e505a27a9597ff0c058d5aff5784ff77ad6c087502c3a7b01204e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542906, "uuid": "0eb50a90-1c9d-4cb0-abe6-7f99a53fab39", "value": "T1BE75333524147E2AC1E3A8322DD1449A295BD4D53CC6C737BEA9FF0279375B2828C9DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542906, "uuid": "6fb6790a-953b-4177-b6fd-fc59d79163cd", "value": "24576:AEaNfg8zDPr738UFlvYo9Vn/I0sVYxsbVgPZ7SZhb6+4xNzVoTdJCxYwWhld5eoq:APPzDzT8M9VPLPZiCVG/IRo8lRYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648542906, "uuid": "ec67e8f6-1765-4557-8e6d-0e9fe2d58bba", "value": 1694747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648542906, "uuid": "250b56b2-8088-45be-96e2-572ffe2f4f36", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542906, "uuid": "18ec538a-fbbb-4d4d-8790-7d001ce890de", "value": "RSB Drawing AC Servo Aluminium Coupling Machine.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ab44be-af56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648554720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554720, "uuid": "2f4502a2-a4dd-4d77-8915-63d246c63b38", "comment": "Malware payload (SilentBuilder)", "value": "ac34e03673e3efcbbd51d48dc0fbab01", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554720, "uuid": "a49512f4-2a87-4b15-9c8e-ad858482b177", "comment": "Malware payload (SilentBuilder)", "value": "5af6359b5ed2e6c39d954872e2899038828e263a5a0e609759a14c5e6555b342", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554720, "uuid": "dd08af55-0ce2-4ddf-8c9e-aed682845947", "comment": "Malware payload (SilentBuilder)", "value": "2960aa394efa75d2053ded6b761e99662c01d70c", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554720, "uuid": "626ce290-ed87-4cdf-8335-4c3563f5aa59", "comment": "Malware payload (SilentBuilder)", "value": "cded2658cead6423f80a3c81268303ff2ddcc4543b4c48c2794fa54b20c8c62dba557c8a11e2f4a54b61037d604653c1", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554720, "uuid": "be59b696-df74-4da2-815e-d870d954fd1f", "value": "T195C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554720, "uuid": "268f6872-0e58-4c3a-b25a-b1e679a495af", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC4:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554720, "uuid": "c794f7a1-45fe-4c83-9222-e52a97c4f670", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554720, "uuid": "1e0cfacb-d441-4f3a-9065-c99af196ca46", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554720, "uuid": "8383be59-ecd9-425f-853c-491c767b983c", "value": "ac34e03673e3efcbbd51d48dc0fbab01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742c4622-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648537029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537029, "uuid": "313f0694-69e3-4617-8b32-6cbe8d9644ed", "comment": "Malware payload", "value": "ac28a108fca646c7d43e6eb2290479c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537029, "uuid": "4bbbe25a-4d2a-4266-b6da-4683afe03299", "comment": "Malware payload", "value": "5b191896f78784df613aa72526c34dde0a84a237057c9c08ad84367d1a914582", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537029, "uuid": "035f6604-6443-49b8-96fe-8518ec589811", "comment": "Malware payload", "value": "c7ac24ddaafb3483fca1386a3db6ab2b830a6813", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537029, "uuid": "7efe69c8-37da-496a-9da3-af70d8e2083e", "comment": "Malware payload", "value": "7accbaf99a723888920530dac0300a7efcc97023f8d9e99578cdfcb10237e2d283562b86f2db53a87b22bd54970969c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537029, "uuid": "ed7cef35-343d-4a0b-aad7-26983d78a5f0", "value": "T18F44E0D077F95692C2A6F7BA91C2525C02B6C1053E43D78A68F8126C1CC2BCE3E57E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537029, "uuid": "bd901d8f-6375-43e7-980f-25957f73a6e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537029, "uuid": "d685f356-96bb-49f8-a5d2-e52f09d95b0c", "value": "6144:TEBzihSlwZoC/Wt7SOZY/oqViOV8V8Dk6HWZ5Jqr:pijCsezoqVi28yDk+Wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537029, "uuid": "05aea85c-9b8f-413a-8ee0-aec773ce0f88", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537029, "uuid": "5f4ccf3d-b886-4be9-9254-02670f3bba7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537029, "uuid": "d92fdaad-7a5c-47a9-a2df-6c333185da50", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd812b4-af56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648554868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554868, "uuid": "e8cd4ff5-4cf5-425e-935d-aecc19bc06fd", "comment": "Malware payload (SilentBuilder)", "value": "fb7b96b283db44463f609a2037865b28", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554868, "uuid": "1d479cec-82c6-4d18-bf85-bda2c53593cd", "comment": "Malware payload (SilentBuilder)", "value": "5bac3bc0211a3fed363648e5b24e0665688d2036ddc66390168d9aa0bbda5b99", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554868, "uuid": "2bc496f5-0d7d-4309-b1a3-623b1dd0410a", "comment": "Malware payload (SilentBuilder)", "value": "868f51baba6ae5f6b8c2fb509d3b51a82ee84025", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554868, "uuid": "9a2966d1-a169-4bed-a857-eccebc338850", "comment": "Malware payload (SilentBuilder)", "value": "b45d15642fce284859f8cc9503210b66475690818b3ff60b66188ffb868dec2f0164a29ef16e19a056114b72f7c72c47", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554868, "uuid": "03cb7b9b-43ef-44c6-bc7a-0526492345e2", "value": "T1C1C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554868, "uuid": "82383931-33e8-41e9-a19a-3757792cf9aa", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC8:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554868, "uuid": "5a0cef89-622e-493f-bd5a-d1c8a47bcd3f", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554868, "uuid": "ea4d996c-ea6e-4a3c-a5ef-ee43b9d09bee", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554868, "uuid": "2a6114f6-ed61-4a46-94af-efd1508bb006", "value": "Insight Medical Publishing_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39adff1-af50-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648552222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552222, "uuid": "6ac2fa63-9e62-42cb-9154-c3c819cbad0c", "comment": "Malware payload (Heodo)", "value": "6aa79dfed5a72228f8d161ad949aafbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552222, "uuid": "f9d5a4e8-ec79-4e7c-9e6b-c321dae6c452", "comment": "Malware payload (Heodo)", "value": "5c03d2a0f7e85ae44d1690b68d849c331cf1e43435db79010638b49f3c39c01e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552222, "uuid": "2a474617-6ce3-4687-80c7-cb2efe837d05", "comment": "Malware payload (Heodo)", "value": "b2e862ae81061c2d93abc1e69a4ab69d61bf486b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552222, "uuid": "5d9966ea-f295-465a-bf60-57241f338de3", "comment": "Malware payload (Heodo)", "value": "bb9d324e4cded4f7700a4384026c7fb6b32fdd015a3c4a587d37d745164132791e99c27e477b4e026d7c15bbfccac56e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552222, "uuid": "a3081b59-1a7a-4996-b084-95327748165e", "value": "T122C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552222, "uuid": "82756f71-71c4-4e8e-8fa2-7627d2335be7", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552222, "uuid": "49a26450-0fb4-4cd1-8933-70c83d48431a", "value": "12288:iUV7ciwHX3ew9aYU3pzc9inFijaQeL+nZBb:UiMX9I5ky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648552222, "uuid": "fcc3c28b-0525-47cb-8c52-b5ac768c591c", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648552222, "uuid": "71f15552-0d97-4783-89e3-d838a1edf465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552222, "uuid": "dcd99265-0e56-41d2-aeca-c31db5a4016d", "value": "6aa79dfed5a72228f8d161ad949aafbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c3e5b1-af3b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648543253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543253, "uuid": "6d3ba275-7c24-4279-87b1-028b7d04a625", "comment": "Malware payload (AgentTesla)", "value": "976f76ebeda1d3bb4c28e66aa9afea51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543253, "uuid": "f3240074-e903-431d-b729-1f4cfc3990e0", "comment": "Malware payload (AgentTesla)", "value": "5c47acc274b44e92bb889f59ba4659e58d0d428003bf3e0c2de3ace7c224312b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543253, "uuid": "f3e3cb31-7c15-40d3-b263-448518b6d151", "comment": "Malware payload (AgentTesla)", "value": "26d0bc48d69b3524a60b863fafc28cf9cf2a5175", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543253, "uuid": "de659cac-6305-4bc9-9c2b-195e02fd49e6", "comment": "Malware payload (AgentTesla)", "value": "32ea8c5ef4d2588ce9f1d42274e6896301730130a58478cd74577e647a55742c2543a4ad2cabba33d3bc9840266b17d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543253, "uuid": "91e57412-7413-4102-9f7a-04cb55b156d8", "value": "T12863BFB91B9E42EEC083F939CC5E42878B245E095111873B7A717D48BF2F5E7274AB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543253, "uuid": "91106eb7-96ce-4d3f-8715-7f78e2a4a8eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543253, "uuid": "d7cb8ca7-7226-4529-aabd-3a90846f6971", "value": "1536:fyErerqjoqGnvlyr+CwaMYONe+b3SFu1AFNGaX9cd:xXotntK+C7VieM3SFZNt9cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543253, "uuid": "8d7c5ddf-faf5-4c3e-b6e2-a7d460143297", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543253, "uuid": "fb58ffe8-bdbf-4f4a-9369-371bfcca1c79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543253, "uuid": "29939a28-cc55-4833-a6f5-b538a228cfe7", "value": "976f76ebeda1d3bb4c28e66aa9afea51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16bcde3-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648573290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573290, "uuid": "65102e5f-8133-4c52-b4aa-9d95630f9822", "comment": "Malware payload (Heodo)", "value": "ca53553349ad1ad8d269febf1b77cb4b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573290, "uuid": "0c0075e6-db79-41b9-9a2d-7fc792f6dbe8", "comment": "Malware payload (Heodo)", "value": "5c98f8551a19c97c9ebd5cc5a5b07fbc6b9b91e0aca679029333c70da513df68", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573290, "uuid": "dde00d58-f1eb-47e5-aec4-e984e0b07643", "comment": "Malware payload (Heodo)", "value": "34772e52458f7c45b1b122d9e16c12bb47ed0385", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573290, "uuid": "d1539a34-1878-4d4b-9278-3273d89eaf14", "comment": "Malware payload (Heodo)", "value": "a0cd3073e6bb5cd64ea1a9d34c802cfa9af98a2b8c5a6e26850d401bf2ea8848775ac3cbc2c5669df766922ba811cdd6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573290, "uuid": "e8b8ef1c-df7d-4a22-ad2a-cd40a2fe3a1b", "value": "T121B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573290, "uuid": "6fbb7cfc-c2ea-489e-9803-4f556539f447", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMK:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573290, "uuid": "77288cb2-516e-475c-8959-e6ce54797b06", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573290, "uuid": "d24f4906-0741-49c1-ab26-dbd5b6e04a21", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573290, "uuid": "1e1050c9-ab20-4855-a9b7-5d5373f127ce", "value": "ca53553349ad1ad8d269febf1b77cb4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6bfa8a-af4b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648550010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550010, "uuid": "04a7fda5-885b-40df-aaa0-e807120bdb52", "comment": "Malware payload (Heodo)", "value": "49d73e33d7e4e756c8aa1774a3557447", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550010, "uuid": "ed21b294-df4f-4495-a5d8-7d3f9b058fca", "comment": "Malware payload (Heodo)", "value": "5ce1b840a408fddaae1d38245033f780e949755d2caa8beb8ca870eff684a7d7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550010, "uuid": "c5d03aef-bb6d-4cc3-a064-e08d1372d923", "comment": "Malware payload (Heodo)", "value": "43e1466afef6f1ed9608d0e3978924b483454b78", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550010, "uuid": "f485e52d-a5db-457c-9a50-959f5f29f478", "comment": "Malware payload (Heodo)", "value": "58af3008b98409be3bb8fa205f1a8729e867d4937bef13990d149a83caa79476ce76991f6c64f3554aadad3a18f4e237", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550010, "uuid": "d198fdb8-e6aa-44dd-8e24-57d447d19c99", "value": "T156C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550010, "uuid": "46bc8c7a-dcec-45a5-af92-7647c4320e52", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCs:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648550010, "uuid": "c8e19470-3533-427c-bd42-783bc4f153b8", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648550010, "uuid": "6ce4a0ab-3d78-4a94-9860-57c1af12048e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550010, "uuid": "cee50ce5-28b1-44d6-b6f4-2dc368d2e9a7", "value": "Scan 2022.29.03_1209.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fead39-af27-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648534435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534435, "uuid": "c5c8d47e-95f0-4efe-9125-735bc3b051a9", "comment": "Malware payload (AgentTesla)", "value": "e4811eda428dfa5635509116afc4e0e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534435, "uuid": "a231494d-16d2-4614-a818-7c2b68c63e7a", "comment": "Malware payload (AgentTesla)", "value": "5d0a8a5478876026ee661b50518e44f95308bf20e1e512c3608f97f97aed3384", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534435, "uuid": "3d71b036-b00c-4816-bd69-45d5e54971e5", "comment": "Malware payload (AgentTesla)", "value": "1d5c7fc84dbbd5c3dedd4483461e135ec5c8e620", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534435, "uuid": "859e897d-6934-4f99-b351-30b26b8e6c8f", "comment": "Malware payload (AgentTesla)", "value": "477406b338f61ad87ad69361d61d49172d404c9b1e23907fc821cbf875493f111c38e02a7990176b6115bbd64ed65e30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534435, "uuid": "46bb1554-dc1c-4eb0-863a-ce71f8950c15", "value": "T1E7A4AE803A61CECEF7794234306F575FE456AFA1699648BF03377E940BFB6861B4A021", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534435, "uuid": "27918794-8341-4daa-a2fc-e8aae58ae46b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534435, "uuid": "29cd874a-9ee9-4f52-8082-23730e21948c", "value": "6144:NbE/HUgowqvX3MD2Nm8VmTGKCEmSMmTTdxnjNJC1XZrmuLLRDj6IofnXgy5Mtf7:NbZnaQmgmTGtZdOoZL16IofnXgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534435, "uuid": "600e1f9d-cb85-4a9b-b261-48264ac2707d", "value": 488861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534435, "uuid": "0833ba2d-4f61-4ffa-8ecc-107c6e148849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534435, "uuid": "6ac01014-c857-4de4-80c2-e52f7872b475", "value": "TT8543489876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aae3aeb-af3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648543402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543402, "uuid": "bf3946cf-ffe7-4c34-8bc2-c6e1b19963a7", "comment": "Malware payload (AgentTesla)", "value": "12cf6c125a22c65b0e515dfbfc73cd61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543402, "uuid": "4e7984c7-1854-4745-ac3d-f10aedf5c5e2", "comment": "Malware payload (AgentTesla)", "value": "5d44448d9368f5ec2b3594446bca10ae98f173176a4e9a55fd239c3c6d9c6edd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543402, "uuid": "09c85711-db62-473c-b7a2-34c6c6910c65", "comment": "Malware payload (AgentTesla)", "value": "d82411456a13dbacb62ef72bcf392b5648709f69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543402, "uuid": "9d09b5d6-67a0-4d9b-bf0a-b3c957cc35fd", "comment": "Malware payload (AgentTesla)", "value": "18380192032771622d8731263e29be0f135e7027c7a0c4435dc21763222faea658ada1c4836339658e717fa7b7aedb7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543402, "uuid": "59e8e1cd-8ffe-4f97-a399-3005cb4c2a0c", "value": "T14DA46C07398089DCDE6A81F7B617818433D9D8BED25CA7087BC873935EE1FA14826B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543402, "uuid": "b97c2518-ae6e-44ce-9b0d-70c3c6bc1b24", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543402, "uuid": "d50cefc3-69e5-44b0-9b3d-1467e1b3c441", "value": "12288:EN1NWRwWcI2Mwomfyvw0l8OwxPBcLDNTd4FqR0:EN1NbWcI2MwomfyvwyuQxTxR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543402, "uuid": "a6fa489f-7f55-4fe0-a517-98f7689d4336", "value": 487352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543402, "uuid": "93de5024-795d-4920-981b-ecc99597a337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543402, "uuid": "76c3ad5a-47fe-49b8-9a91-bdb11fb8e37f", "value": "Enquire_#29032022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0941d448-af46-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hydra)", "timestamp": 1648547587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648547587, "uuid": "5c3aad0d-1ff8-43cc-ac42-5d7bb909e75e", "comment": "Malware payload (Hydra)", "value": "cc75c64449276f37f147f7c8f5589e2c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648547587, "uuid": "db232f6a-22d1-4214-b11c-c0e5e19300de", "comment": "Malware payload (Hydra)", "value": "5d6268d44f132574165ca78264744754186028c289fa37afeaf510fd0a0047f0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648547587, "uuid": "7836d14c-4d15-4478-9dfe-900a3663612b", "comment": "Malware payload (Hydra)", "value": "d9e3d4a4f84ebb8c544e37ad470ccbf51f358007", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648547587, "uuid": "d8bf7a2d-33a9-400a-b769-38c4a24eddb5", "comment": "Malware payload (Hydra)", "value": "7843514f189d437a32be568730eee41ea22dde13bd76d3da15959a9c1dfbbb00e7e7a622b8314d8ab063bdb80f4a04fd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648547587, "uuid": "e48f7f1d-6e9a-4328-85fd-318ab8f8135d", "value": "T1311633D6F3D0C966F972ACB01499F1AF83390ED41A95E2533B21F999447BC8833724B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648547587, "uuid": "694e0cd5-9516-4005-b227-f703135b4658", "value": "98304:+B7U8HoB4K3pPZG05dPXvsG9u3QS5OqsTMHGzC6jev1TvJ/C:bvxPZG05dfkv3QsOqsTYGzBjwLJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648547587, "uuid": "463400e1-b18a-4608-9b63-70b3ada9e301", "value": 4126471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648547587, "uuid": "a1833085-a57b-4142-bacb-ffe4b1405c5b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648547587, "uuid": "1d41ef76-7ff2-43e9-b35a-2cc2ac362157", "value": "coba.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594f1af2-af55-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648554164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554164, "uuid": "11d76796-a72a-4a67-888f-dd7c44ff4c22", "comment": "Malware payload (Quakbot)", "value": "b46220104f17a172417a86a9cfc677fe", "object_relation": "md5", "Tag": [ { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554164, "uuid": "56cc3e62-98bb-4e18-b04f-241ca7b21d2d", "comment": "Malware payload (Quakbot)", "value": "5e7cd461086edf8d84c13861836614e7882e182fa6bf52c868f7af38fd649682", "object_relation": "sha256", "Tag": [ { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554164, "uuid": "48ea5b72-7435-416d-a1a8-c1837eacebd7", "comment": "Malware payload (Quakbot)", "value": "cadfb0f375d962367567a9b717cf55af5dae2834", "object_relation": "sha1", "Tag": [ { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554164, "uuid": "07d53ba7-4866-4e7b-a14a-6f8a30058076", "comment": "Malware payload (Quakbot)", "value": "3fb8a8a8286b78dc51e0ae0a86a6a4df2ee2ddb9f3dd177d385f4a59fb32515d2655fa5d97fbcfa6aaa09b7b78a04c66", "object_relation": "sha3-384", "Tag": [ { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554164, "uuid": "2065ad72-b00c-440e-a23e-8ce46dacc8e1", "value": "T14A6512318CBD5153D9F24239616006B3B71830BEC5F0E17F6E8797D91A3749A86AB0AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554164, "uuid": "c37eda62-b42d-4818-955c-f41360059d83", "value": "24576:64A2/mzQP5R96N7CmYFxAaaGgF6yXJnH4fIgEtOzx4fIgEtOzB4fIgEtOzz:kRo/olkqZGgtCdEt6OdEt6+dEt6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554164, "uuid": "972b7aa3-b6f5-4f55-9faf-7d30940a8717", "value": 1491417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554164, "uuid": "1789fae9-b6d1-4f82-971a-152ca7ef53d5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554164, "uuid": "2d0c43a9-31af-455d-b3bc-d8ab5923fa58", "value": "NFT-1042555268-Mar-29.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d9f5ef-af5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648558052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558052, "uuid": "a582afdf-7062-4587-9706-1e2abdbc9e5e", "comment": "Malware payload (Heodo)", "value": "fc80e5405724a8675401caba7f354c1e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558052, "uuid": "10406155-d40e-4205-89dc-1765a5480966", "comment": "Malware payload (Heodo)", "value": "5eb46927e22c166855803d987aa0fee87d7c949d7e2883543daf51e5964eb9c8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558052, "uuid": "3aa1f8f0-08a5-49a7-8a3d-8ae3de75ba5c", "comment": "Malware payload (Heodo)", "value": "debe1e1ae392cef38146f2928b14577efc202530", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558052, "uuid": "fc948e0a-4d31-4868-a74f-0f98d2ef00f5", "comment": "Malware payload (Heodo)", "value": "7d6d3d2c1a6efa6295aace81d9ead759c307545ad68dd71cd47af7a34899cb91e20fe4895c30542ee4bca3ada3bad75b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558052, "uuid": "d1c561b3-6dd7-4884-aab4-891ea9954f6c", "value": "T178D45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558052, "uuid": "6aae2478-fe59-4a88-bba7-7bf3456c0d25", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558052, "uuid": "7df42222-46f3-4555-93d1-c744c1df9aa0", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzvipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wIooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648558052, "uuid": "9ef1713a-a617-4c1c-8205-dd3823150fc5", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648558052, "uuid": "93819ff6-6f41-470a-8d7a-463d4b1b711e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558052, "uuid": "7ac36f7e-7f68-4bc3-90cf-b7aeefea99e3", "value": "s8otv87or0QO68T1n88.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2d6af5-af35-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648540504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540504, "uuid": "5d0e3e52-9489-458b-ae82-a830dc00cd18", "comment": "Malware payload (njrat)", "value": "bafbec6e52341ecd4c2ab25cbf27a54f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540504, "uuid": "776265e0-ab22-41a7-b074-a00420a2a061", "comment": "Malware payload (njrat)", "value": "5f858efb1604c4eee1e8c487cf5c8af9da44055530e5d20692bda0fa42910851", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540504, "uuid": "a5235b2b-7c9e-4807-948e-2d1f807923bf", "comment": "Malware payload (njrat)", "value": "7014f6b3dac8f421025b191c99d2136089aafd52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540504, "uuid": "213a64b1-3781-43a1-834e-41ad2b406d74", "comment": "Malware payload (njrat)", "value": "622e28e5c7002f97b98ee8bddbaa5cca0279cf73e83934ce4017db2cc633c04d9d9482cefd7b8dec6442078ff341ee97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540504, "uuid": "ea69bb2d-bed4-4107-be22-02e76e85d331", "value": "T1A723F7467BA58219C6BC6AF89CB313110772E3878532EB6F5CDC88DA4B676D00641EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540504, "uuid": "4ea446ce-3ff9-4daa-b3a6-47515f96c491", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540504, "uuid": "01733b2c-666e-463e-91b0-aa98eaebb0b6", "value": "384:X0bUe5XB4e0XjODeANuiEO0Ya7WTwtTUFQqzFvObbU:8T9Bu66guiEYaJbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648540504, "uuid": "acf8debd-f35a-4243-8fb4-3ba61d538b03", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648540504, "uuid": "fc84d55d-3493-41ce-aaf5-449250b7b063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540504, "uuid": "fcf684d5-2d23-42fb-94fd-e95028a31d53", "value": "5f858efb1604c4eee1e8c487cf5c8af9da44055530e5d20692bda0fa42910851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46d5f3a-af1a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529084, "uuid": "cc9abd91-553d-41ef-8e66-1e99bcf3822d", "comment": "Malware payload (Stop)", "value": "6cdf7490e40ed2d7e0b764f6e2b69b79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529084, "uuid": "90f27347-3b20-4cd9-81f6-135b0700204b", "comment": "Malware payload (Stop)", "value": "5fd67e4b1a89e08aa02b8bf4af770eefac4b25f55081ed9ee2c21adcca23547a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529084, "uuid": "78d170f5-e301-47f3-8395-cda766c25ca3", "comment": "Malware payload (Stop)", "value": "7aff4127b398510b048ffe06e82cfd55ef2ac2d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529084, "uuid": "65b39618-cfa8-4a0d-a46e-e7216e1c2dec", "comment": "Malware payload (Stop)", "value": "647320676acd6dd168407c3766b5d48647334260757fd8c5d9559c9a10bf801fd8c75464a014250deebbc5f925c81787", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529084, "uuid": "2c916c2b-d5a8-4cf8-a59d-b4406fb1f15a", "value": "T1F205F100BB81D034F1F766F4497993A9B52DBDA05B3491CB62D46AEE4634BE4EC3032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529084, "uuid": "9db26c9b-4d6c-4171-b53d-65cf4f587919", "value": "c5abd0d249bf5319619ab44b6b97960d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529084, "uuid": "c46433d9-9914-48e3-b9cc-7c5a08d44fba", "value": "12288:ReEjeVmmSeUoedf3dkX69Gdd6XkAvrubk5zd16UIhhArwqMhiTVkz4HBVVBhSexv:RHlRoSx9GXETvancoWVkIBdhvYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529084, "uuid": "0e41b79b-dae1-4692-b49a-6bdf2b8e4c1b", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529084, "uuid": "27bcb2a3-ab20-44e3-a52c-128552bfc28f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529084, "uuid": "1c875a7d-f86f-41f0-8b65-81de3cadcae6", "value": "5fd67e4b1a89e08aa02b8bf4af770eefac4b25f55081ed9ee2c21adcca23547a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73b3a73-af29-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648535397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535397, "uuid": "fc492541-c542-42af-8e10-504b89f01751", "comment": "Malware payload (Mirai)", "value": "bdcdd579e1a81546a931d1899bde12c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535397, "uuid": "1fe949b7-1bd4-434c-8c83-794b375490a8", "comment": "Malware payload (Mirai)", "value": "60b9052f710525b38ee6daf0c0ae9218263f6bc8ea003c3c7826d7f2cfaa5fd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535397, "uuid": "80bbfcfc-e0a0-422f-8b71-e277db48b16c", "comment": "Malware payload (Mirai)", "value": "08333690d3ef38728333b9d4a85403a97677d059", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535397, "uuid": "65d1e0e7-822b-4f4c-af54-fb7432086e31", "comment": "Malware payload (Mirai)", "value": "73a4397170effadc38b1db64948fc5179a71bded0ebe81034d479ca9d5bddac3777e72db17b0f9299352340442eaeb1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535397, "uuid": "3f66a8c8-b349-4a6f-a315-7c3351fd49f5", "value": "T1AF832AB81996F63CF9F250B5F45320EA28610A1C379CE1E3B9836476FFB47087269D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535397, "uuid": "86d76888-032c-4aa2-b852-230495f671e7", "value": "1536:RFsqdPA6xChpzOWYbgABeaGxHv1/WGQ9hyAhdgYaVu:Xdo6xIz7+BeaU1/W3ycg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648535397, "uuid": "ce577e00-3b83-4e3b-9ad3-de586540a021", "value": 83396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648535397, "uuid": "a6fe008f-5d93-4942-aa73-1498adb38697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535397, "uuid": "0057777f-77ab-4ec2-b9c8-38be8b93f6f9", "value": "bdcdd579e1a81546a931d1899bde12c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34d6bba-af30-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648538477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538477, "uuid": "192bd8dd-2406-4f95-b6df-c03e8eecf544", "comment": "Malware payload (Heodo)", "value": "a70c70a6f65c945a7a6ee7470f3bfbee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538477, "uuid": "aff3a0b1-0a0a-4ec0-a268-34de178de7a6", "comment": "Malware payload (Heodo)", "value": "60d2fb31fefd9220c818b123aab0dfaf680ad1ffb410f1f2b9a74ad1dbab76f4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538477, "uuid": "1b6dc650-f92e-44bb-894a-43e7e4a543c4", "comment": "Malware payload (Heodo)", "value": "d77d413661a131a2a478b583d7cb87fe64b69d2e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538477, "uuid": "9e59d1ea-81a1-4de6-9c89-998b99fe7f8d", "comment": "Malware payload (Heodo)", "value": "853acbc78a31a37b088144b66d3ff55c98bdfdbf15d4e94b4699606d2c424a16ece8ca971a8e7325660deb2bb2a34e43", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538477, "uuid": "a37a2f7b-cbdc-4c36-9bd2-facaa35c93eb", "value": "T11DD45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538477, "uuid": "8f7b7d01-c7ce-4146-b9b5-13c769d0fed8", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538477, "uuid": "a1c0daeb-efb6-4617-be27-15d07822068e", "value": "12288:J1U8sNY8/z0rYebzwdBCoGEAbcVBLku8w:oq6z0rYcMdBVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538477, "uuid": "d628f8e2-b170-4eb1-b030-b20d9270799f", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538477, "uuid": "882fed1c-8b6b-4ac7-9ee3-b2349ba4f474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538477, "uuid": "18e4ecd2-a209-4379-a342-b6c649bb3f74", "value": "emotet_exe_e5_60d2fb31fefd9220c818b123aab0dfaf680ad1ffb410f1f2b9a74ad1dbab76f4_2022-03-29__072113.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326eb2c7-af52-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648552810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552810, "uuid": "ad6e0405-cc63-43d6-9c5d-000eda8005a6", "comment": "Malware payload (Stop)", "value": "45ca1387140ddd67c34e158e1d336d9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552810, "uuid": "7dd329db-308e-43f7-baf1-d9d962867277", "comment": "Malware payload (Stop)", "value": "610cc309ef1470210e8cac4b9e275ca08d1aa5253b3855b423b5625c835538d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552810, "uuid": "9def7702-a950-4ee0-973f-0ac1cb593712", "comment": "Malware payload (Stop)", "value": "4023b412980ad653fc25c9eb746b306a66405f14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552810, "uuid": "60cbffc2-322f-456e-bae0-19edc105cd8e", "comment": "Malware payload (Stop)", "value": "fc7e58b95adb7528b38cabde574d87560d524f5a4012c18054816ef47a230ecb586b570390f4e874aa69a76e1f2a0804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552810, "uuid": "9c748728-89da-4f8a-9674-72e529f748cb", "value": "T16205122278D9D072D2211671941DCFF1392EACB558342E736BD83A09AE362D259B13BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552810, "uuid": "eda4f271-d21f-42e6-804e-3a03dcfc45ee", "value": "8ee4f2cace7854793aad420556d77bc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552810, "uuid": "162737f2-5f2d-49e5-ad59-e307df62625c", "value": "12288:r/Ofw2dzh0yDrXUKEoSUSR3KlkuWfDBQwFr/dznSAlum/5R:r2Y2dzVXUnoSLR3KyhfDBQ81DpQm/5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648552810, "uuid": "40247418-45b7-469f-afa7-eea675389d65", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648552810, "uuid": "94e617e6-41cb-4c88-b353-1a19cfc7e5bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552810, "uuid": "600dd82e-e31d-4c59-8a2e-12fc4530f969", "value": "610cc309ef1470210e8cac4b9e275ca08d1aa5253b3855b423b5625c835538d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465aad45-af8d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648578184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578184, "uuid": "117bf5b7-a6b4-4af8-b8aa-328111eb6e0a", "comment": "Malware payload (SilentBuilder)", "value": "b8ae25d74e3be2c56b912bd52376f5c9", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578184, "uuid": "b3984b71-f372-4d8b-9c6d-941c34f96b1c", "comment": "Malware payload (SilentBuilder)", "value": "6121550710d668a4b80ca4f056d91829e4a793dc1a04fd52c9ebd937b02fb685", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578184, "uuid": "ae38a9eb-2b20-4843-89cd-5a5021a92a26", "comment": "Malware payload (SilentBuilder)", "value": "5de86b6a67c29207f2652c38834ebaa6ec4fdcc8", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578184, "uuid": "e1a2e2d0-588c-4ec9-acae-ec73a1d0f2c6", "comment": "Malware payload (SilentBuilder)", "value": "514a4e5ab6dca0f45798ac80f6af44ca4ff36d9c0dfcc022f31cf8e23b0724c4c645468de7c94207e63cac7c08847555", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648578184, "uuid": "75329f1c-34c5-4551-af0a-5a566019b381", "value": "T176B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648578184, "uuid": "47f8297d-c6b4-4390-a4d3-a0c3bfeae453", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMF:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648578184, "uuid": "9b617602-5bb2-40f8-a5f3-f8b649ef9a0f", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648578184, "uuid": "1cf5faa4-e028-4748-9c52-287310502339", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648578184, "uuid": "7e6e07b1-8d68-4e40-9f0d-b6a3a5dec092", "value": "b8ae25d74e3be2c56b912bd52376f5c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62376ba9-af5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648556327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "96330731-8848-40f1-a8f6-e899782f698b", "comment": "Malware payload (Heodo)", "value": "362a46c54a5d9d0d1964080f80bb7d14", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "d84dc27e-b5a6-4ec9-adc1-c56fa56239dc", "comment": "Malware payload (Heodo)", "value": "61330bcffa1b670bba5bb2e42e9a8f0021b9ef880029414f93d883387945afba", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "56a82e31-a368-4045-9aeb-6ccb9ff60fee", "comment": "Malware payload (Heodo)", "value": "bc65ea4fc6085ac63ca221c0e853c9ba416dd7bd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "4d39ed0a-8434-42ed-9470-979b2e932654", "comment": "Malware payload (Heodo)", "value": "1a9a6dc999c18cae45c370ac771522182d778e849fd54507c4925a5af7039b917a352ab3299a2df8fbef24b12981494a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "47007fad-1b10-4374-b256-2d3389e459bd", "value": "T17AD45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "0e486d54-31e0-4974-a06f-a3dcaecd7f96", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "84f3b80c-becb-42a3-b34d-3a8ec1e89f48", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzdipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wuooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648556327, "uuid": "b94ee7fd-519b-4596-8213-f4f96d931106", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648556327, "uuid": "640aeef3-a41e-4627-b7ac-30a721a65e3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "43ffcaec-3cd9-45c9-bfe0-ae40d2813939", "value": "emotet_exe_e4_61330bcffa1b670bba5bb2e42e9a8f0021b9ef880029414f93d883387945afba_2022-03-29__121838.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbeb01fb-af62-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648559940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559940, "uuid": "d42d89e3-ade4-41fc-b374-41f40be9bab8", "comment": "Malware payload", "value": "e49203d2c37a21f17d9891952fd77b6e", "object_relation": "md5", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559940, "uuid": "e6168365-91fa-485b-9c52-27951fa170e2", "comment": "Malware payload", "value": "619c4dac5eefa6da38c736ec60a8b47aeb752c0dcb05c77156892507a828cc48", "object_relation": "sha256", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559940, "uuid": "df0b298c-c0b0-43f7-a592-d9eb1852e5ff", "comment": "Malware payload", "value": "8c76903f4b32a20cdede28cc63dec5d87054080c", "object_relation": "sha1", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559940, "uuid": "23d1589d-ba10-467e-8095-1dfee5f4b9dd", "comment": "Malware payload", "value": "de84b441c520c7ffe601887d43d0421565857f1060c4bd31d950be65d765f6e83330c899ceef3f86f88fe12156fc1aaf", "object_relation": "sha3-384", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559940, "uuid": "9cbcbdda-d02e-4dd9-8630-f3c4857b7137", "value": "T12E741FC55A8DC9B9CB2FB45853099C57CECED329262DD8C1ABE32F0935238B875789C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559940, "uuid": "c3fa4f18-8c77-4f33-b03b-6c6c8546ac6a", "value": "768:j4rx0W/xBbB5/tIGy/R/xdvDJZPsddsMuilelVLMkEVT6+IFbSLgCSGX4Wb/tBJ3:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648559940, "uuid": "b7c43c97-cd6c-4026-ba5a-3bfec5bbd52c", "value": 354506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648559940, "uuid": "4893cc7f-a638-4149-8a72-9892f128c8e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559940, "uuid": "d09db4cc-fe8c-4c4d-aebe-709bf2ab9264", "value": "Mv5B6NCi.dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018effec-af57-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648554876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554876, "uuid": "83f57fa6-8b72-4cfd-b201-a84e5b776b4e", "comment": "Malware payload (SilentBuilder)", "value": "2fe1e82c441189394222fe04a14d3d9b", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554876, "uuid": "159f1c35-4baf-4e7c-947b-10082d87e927", "comment": "Malware payload (SilentBuilder)", "value": "61bf0ee6dfb8defcf09576bc5111123a0f1ffab4fc3eefbd3c0834844e4cb970", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554876, "uuid": "2d1756e0-10f2-4ce9-87d5-d5b29d941894", "comment": "Malware payload (SilentBuilder)", "value": "dbaee2fe908e8f5438a64851e7522fe657b6d0d0", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554876, "uuid": "7c4468f1-89ca-4dfd-b325-5f14250804ca", "comment": "Malware payload (SilentBuilder)", "value": "f478ae9bc3e3b573727a417d6d1a983bd4c4ebc187074d9abb68537cb5f1e2d481daf134809e53ed5522ec54ff127b1a", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554876, "uuid": "9b1271a0-7a2e-4994-bdde-9d3ac9bfe4c1", "value": "T131C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554876, "uuid": "a75d6ab3-2999-4496-8318-29dd88fafa21", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCM:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554876, "uuid": "3863ac57-f6ea-4e85-b9d5-199ee9913448", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554876, "uuid": "228009b8-771d-4264-9986-cff4d2ad1060", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554876, "uuid": "6bb17397-7a15-455c-9faa-2077b4f698ab", "value": "OMICS_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cbd3b1-af26-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648533977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533977, "uuid": "b54f849d-22b8-4b25-8f72-cdec2140ae26", "comment": "Malware payload (Heodo)", "value": "63220f7c81e6c5ac439d2107ac1967e9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533977, "uuid": "1ff61d37-28d6-4ab8-840c-d4e83ac04ebc", "comment": "Malware payload (Heodo)", "value": "61e430fa1d6c7abf73ceb5818279bbbf4f0567d2043d1cef77e6cc1f4c9db934", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533977, "uuid": "5846f54c-5446-4e59-a8d8-fd6388cfe5f6", "comment": "Malware payload (Heodo)", "value": "da08e94e88de5973b1fefbbf249fe6bb74551a55", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533977, "uuid": "2a7cb64a-d496-40a4-a31f-faf17e62e52b", "comment": "Malware payload (Heodo)", "value": "860fa592ef10ff4bb4082236b99e8fcab52b829a54f7b870b2d8e58ca96df42a0566580858dc61b75f98c31765607cbf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533977, "uuid": "3709151e-b289-49ce-b886-ed9192b35b82", "value": "T198D33CC1A765416AC96A45703D6DB4B6E7A85CBADF398EE793E3DD8D28331C0083111F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533977, "uuid": "7ab0ac5a-585a-45de-894f-d8e3a852ccc0", "value": "28570bd8351c62f6e0c8e6211e57a6e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533977, "uuid": "22727b51-b6f6-4577-9e32-e317a692cc9b", "value": "1536:ow/ilkCX+Ks7iA/KQVVQDIoCc/Nct37JfTxRp1y53XbQAorvXGiF1:owalRy7iA/KQVYhi3JUXbQ7rvXbF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533977, "uuid": "69dda167-5583-4d72-9d88-ecc83582b2c2", "value": 139377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533977, "uuid": "0baab007-167c-489c-a0ad-add403b64b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533977, "uuid": "fcbb6461-b8dc-4c96-8674-e90edf4e188c", "value": "g3j89ri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3dff60-af64-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648560850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560850, "uuid": "45014e2f-c4af-4fad-9582-965dee2bd266", "comment": "Malware payload", "value": "8ea4c131b4a7889c99b8a794ff11f478", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560850, "uuid": "d4bee8b3-358f-4e86-811d-6516f01d667c", "comment": "Malware payload", "value": "62386f487825c3dd99ca120087ca362a3389654575b7e429be560715099c2382", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560850, "uuid": "91bdb490-8a4e-4a0a-ac79-4c7121c91f33", "comment": "Malware payload", "value": "ad37c2867bbbd082e58cf9a64899fdf29d00b9ca", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560850, "uuid": "c7a7b7ba-e600-4620-89e3-b35bdff194e9", "comment": "Malware payload", "value": "2b38991062ccd5187076491b91e081c2e571fc75ce26f2f8bde0ea07d5d9c47d6104d920d203ea9a73955b3b67ddcb06", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560850, "uuid": "f3b15fe9-4cf3-4cc8-82ba-e272cf243e5c", "value": "T1AE831204EEA772B6FA923C2CCF9C41DD6DE0AF5F3B44A980D31B84038BAD5585749D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560850, "uuid": "05079d2b-3a7e-4f45-af20-f027636da481", "value": "1536:o5gE3Lq8LDlzmDnMU/ZTGR//As/s2PmJyyWMTf2Q1+pNa4fG8CvfYkfZxkcimiG:9DPSdEf4Mr2zpNQjfxfZxkJbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560850, "uuid": "c045961c-8777-432b-bfd8-1ac1a6dcc9f8", "value": 87135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560850, "uuid": "c3c9a106-1871-495a-9233-dbe426449443", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560850, "uuid": "713eb9ef-0ceb-49eb-8331-3dabb88c0df1", "value": "N.975 DDA 29.03.2022.xls.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749b403b-af24-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648533165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533165, "uuid": "c99fbe8c-2fea-4b42-af8c-a0470a17b681", "comment": "Malware payload (AgentTesla)", "value": "e8f264251b4faba39664525d1ac47a8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533165, "uuid": "3435cc8f-9dda-4ce7-8d00-1502adcb6f8c", "comment": "Malware payload (AgentTesla)", "value": "62974ca6372fcbe3211175922e621f5f3331e6529b0bdff421b9592caf1886af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533165, "uuid": "8f8d1239-214a-46b6-b963-a83a68f5fbde", "comment": "Malware payload (AgentTesla)", "value": "b4fff47f47e8e7c9104f383c2d7dc94ad5e82622", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533165, "uuid": "613ed6db-2208-437e-a1cd-3ecf2f2a6a27", "comment": "Malware payload (AgentTesla)", "value": "f57999c8ff08e24658f165c66dc16d88e343c09c7f4c5f6640852ec03eda69bc51285c295daf80f976336c45ff088124", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533165, "uuid": "21685bd6-3e4f-4f74-bc55-d0ac340dcfb7", "value": "T16225E999F2E075DFC857C4729E589C34BA107DBA531B4103A0A739AEA97C493CF14AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533165, "uuid": "68265b39-2862-4562-bd0d-a60b5c60389c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533165, "uuid": "6ddf0f98-fd77-4292-8e58-b0ec39daf1ac", "value": "24576:jEdgjjQa7cpGY1Ym2c9X5nMMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMMMMMMMMMMMR:QMsnJefcjMMMMMMMMMMMuMMMMMMMMMMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533165, "uuid": "9759fa0d-1379-41ff-a947-63d3b79f9c90", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533165, "uuid": "facea0fb-6042-4705-8e7e-2ba6545bf9dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533165, "uuid": "6bf7ae4e-6149-4aad-ab64-51c35f5bc6d4", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a0c1fb-afae-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648592408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592408, "uuid": "c8a4af78-ed68-4850-8fd2-a7031fa2fa4c", "comment": "Malware payload (Heodo)", "value": "8eb461d662b36ced8f1c169845ae2366", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592408, "uuid": "71fda433-0edc-47d9-b202-900364c28d28", "comment": "Malware payload (Heodo)", "value": "62b094d107529f9d76b6884e278677c794df2144fe1bd7e595e0c4ad181729bb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592408, "uuid": "446566fa-b833-412c-a0ec-230283438e98", "comment": "Malware payload (Heodo)", "value": "0e9c6fc0872d0d3e6dd525769064fe35d2c0bf1a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592408, "uuid": "cb10e6d2-d01d-456f-9052-8b914d4d15fd", "comment": "Malware payload (Heodo)", "value": "76404b4af3164c9c5ff4585ab512819839d767b541d360258f42b6c61e9110af00f42370589d3606c53cfec4f25cdf1f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592408, "uuid": "6b23a2c5-b74a-459d-bfdd-9874c0b7e994", "value": "T143B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592408, "uuid": "b2b15e87-232f-4401-82a7-95ccd20b36ec", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMC:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648592408, "uuid": "05006d7c-d013-4286-bfec-d2b362cf1846", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648592408, "uuid": "1d2a0512-f75c-4b95-9f4d-9034212ef8b5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592408, "uuid": "a8d1980a-0500-44d9-ac9f-46a310bf734a", "value": "8eb461d662b36ced8f1c169845ae2366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a46a072-afa6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648588821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588821, "uuid": "d8564049-fbac-42e4-b770-2249710c98f5", "comment": "Malware payload (Heodo)", "value": "af28becdfd69352851ffee1fd49315c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588821, "uuid": "f7160a2f-d78d-441c-9cb4-25d529e81791", "comment": "Malware payload (Heodo)", "value": "62cb20ac94835f385f526475040b94e09f64dc8bd6d66d0bdf912d204380e829", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588821, "uuid": "dadcdb4c-62ee-41ea-9795-c3cf8a64436a", "comment": "Malware payload (Heodo)", "value": "2cdf4e8ff1bc51c256af71979a9a9976d97e26e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588821, "uuid": "80aa4fa9-02be-482f-9064-bc9218868d9a", "comment": "Malware payload (Heodo)", "value": "dc955ea41bf999b8b7b94dea7507da1001c44aac96cd9bdd17c3622dcd765a2686ce867bbf92aed8ba0624a8306c0427", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588821, "uuid": "563504e3-05bb-4626-be42-887621d2607d", "value": "T146A49DC87582C132DE7B4B75C552CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588821, "uuid": "ee265288-68e8-45fa-a97b-d675e02f7f7d", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588821, "uuid": "e634d695-632d-4ecf-9fef-1e62ae78716a", "value": "12288:myXvaWo3sPddfrkkEpBLsORdPDpFlrh5W:F/as1dDkHHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648588821, "uuid": "141a1f33-f514-4977-b333-690c705ccf92", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648588821, "uuid": "2ec166c2-3c10-42e3-84f2-c4b5debc4754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588821, "uuid": "e05dc118-db51-48ee-aa1f-05d015afd067", "value": "af28becdfd69352851ffee1fd49315c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62145566-af5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648556326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556326, "uuid": "05ab2442-fd73-44c9-b467-855b54687b54", "comment": "Malware payload (Heodo)", "value": "26a000e9c1d513a2faf0d5c260577f9b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556326, "uuid": "7bf27761-b041-4560-96f8-9aa65c91ee47", "comment": "Malware payload (Heodo)", "value": "62cecf2097383a7d64093334ffd026ce0c1f55b5ef11570a7a7d57a8b9d4318c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556326, "uuid": "375fb67c-b075-423d-a390-52a1980c423f", "comment": "Malware payload (Heodo)", "value": "ceeb7593f139504b59967193e9674790faf27196", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556326, "uuid": "7a309d27-fa25-4c09-a00f-6ab4796fe794", "comment": "Malware payload (Heodo)", "value": "03cc0ebc035341b232da9d975e5ad6e74763f54767ef208481b75fe36816e5a7dfb858bb7415634f898501e4ab5da6ee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556326, "uuid": "43716d43-bd91-47b2-b0b3-58150729bfcc", "value": "T1D2D45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556326, "uuid": "bc96f51b-fb45-4a53-9554-bef37691dde7", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556326, "uuid": "56484b12-877a-41f6-984a-f3dcbf0ee0f6", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzkipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+w3ooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648556326, "uuid": "0e6eec03-b9c0-42ba-91d9-74ce8bee1cca", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648556326, "uuid": "ee16da7a-bf8b-428d-9128-1491ecf887b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556326, "uuid": "69cb11f0-e1b0-4c69-8e2c-16126880f436", "value": "emotet_exe_e4_62cecf2097383a7d64093334ffd026ce0c1f55b5ef11570a7a7d57a8b9d4318c_2022-03-29__121836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5415cdf1-af8d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648578207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578207, "uuid": "ad494e85-03c0-48be-9abb-8453eb637e91", "comment": "Malware payload (SilentBuilder)", "value": "78794ffff84e62f0340e887dd56a7cb4", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578207, "uuid": "5f84acf6-d1bd-4618-ba4f-d7f067a89456", "comment": "Malware payload (SilentBuilder)", "value": "6314a9734944ea69ee02ced6cc24f83056ff0da1015053c9fa674b74bcd3f26a", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578207, "uuid": "d0421634-8270-4646-8024-f89be8cd7653", "comment": "Malware payload (SilentBuilder)", "value": "858d1b997f989c20f81bfa6e83214d37b01edbf5", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578207, "uuid": "baeaa658-96b1-4c8f-93a0-3c8b1db47dd9", "comment": "Malware payload (SilentBuilder)", "value": "216de1c686aa9a0125b74e5062f3026ff9cb27377cfa12a97217f4b2de0786e5e2e1eef1a0ca8bc2ff48cd93bcdb11c2", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648578207, "uuid": "3e143928-d977-4aac-8636-b7e821994262", "value": "T14AB39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648578207, "uuid": "10663d41-f212-4d68-a405-fb9948c252f6", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsM9:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648578207, "uuid": "fa373cee-2e72-4d23-b08a-e551539d7c04", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648578207, "uuid": "49313934-99c5-442a-beb4-896c0c09c391", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648578207, "uuid": "1db82d9a-6708-4408-8176-07b8281bb951", "value": "78794ffff84e62f0340e887dd56a7cb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2158d4-af32-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648539274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539274, "uuid": "6bff3dbc-45b5-4f2b-a61f-3ab7d61db7b5", "comment": "Malware payload (RedLineStealer)", "value": "69ca2205558f5aa3302f2fe44408f616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539274, "uuid": "7ca5823f-7f0c-49d3-91ca-e801e64b5b56", "comment": "Malware payload (RedLineStealer)", "value": "637950b77e37851e2b5792d5071c0637084cb8591a12323ee5af12f674866e6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539274, "uuid": "806ed274-b4cb-465d-8421-568645441883", "comment": "Malware payload (RedLineStealer)", "value": "bee8033e0c7d26b6a1c540453fc2ef611274e642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539274, "uuid": "0b2cd3ca-4870-4088-a161-47d027468b27", "comment": "Malware payload (RedLineStealer)", "value": "58f35bcf87be4c3fa50a849fc56e4aa82c6db34d0851b00d9551b1dca8bfac60681f99cde7befded8368b5d47e4c585e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539274, "uuid": "83416915-e3ef-4315-8392-54342137a65c", "value": "T1CED423E66D792259F8D4F271079FA5B46C932C2C893C2A6A138260361DCF170376F67B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539274, "uuid": "19b9ac3b-b6ad-4589-9bfc-4e50b9875902", "value": "2babfffbd5912113c1d9039821a842b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539274, "uuid": "5eb18988-408d-4d09-b18d-7d18b4e2e046", "value": "12288:xdiILu/bUnaJaTcxadS++Dyvn7AIxXFYl1WbU0A0D9VS55s0AbPKiipb5JBunn:vpcbyIaSTS7AI7Y14zPj0AbPz0rBunn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648539274, "uuid": "46dd4e5f-6a74-413b-8b4f-e5edb046143e", "value": 613752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648539274, "uuid": "85c5f4f4-cd0e-4862-8842-9db7af8eb0c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539274, "uuid": "1ed4b269-9e7c-44cb-a02a-aa58e8a1b391", "value": "69ca2205558f5aa3302f2fe44408f616.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab29e8b0-af78-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648569334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569334, "uuid": "4c4fe556-63e6-4576-abfa-4dbb66e28ea3", "comment": "Malware payload (SilentBuilder)", "value": "9e1a3dc4e5dc84c07cc2be8de9b54497", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569334, "uuid": "7caa1637-cb57-46cb-82ab-af499d82bcd0", "comment": "Malware payload (SilentBuilder)", "value": "63bd32a0fe469f74ded0c05b18cd562e671cf5d2655ccdd9b54ed62c92004750", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569334, "uuid": "20b0161c-95ef-476a-b2db-6abe800e2405", "comment": "Malware payload (SilentBuilder)", "value": "8ec0da8f78f918ae6b87cc94ddb440e59695ce0e", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569334, "uuid": "7ca6c6a3-ceb6-41dd-9e05-ee0e64d4f25c", "comment": "Malware payload (SilentBuilder)", "value": "d657f903562052040e48d299b19b3a06a1b4a445c5f701f47dc0a006098ffdc850beca4dd2a8cb3be380add3ba3e6d64", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569334, "uuid": "6b43c0e0-07b5-40fb-a808-d4223c41abc7", "value": "T1AFC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569334, "uuid": "48262e43-7d84-4f35-90e8-ac2d7a795e2d", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCY:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648569334, "uuid": "d39f922c-cd60-40c3-8972-80670d3fd570", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648569334, "uuid": "809e9f1c-2d7b-4fef-82d0-9de1f5ddff8a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569334, "uuid": "0c9e134d-c9f5-48c8-9f99-5049ff31824e", "value": "9e1a3dc4e5dc84c07cc2be8de9b54497", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a90ffc1-afb4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648595022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595022, "uuid": "5d57f36c-7884-4b54-9365-52719c3eabd6", "comment": "Malware payload (Heodo)", "value": "b7d12067b824e51fcc0e5228cce84283", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595022, "uuid": "e608386f-99b0-4259-9e5d-c4853ff920c8", "comment": "Malware payload (Heodo)", "value": "63d4fcc51abb6b6d64a21ca3912fe0a84c9cfeecca8a1f3862bc07578bbbd84e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595022, "uuid": "b6d0d3b2-c3a1-425a-9262-d07ea4493f9d", "comment": "Malware payload (Heodo)", "value": "cdff217e2fecfe48889e689dfc3d79f647ecf20c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595022, "uuid": "df43b3b5-b96a-490a-9fb5-16ced22d6a62", "comment": "Malware payload (Heodo)", "value": "948da53b2f4262d9f2950f80e4d193f1f13eaa70774be7850519ba57e37d505e76bc8ed32fc850bd47242b57b81120e4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648595022, "uuid": "23c13fd3-4417-400c-953d-401d9ffb9194", "value": "T1CEB39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648595022, "uuid": "e2eeb71a-3db3-40fb-bc14-e7e6781eefa3", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsM+:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648595022, "uuid": "9cfe4b0f-11dd-4c0e-b2fc-d57000603cce", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648595022, "uuid": "fb78b6f9-9d61-4fe6-8bcb-d31d606f0a32", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648595022, "uuid": "5270e26f-dc4c-4589-b545-77ae112ba28a", "value": "b7d12067b824e51fcc0e5228cce84283", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705ae56c-af49-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648549049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549049, "uuid": "751a3d6a-0ae3-4c3b-a896-4bd5baac1321", "comment": "Malware payload (Heodo)", "value": "d9f0b98b4634763ac3cdf86f566da1e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549049, "uuid": "bd343e24-d66c-4e9e-96a6-ee19fb1b5bc5", "comment": "Malware payload (Heodo)", "value": "64bbd34fd6fb5717238c8e9142cf6d6cc42654d4e3ef316fbea5952c7747dbc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549049, "uuid": "f87b899c-2558-4d3f-9464-d54fb9f7d878", "comment": "Malware payload (Heodo)", "value": "afac9b6d8cfca1f46c0a1e69aa515758cdaf2241", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549049, "uuid": "ef25041a-30c8-4814-a965-f8e9b2d9714f", "comment": "Malware payload (Heodo)", "value": "630a7d8ea5b8e27172f5f002e7a7ad91d0159ee9a8eab10e6b66cb3f88b192d0d50f991453c09b5a85fe88e3f477a8b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549049, "uuid": "64bdd10c-83ea-46bc-a05e-1c9dd0e076b8", "value": "T1F0C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549049, "uuid": "fa10b041-eaa1-4945-aef5-2b20b1871682", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549049, "uuid": "b0da55c7-4e15-4503-9e97-5549d81ad2b0", "value": "12288:iUV7ciwHX3ew9aYU3pnc9inFijaQeL+nZBb:UiMX9Ixky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648549049, "uuid": "00a303c7-ccfa-4c53-94b6-a1796e140376", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648549049, "uuid": "dd50da59-7f2d-46f3-91ab-d29f2098d941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549049, "uuid": "2845a984-54d4-4b06-a832-523434fd7030", "value": "d9f0b98b4634763ac3cdf86f566da1e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4eb106-af73-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648567217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567217, "uuid": "905eafc6-a79d-4c6e-a931-376ef9bc6c12", "comment": "Malware payload (SilentBuilder)", "value": "d3a0bc263cbc38a26c27e05cd0a7d7c4", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567217, "uuid": "3e2fc807-ef60-4672-a12a-d031bc4d7573", "comment": "Malware payload (SilentBuilder)", "value": "64ff6ca63f3a58420a58577c161c851f078d9c95466f97a6747e68145fdf590b", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567217, "uuid": "cd32fe8c-f186-4589-a023-d0eb9b13159f", "comment": "Malware payload (SilentBuilder)", "value": "7c2b26ba96fee6a05e79ce03f525a13a8c820fde", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567217, "uuid": "77bcc80e-0f55-4520-8196-4369250c38d3", "comment": "Malware payload (SilentBuilder)", "value": "210d0aaa263e6d2831009c4cee351c3352b5caf94019e4a8d6c4c8364e80d6d4a31b55d2c700b1e7b591290723296e5b", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567217, "uuid": "994c21b2-6487-4cd0-9c93-fe916d232e88", "value": "T148C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567217, "uuid": "82d783d7-b581-4770-9220-8ec2c864754e", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCI:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648567217, "uuid": "852f59d9-9409-4ab3-ad03-f0c31ec97484", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648567217, "uuid": "e7055181-417f-44ba-bd86-08a4d7b0c41d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567217, "uuid": "adfe9fb5-5bdb-4dcb-95f8-3d5c35ed6b93", "value": "d3a0bc263cbc38a26c27e05cd0a7d7c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0459f0c-af68-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648562578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562578, "uuid": "ee82f6ca-a891-4e4d-ae1f-5ae58a80a516", "comment": "Malware payload (SilentBuilder)", "value": "b2727050b8540b0de8cc7e25cb61dc80", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562578, "uuid": "01958a65-51e4-4b11-9eb6-8330e1fb965c", "comment": "Malware payload (SilentBuilder)", "value": "65c22cb7a34b3440d28675d2b3b926b55004765609e52e3c099ab823e6f4ac69", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562578, "uuid": "c5292608-e9ad-449f-837e-37e528397b78", "comment": "Malware payload (SilentBuilder)", "value": "0965b1664174123160c59aac230b5646ae550932", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562578, "uuid": "22846458-f2e2-4904-a271-62a609f9f78f", "comment": "Malware payload (SilentBuilder)", "value": "6fd4dd635b911e5be11434635e9bf17056d6efbca007f26172912f6480a6c6ad0c0feea2c50898577a82ac766206784e", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562578, "uuid": "cf9337f1-2f5d-43c4-bb98-86428ee516cb", "value": "T134C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562578, "uuid": "cde426a0-433b-477c-a328-53305ae4e337", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562578, "uuid": "a26f85f1-de73-45ce-89fc-b2d492641e7e", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562578, "uuid": "58ae15d3-7ec3-42db-8e06-3b1d68e1e221", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562578, "uuid": "127cd0a6-9263-442a-aaa9-a73e33113834", "value": "2022-29-03_1531.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d4c674-af35-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648540675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540675, "uuid": "3c6c95fd-eacc-4558-a581-e44fb669dff6", "comment": "Malware payload (AgentTesla)", "value": "27857b97ab2f31b61d894ddba16d1328", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540675, "uuid": "a10245ca-1a8a-4b3b-a08d-fc4aca4b7b27", "comment": "Malware payload (AgentTesla)", "value": "65c8b6833078b6593de327d1b16a9dfcb020eb272a902f86ee0bb26bb3dc1609", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540675, "uuid": "a55cc8ce-f8fc-4c1d-94df-6215dd0ab680", "comment": "Malware payload (AgentTesla)", "value": "45eba90029285687a56be0821cbaaafd8a434a77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540675, "uuid": "2e0dcc17-0337-40d3-9267-f6a9c2b208e8", "comment": "Malware payload (AgentTesla)", "value": "05e77e7e2960929afdb39cce59da7c054366e32171eff1a172d8d7fec11bedbdf63bf6e20b2c654de7e4e07338d40956", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540675, "uuid": "405a07df-8dd3-4cfe-acdc-f1c20b8f8563", "value": "T1FFA42307F3BD1A4014C546F84AC28CA2CF907D299FB91B78657D7BCE2C5E1AADD860D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540675, "uuid": "90612161-4a94-4fab-9431-d26e35bc1e37", "value": "12288:LYUCHS/ElMU9hYL1CluNsW0sPK5cWFslt:LYUCy/Elr90Ylwf0Hbgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648540675, "uuid": "29ee699b-b4c6-4235-b407-ac30376cd7aa", "value": 451580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648540675, "uuid": "326b25a1-5538-43c9-8f39-758bb5dcd552", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540675, "uuid": "48b199b0-2795-425b-83f8-231b5503dc94", "value": "fattura richiesta offerta 00223848885 03292022.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0ca449-af71-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648566440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566440, "uuid": "4aaa2dc2-6910-47f6-8c53-37c4e05630d0", "comment": "Malware payload (Heodo)", "value": "ecf2c4a14f891fb3b09e3f1f8d53f35f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566440, "uuid": "42e7b22b-23d0-400a-8603-938b87fd6a46", "comment": "Malware payload (Heodo)", "value": "65cb61155f04597306d3d063ed292605790a5dca2c616422756b23ef4d5c18df", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566440, "uuid": "91e45a8c-7daf-46ec-8db6-315c92aa3835", "comment": "Malware payload (Heodo)", "value": "cc81ec1c9c2ed4f017740bdb530dfaac47013e90", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566440, "uuid": "bfa92fca-7b0c-4a9e-9892-38409e9b4057", "comment": "Malware payload (Heodo)", "value": "52a52d11b32436a22ccc34d0406c5f74f2fc4fce54f8afa605e103159915f4f03e28a2a19927190c6f335134584e0926", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566440, "uuid": "e1a5c31d-a575-4b05-8f56-d56d0c7560ea", "value": "T1E9C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566440, "uuid": "08b420e7-6fc5-4621-b934-1866f137234c", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCM:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648566440, "uuid": "1777e1c0-d2d5-49ff-a51b-fb3e5d7782ed", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648566440, "uuid": "c9039108-fd45-4c11-9772-bfd818deffef", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566440, "uuid": "976a43cd-c243-4f50-a5fd-ea2c5281888c", "value": "ecf2c4a14f891fb3b09e3f1f8d53f35f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3a4a00-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648573198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573198, "uuid": "caf8dd30-08f9-40d9-a454-cc7ebe1a5cc8", "comment": "Malware payload (Heodo)", "value": "b11c3dbb57a5cfdfbd10052e644c0d02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573198, "uuid": "bfac9e1a-20a0-4585-bfdd-916abf9f255e", "comment": "Malware payload (Heodo)", "value": "665121ebdd5ad9b1bc7f0bdb95b504f6b7609a8c910dd029da8681a217501a3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573198, "uuid": "f6594e31-7e3f-46be-be47-9d8ccdda0f0b", "comment": "Malware payload (Heodo)", "value": "a9f65d0d1b7751272075fafafc0f1b6a32f9c802", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573198, "uuid": "f41b733c-a4e8-45d1-9b28-9b8ee2350623", "comment": "Malware payload (Heodo)", "value": "d785a510d4e5f1dbdfdb9c3f605dea059ee9fefbf14a8b5ff38c250bd36a45b2beb14302fae00bb53dc63e1a9d21cf89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573198, "uuid": "74e63a29-e01d-4be6-8396-90eaf18313a5", "value": "T11ED45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573198, "uuid": "cf6c8e42-b4da-4b55-bd19-8277895bbe0b", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573198, "uuid": "0b061249-8b4d-4322-ab99-7f7259e2c1d2", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzCipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wVooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573198, "uuid": "e988ec5a-8e2a-4e5e-aa90-e739fa5917cb", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573198, "uuid": "5091935d-f39e-4546-b244-0302cc893f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573198, "uuid": "fc9d8a19-cf87-4b73-99b6-bff7a4a61dea", "value": "b11c3dbb57a5cfdfbd10052e644c0d02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8c44b5-afa6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648588830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588830, "uuid": "8af95614-8ff3-4ee0-87f8-42437e25a2c0", "comment": "Malware payload (Heodo)", "value": "22c2fd63f5c4207410c0b57d4f162874", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588830, "uuid": "0a807be3-5ec6-49a9-af08-2b9b67783acc", "comment": "Malware payload (Heodo)", "value": "669f9ad8103c54bd889002ba6093c893797c6b014586c9604b3be129b5220c93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588830, "uuid": "e2f1afd5-0823-4ee7-83ee-58fe7a2d9f1b", "comment": "Malware payload (Heodo)", "value": "3df3e78e5da02f6dca1903406b7b0ea92495e3bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588830, "uuid": "a97c6eb5-e175-4722-b9e8-f5ff37efc935", "comment": "Malware payload (Heodo)", "value": "df2a90378d7c3b740f422459fc09d6679b2c3be888a7ef1761beeda3c5001a90c046fbf26d1099c89f6f6d63b12b686b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588830, "uuid": "07f922eb-94f1-4ff1-9029-b4f8fa68c8e7", "value": "T1A3A49DC87582C132DE7B4B75C652CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588830, "uuid": "11e84d11-8237-4f0f-bfe3-201c05295ec9", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588830, "uuid": "355a8379-8f26-4b3d-82d9-396ebdd756e6", "value": "12288:myXvaWo3sPddfrkUEpBLsORdPDpFlrh5W:F/as1dDk3HRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648588830, "uuid": "e7c36d24-1fe8-49b2-8be3-d44cb118ec80", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648588830, "uuid": "81502806-9d54-4924-a361-98f24a994810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588830, "uuid": "6101af8f-40b1-49c9-a0f1-ef0c68b99e94", "value": "22c2fd63f5c4207410c0b57d4f162874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f45c99-af25-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648533455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533455, "uuid": "d59269e9-640b-4711-863b-47b9366ca883", "comment": "Malware payload (AgentTesla)", "value": "ead3be0296efc3451f39c12c9ee911bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533455, "uuid": "37fd6b3e-583e-4c29-9fe3-6e411eb77082", "comment": "Malware payload (AgentTesla)", "value": "66a7d213e8166b9d694b89f5cb0f6b09bafeccfbaded873d64203c4ceb8ada86", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533455, "uuid": "cda8b79e-a290-40b0-9204-0670587b1eb0", "comment": "Malware payload (AgentTesla)", "value": "2e26a85245593f0fbb3df21526b02edec9b08861", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533455, "uuid": "70e3285c-a90f-4d63-9169-997724c52613", "comment": "Malware payload (AgentTesla)", "value": "b75ac4a0a516449a369da57f2c0c704a72e1a2ac9222818b0dea87afc5ab1a6fc1e13c33e044fa6eb096448b57916844", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533455, "uuid": "d40eccf3-9c2c-4291-994f-122e5c01eec9", "value": "T163D4D02677882A22C969277A0560E47213F5FCCB3A10DB0E3DD57B9E7A76BC16B11703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533455, "uuid": "5e52099d-d7a1-443e-bd91-33a31a2ba8d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533455, "uuid": "f8ef83a2-d5cf-4083-b520-e5de2c40b340", "value": "12288:JSUIKFLwSlRQMG+eRqGluK7mVnShZlNl3/3UoibhWn9/4wUmOZ6D:rGPO4nV4wUm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533455, "uuid": "ff949017-f6f4-4352-90a3-fcfb6863db6f", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533455, "uuid": "5e0cff5b-8cd4-44c7-b105-1e0ae481a947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533455, "uuid": "d74c8d08-919b-459e-bbae-6e3ee7fab254", "value": "DHL Delivery Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5e957b-af78-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648569306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569306, "uuid": "73198c02-6789-4561-9ebf-060a4ed6a885", "comment": "Malware payload (Mirai)", "value": "4c3a2cab2bf2a1d5dc783302bd52fd86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569306, "uuid": "93cb1b0f-de3c-4daa-aec8-431886561b7a", "comment": "Malware payload (Mirai)", "value": "6753d5fa90f64d8e7228207e1015e361aaf59892ce0e839a8e5f2ef5fce54b64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569306, "uuid": "76f89f55-8cd0-442a-9100-865975c83492", "comment": "Malware payload (Mirai)", "value": "16baa474eb7984878ae784600a7e90786f2642dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569306, "uuid": "c2feafce-60a4-4ef5-a5ad-d5def4f6f725", "comment": "Malware payload (Mirai)", "value": "28a9e2cbe40ce9ec4d4bc099280f351f0a6d79860f5c422920a365d4e79d03059c9bf12bc60219210a9e8b38b869aeae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569306, "uuid": "00ed30d7-65b0-4f78-b51f-88cfa0086b1f", "value": "T12792C0D0509A1C73C2A81C73F3FD8A064A53597DB4F2F378699592A8F18A80EFF6E441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569306, "uuid": "fe00a36d-674b-4bbd-ad96-ffc2cb1bc93b", "value": "384:U9OObbU7fsuSdSUVpa6m+SHaR3p8uQ43YSBXsmdGU5EL6:U9OOMDsRpVpJfYaRZOoYiXs3UA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648569306, "uuid": "8cc1647a-f603-4df8-8160-177e1f473702", "value": 21100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648569306, "uuid": "a9cc115b-0f07-4369-85dd-69c83efd97f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569306, "uuid": "ee736ab5-39bd-422a-a791-5061060eb665", "value": "4c3a2cab2bf2a1d5dc783302bd52fd86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0541f393-af26-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648533837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533837, "uuid": "f16ae1fa-9e6b-4872-ba6d-3954d309d100", "comment": "Malware payload (Heodo)", "value": "df8a979b21f669ef46e6fa9e1eb4de91", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533837, "uuid": "f9e3bac5-2efd-4d97-b217-b90f88ff32bf", "comment": "Malware payload (Heodo)", "value": "6824c06f886155e7270d8bf1114f850c95ca06f92fafd3a9795f9da838508fce", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533837, "uuid": "804caad0-3f39-4e58-af9f-b1ada58306dc", "comment": "Malware payload (Heodo)", "value": "bbb3a94d211bc2acb6df5d3e86587d0327a96d4b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533837, "uuid": "b0d70502-3347-4b2e-97a4-c273fa9063c4", "comment": "Malware payload (Heodo)", "value": "12a8572609456f6b0ac408a76906ff0f20e7b2275e07b70d4bf26bcf269c5ccbd5bd2b8191687d5c7ee5ea1e9d64fbe2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533837, "uuid": "161d8add-3ead-4c51-9a86-10daec446dc0", "value": "T16E746DC237E180F7DA6255313EE386466779BC648E328A937354BB8DEA31AC3E535740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533837, "uuid": "4711a5c6-73fa-40b3-9f5c-552e97c4a821", "value": "72b3528e45595fafbd5f24ce92204592", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533837, "uuid": "24242279-7efb-4b10-9768-4cff519bff0d", "value": "6144:2PHIFvHxVBxWrhtOjMcD+t14e13gvXr7fa+CYSoSiNX:2PoFPxVB0r/OjMciV1yja+3hN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533837, "uuid": "b22ad17f-b441-434d-9189-6de75582c826", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533837, "uuid": "b4715083-e0c0-4e7f-950d-1c2547474245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533837, "uuid": "84c05298-353b-4b8a-85ac-fe0d9dcb2ceb", "value": "4afsgcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec138f3-af6c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648564079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564079, "uuid": "4f3185f1-006c-4850-98e0-f507f0e8a5cd", "comment": "Malware payload (Heodo)", "value": "0d794aa8d3517c54ef39fea651ba0dea", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564079, "uuid": "661d6276-95f8-4fc1-8b36-36ee566ffe87", "comment": "Malware payload (Heodo)", "value": "684e1f019f9df837cea277ff2923f54e1b602b7091e748207554f2376b8b4fc8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564079, "uuid": "4ae5e9e4-b183-4bb5-bad3-078886a63249", "comment": "Malware payload (Heodo)", "value": "79ac991a2f7a3f7edc5a9d7dcef679d9f9ce508c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564079, "uuid": "acfd3ab2-e918-41eb-b891-bdeb05451101", "comment": "Malware payload (Heodo)", "value": "d2153b4fb4489a8c1a745297fb1d4add3e78dee03c8dbb68210b0c54eb2f5d151b922d56885665dd44cd6303a370322b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564079, "uuid": "b53ce217-fcff-4816-a426-de57979b83cc", "value": "T103C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564079, "uuid": "0e1b3e25-0f2d-4c34-b0ed-3383c6f5f29d", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC4:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648564079, "uuid": "def44478-50f1-4902-8ab8-3805d090b01f", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648564079, "uuid": "7b55afd2-153d-4fbd-a1e3-fdbb561faeb6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564079, "uuid": "6b26178c-612f-4d5f-ba42-659431a2d771", "value": "Angebot-UVTCI-148582662.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a9697b-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648536064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536064, "uuid": "b2234892-dc4c-41eb-aba3-a6c8758bd554", "comment": "Malware payload", "value": "faa07a8d96c3e85b83e81ac8f0992724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536064, "uuid": "df369dd1-5492-4943-b048-e8a6689c98e6", "comment": "Malware payload", "value": "689e0f8852ccd6a64d3255618606a2fc90cddf09993d8f441b685a8e02108b03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536064, "uuid": "89cc8e64-af86-4574-9ea3-939dde57fbf1", "comment": "Malware payload", "value": "ae7425573a8288ec3569d4babe1572e2f4340801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536064, "uuid": "3e1e39ee-7b8a-4a4b-af19-0764f043a178", "comment": "Malware payload", "value": "35fe39a2abf2d20afb9512c753ed7f1497b0aab92a76c44d01f158f835a1408f8d8742140fdffec440c8fe23f7fa07c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536064, "uuid": "c676c39b-f925-4fa3-9ce2-767d70fa5c15", "value": "T111431883E7C48712E8140970653B5E681B3BBF8AEE43750A21DCF51A1EF63C59D22967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536064, "uuid": "b02082fe-b6de-4dd5-935c-29c8f9e0395c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536064, "uuid": "cd5aaf32-c035-45c5-9e83-7aaea30788e8", "value": "768:5RdmOj+tyVVkvwgQxis56WBCfYTQwP0Z//a4aOgqxsisoxEo7E:fdmm+tyAvRs5zF0jaOgysVQEo7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536064, "uuid": "aff94d3b-63e0-46d8-891d-dd38c8c23b69", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536064, "uuid": "e133199e-261c-45b8-823f-8b37bc1044bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536064, "uuid": "58ea930c-7cab-47fb-8ac1-c22bc42141cc", "value": "kesh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8f6083-af53-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648553447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553447, "uuid": "fc490bbc-5ce4-4d50-b30c-10c42bdba435", "comment": "Malware payload (Heodo)", "value": "0c4248cb24808ab268806ec605779267", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553447, "uuid": "ac05b5d2-993e-4d22-887f-9dd0cc0d1926", "comment": "Malware payload (Heodo)", "value": "68ae9bd4498bd077c5e0200bef2aa21a028e4cd90587d80788b9cb7955b35b81", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553447, "uuid": "4699e14a-0fd2-429d-9e34-3e96e44546e5", "comment": "Malware payload (Heodo)", "value": "c45416c861388f836846aa22f0ad27155cb38634", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553447, "uuid": "3e9f6d10-55b9-4475-956c-ea63b373d605", "comment": "Malware payload (Heodo)", "value": "6568b00427475514ef2655d9fb0c6384700b06a8c2b8febabf4a0abe869412d0aea7b3b30357734d810f4eedc6e63839", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553447, "uuid": "8fcb609f-8f16-447e-a4be-44789be7d605", "value": "T19AC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553447, "uuid": "eac14af2-bc63-4732-a7b7-66b150006786", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC8:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648553447, "uuid": "f5947d03-4fe7-4e92-b227-b9dd01c862cc", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648553447, "uuid": "8eb1d511-09b1-4b57-aedb-656bce8fc253", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553447, "uuid": "45341180-096d-45fb-bfad-34bd38c9866d", "value": "Scan 2022.29.03_1312.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad50183-af37-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648541309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "fcc871ab-684c-4422-b141-2b16e9c94323", "comment": "Malware payload (Heodo)", "value": "b10d0504d8d45be6d708f1b04f843b04", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "f8e10537-735a-4d41-8add-b77dd1dd20e2", "comment": "Malware payload (Heodo)", "value": "68ce8f1ba2c3df70f2adea3f70eb06c6b8d2573fddc41c9c4914a7e6cdf31174", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "3fde013b-42d7-4593-a3b7-a12cbd689d1d", "comment": "Malware payload (Heodo)", "value": "21f5545e9506031780a89c5992bcf7357d72f5b6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "55431cd5-9f22-4ada-a969-3a14cc290adc", "comment": "Malware payload (Heodo)", "value": "bdad7569309172a62cf10fbad412b722c06bc6d1cc5eb021c3f64fc5525c9c70ed7bfc5519d236f4386208d7b19cff3e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "ae780d8a-0fb4-4432-9c1a-fb0f0204ae83", "value": "T1A2C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "78d10d27-3069-4ecc-87d3-1aeed3317b4a", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "956e7317-f107-4dd9-a1fb-654cf467437a", "value": "12288:iUV7ciwHX3ew9aYU3pPc9inFijaQeL+nZBb:UiMX9IZky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648541309, "uuid": "7f8d19d5-7ffb-4858-a5d6-dc73c893ac81", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648541309, "uuid": "20063e42-b772-47be-b494-610a7cd30d48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "a68593f0-b0a5-4c12-b5d5-2a42f932e6b9", "value": "emotet_exe_e4_68ce8f1ba2c3df70f2adea3f70eb06c6b8d2573fddc41c9c4914a7e6cdf31174_2022-03-29__080822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f37629-af3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648543282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543282, "uuid": "ad31fc95-e33a-42b0-b776-b7e50da2bdff", "comment": "Malware payload (Formbook)", "value": "73e144cdb1a974a75375ff9c829dd3c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543282, "uuid": "4f2916a1-deee-442f-8361-8d8c72345317", "comment": "Malware payload (Formbook)", "value": "695701749b6bad9594632b7e6e653c8137bab9ac214c89ace77d06b72f3aadff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543282, "uuid": "fc986979-f55b-4e63-8d8e-5e97be1121f6", "comment": "Malware payload (Formbook)", "value": "e80aab34755cdfd8f6d9a83409cccc4526b93511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543282, "uuid": "4a815a97-286c-4b63-8b73-f4b47bbfc8fd", "comment": "Malware payload (Formbook)", "value": "b70858a441f9a477998f6c233b89e5c4d1b91f2fe5f02741abcab455ce8015aba5f96a00e4168c30c1075f8fede15b35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543282, "uuid": "83ce59b8-f21c-4524-beff-5e0ec9f4a225", "value": "T198657B993250719EC467C972CDA81CECEA207C6A5F1FC207A053369D993DA9BCF146B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543282, "uuid": "3c8ff049-d1e1-4f19-bf26-918a66b7e8e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543282, "uuid": "441f36bd-96cd-4183-ab67-50a56d602166", "value": "24576:YCrhGIJLSKRMfQhoMGrffzYjNcvmSk2eDVnMPQYm1QrPrbra/:rGAqconDkj6vmSiVnDYm1qP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543282, "uuid": "25667252-1c0f-409e-93d5-e3c3695b4b62", "value": 1462784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543282, "uuid": "0bdb3c3d-4e9d-46e9-8ebb-13b6c4d4e105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543282, "uuid": "45d03625-c332-4108-b28b-4cadacae7acb", "value": "Reliable Purchas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48e88c8-afa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648586583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586583, "uuid": "965e1e36-615a-48c8-939c-89a6baca76e5", "comment": "Malware payload (Heodo)", "value": "7291158742e0292b83916b5c67d54118", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586583, "uuid": "d2944501-62b5-4c39-92ea-fab891d7c52a", "comment": "Malware payload (Heodo)", "value": "69733e89681e26730997e4ee6ee531ebb7716d94c367f4134834492fc25c964c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586583, "uuid": "0dcff8c9-695a-4d79-9638-eae0bb92be57", "comment": "Malware payload (Heodo)", "value": "32a839a4f1494b57e5fe723a9cb72b0f9f4580b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586583, "uuid": "a70f3b3d-bf8a-4074-899e-7c1f4c92b876", "comment": "Malware payload (Heodo)", "value": "99affdb26252987986fef46433861db07fb4b3575a5ef6680d80e086500cf82089889894f862530691e662574f2d10d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586583, "uuid": "4775148b-7d67-4596-843a-56d889ffa981", "value": "T1BFA49DC87582C132DE7B4B75C552CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586583, "uuid": "198f6f3a-471c-4eaf-8cd6-9a945919fdf6", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586583, "uuid": "b8c48965-8e1d-4d31-8912-1062968eaed6", "value": "12288:myXvaWo3sPddfrk5EpBLsORdPDpFlrh5W:F/as1dDkwHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648586583, "uuid": "1a05040c-9b05-4fc5-85eb-e22bb73d32ff", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648586583, "uuid": "508e836e-ded3-4a8e-bf98-da5514e3b0ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586583, "uuid": "eba7e572-2025-4aa5-96d0-b224527dc660", "value": "7291158742e0292b83916b5c67d54118", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2520cc4f-af69-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648562667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562667, "uuid": "154323c6-8eb9-4f0f-a010-22fa9c244a4b", "comment": "Malware payload (Formbook)", "value": "a39ae766c3a35121c99d23a351fb7f9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562667, "uuid": "87e40a87-0cb7-449c-ad61-5b07961b7ac4", "comment": "Malware payload (Formbook)", "value": "69785e004f3bf684c91c8f188058022933f954154f42d4dc41047be3713397ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562667, "uuid": "a3731ee7-9274-4fc5-9413-4892ca935acd", "comment": "Malware payload (Formbook)", "value": "6a5396e09daa0f2b1cfa176f3959bf6797bf2464", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562667, "uuid": "92a4232f-27bf-428e-872e-969d07360f8d", "comment": "Malware payload (Formbook)", "value": "001af3b9d103736a9d7c9398633c20fc5c026159d8a000e7d469aaa303fe5d9cc68fc15e4131619bad734c6c2a6d3620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562667, "uuid": "86649eec-4804-40ae-b3b4-94eb92e73640", "value": "T14B64010073619C27CC6E5A326875D279876B6D14EC611EF7EFB33E5A3D73A800A1D6A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562667, "uuid": "161401ed-30ba-4351-b6fe-8dcb7e4e5e0b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562667, "uuid": "c86b891e-e433-42d0-ab23-305be0040ab8", "value": "6144:GbE/HUXB0SzdeC/XNbTD+6ihA2PuNAbWxe0hkTkQx5VwmypVTcY:GbbuSzdeEZCnG4dvPSmyHoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562667, "uuid": "c6c7665a-19cf-48fb-897f-4ec2fefba907", "value": 321045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562667, "uuid": "037615db-7622-4052-9af7-8d35f46f9d86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562667, "uuid": "4741c8c5-972b-4b2a-ac8f-2c3bcf301332", "value": "SOA FOR RAC-098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fe1fdd-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648561859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561859, "uuid": "4d722933-b9de-4f74-95de-5353a1b82c04", "comment": "Malware payload (SilentBuilder)", "value": "8a62e3684dd37c509ef8cc24abcea4f8", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561859, "uuid": "003479bb-3f96-45cc-afe9-d897206fde4a", "comment": "Malware payload (SilentBuilder)", "value": "69d3d7130fc1f24121d302729d41f48fb104db2cea3b86352e1c8517afbcda8e", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561859, "uuid": "4d25b2a0-dd3c-4f78-b588-606eb044afd3", "comment": "Malware payload (SilentBuilder)", "value": "101498c948a7f56ae302c3610114701eb1981602", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561859, "uuid": "0a1b0b96-9ef7-4eb8-9218-851a333edfd4", "comment": "Malware payload (SilentBuilder)", "value": "7d25a9afb2e4d62268a5785c89c96151243d3764e1fb3d6a5053195d671c54553c0557016d4cac93d9c971550c0e0aee", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561859, "uuid": "708b8dea-f2d8-4024-9200-bd336a09c76a", "value": "T148C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561859, "uuid": "05569cee-d812-40cb-9245-4e0f2c781271", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561859, "uuid": "ebae6d2c-57c0-4544-813b-bb47e5cc0ef1", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561859, "uuid": "16dbbc62-0f81-409a-95cf-a4f4729cc44a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561859, "uuid": "60d62c02-cea1-41a1-86f9-bb263ea3ed4e", "value": "SecuriteInfo.com.Heur.7302.31584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e443d7-afa8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648589671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589671, "uuid": "692005c9-6a0c-45b5-ae1c-06e2b03c1bd3", "comment": "Malware payload (Heodo)", "value": "6b1eaf1ccf93b1910d36b37c43488606", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589671, "uuid": "9a9b577d-1ca2-44e2-a814-6a3503645ace", "comment": "Malware payload (Heodo)", "value": "69f361ca3261b584bbd0e50b95e325b85fd1413cdebf1f5f2f09345eaa9f197c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589671, "uuid": "a82f13ad-e7ba-4f18-b383-3112e9f97e59", "comment": "Malware payload (Heodo)", "value": "29ae7f2a4cbc9c9c6c2b80b381fe14d14b51451f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589671, "uuid": "5332bf52-c6ac-4037-9d99-55e508c90d80", "comment": "Malware payload (Heodo)", "value": "05bb6e008cb0fd55a00d653e9bd271a6928f136aa00ee728e8459d9f9ed0689aaf569ecbfdae287063e119035850ac87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589671, "uuid": "c3aec787-a3ae-49ad-a197-66b88e132a35", "value": "T143A49DC87582C132DE7B4B75C552CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589671, "uuid": "b2ef1763-d88c-46ab-8fce-12a509420d42", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589671, "uuid": "7b242cd1-eb0a-49a8-9938-eb8b3f922e19", "value": "12288:myXvaWo3sPddfrkxEpBLsORdPDpFlrh5W:F/as1dDkIHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648589671, "uuid": "20441e01-8222-41f4-a256-7893c6ccb269", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648589671, "uuid": "99bccf7e-7d2f-497e-a11f-60c037a1b35f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589671, "uuid": "18a61af9-69f5-4d2b-8b6d-3cb2a94c6fb2", "value": "6b1eaf1ccf93b1910d36b37c43488606", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96520be4-af78-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648569299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569299, "uuid": "2cad9729-de67-4fdb-a0c3-2dfdf99a34d3", "comment": "Malware payload (SilentBuilder)", "value": "8d9bbb746f3ae92e83c5784777469733", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569299, "uuid": "84d35762-3c1b-43e7-9d6b-cc86b229683b", "comment": "Malware payload (SilentBuilder)", "value": "6b042ced72295064e8451d40a90aa36ade3aa7da1bb668bc3acb92565cd6db2b", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569299, "uuid": "0a7d6971-0a98-46a9-b1b9-34621d3352a9", "comment": "Malware payload (SilentBuilder)", "value": "1a3911b2f881623ff0c564a703aef7fa46797dba", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569299, "uuid": "2959bb6e-87ad-4911-8559-f48e75ff8253", "comment": "Malware payload (SilentBuilder)", "value": "6e6bfc8e4a7362590a3b45100955abd77ff14eac8dde4229d0c969703a1cf59d6290f9ce7912b9070efeff9a1afa9c67", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569299, "uuid": "b0c49376-15f2-4ab7-be89-e4577d7328fe", "value": "T17EC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569299, "uuid": "14a9c07e-a243-4bed-b675-0f1cf9b6c020", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC8:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648569299, "uuid": "d42b830b-04db-4b1a-be6c-12fa63d9e1b3", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648569299, "uuid": "fa121bf9-43a9-4a06-bf0b-1cc09881403c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569299, "uuid": "c28cd3d1-88b6-4c0f-84b4-36dd2a22e48a", "value": "8d9bbb746f3ae92e83c5784777469733", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004b05f4-af69-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648562605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562605, "uuid": "a4b89a01-2036-4c1e-9b2a-22faebf4ac2e", "comment": "Malware payload (SilentBuilder)", "value": "89090d3c96227dabf681400088f06650", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562605, "uuid": "ace74a49-8492-426f-b8ad-2d0f6e8fbb39", "comment": "Malware payload (SilentBuilder)", "value": "6b0a69aa1b6d0afb8bce4b69dc04c6dd1b2ad8135fc96a3fdf508a5b418fc3ba", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562605, "uuid": "73af3115-f672-4453-8d9a-683bd8e05ab3", "comment": "Malware payload (SilentBuilder)", "value": "1517eeba23547e85fb900099871e555625ef3aa2", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562605, "uuid": "e1fde653-e0ad-4792-8c55-ddaee278da72", "comment": "Malware payload (SilentBuilder)", "value": "2a413e3cb2d09bfc07159d39ede39bc38d8c9b64e7d08a33f66c771088d345ce3425dd6f4fba0ed6b111672597321b2d", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562605, "uuid": "604d2c8b-1d96-4bd2-951d-88426d57bb3a", "value": "T18BC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562605, "uuid": "0c64528e-ebd1-47a1-86e7-72c1ffacd0a3", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562605, "uuid": "c0d16e2b-07ce-4154-ad77-56a0ce5668c7", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562605, "uuid": "520828a4-f5a1-4000-967b-9dbb330bc233", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562605, "uuid": "033f1815-3324-4c95-89dd-03116b872a65", "value": "DetailsX2022.29.03_1522.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88798345-af49-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648549089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549089, "uuid": "be84ca18-412e-4325-8fbc-f0fc35e900fb", "comment": "Malware payload (Heodo)", "value": "386f39b0edefa6d9812568a36a177ab8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549089, "uuid": "bf4eb3a1-a73b-4ec9-9ef6-301725029df9", "comment": "Malware payload (Heodo)", "value": "6b0b9a8e37bbe3c2f74538e1e336cbd5f5ec96f0ead6819d377ad0a0898c75ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549089, "uuid": "0161e9b3-5efc-43b4-8167-4b96744a7587", "comment": "Malware payload (Heodo)", "value": "252c345351f703adfe63d6d368b272c919aba89a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549089, "uuid": "6fdbe25a-9ee9-4358-ae59-d7cb3f740cf3", "comment": "Malware payload (Heodo)", "value": "5ef3f983427d226f0d2a8ebbf1e6bdd151a6d961e9573ef26322e3a172d54572a0a7d7d7e995e0d77fe41b9b36669d38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549089, "uuid": "92b9167f-7f18-48c3-82fd-489b6188b4dd", "value": "T1E3C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549089, "uuid": "48465e9e-9616-4687-9e08-21dba29c741c", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549089, "uuid": "1e77660b-ed75-49fd-ba29-9968c68bf0a8", "value": "12288:iUV7ciwHX3ew9aYU3pAc9inFijaQeL+nZBb:UiMX9Iuky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648549089, "uuid": "ea62dc0e-61f8-40f1-93b0-bc676bef4594", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648549089, "uuid": "45ad6525-efd8-473e-bf1b-76201a582f6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549089, "uuid": "70e3ef24-6cd2-46d5-857e-e853c722dea5", "value": "386f39b0edefa6d9812568a36a177ab8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1836e2-af0e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648523889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648523889, "uuid": "70f516de-538f-41d5-90e7-bfb03b99aaad", "comment": "Malware payload (Formbook)", "value": "00549eb533dc1781660d59c4482e9b53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648523889, "uuid": "f9d2c1e7-6f67-4c74-b74a-a6eb8292b235", "comment": "Malware payload (Formbook)", "value": "6b9529ef9582e73d4ac7bc63d46bd152a1bc894ce781308b8798ea9689312e60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648523889, "uuid": "e34d360b-df74-4e7d-8cb0-08a7de7d5df1", "comment": "Malware payload (Formbook)", "value": "c220f6cc596230f6436c32234a9d01444882f310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648523889, "uuid": "d3e81ed3-d4f7-4513-92da-4ddb04d34c51", "comment": "Malware payload (Formbook)", "value": "9a49c362c68c6ff97ca709f5f8ef9167a1acda288676d67ac467559d575e12a898bedf35b3c20acc1b722c18d14d5365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648523889, "uuid": "92264685-182d-477e-b063-dfebfaca37e4", "value": "T14035021417E88652EABD9BFEE4B440014B35B42721B7E31D96C2A4EE0F733C68A5B357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648523889, "uuid": "c1009443-27ee-43d4-b36b-e4a121d45efc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648523889, "uuid": "9be93ad1-ca0a-4c29-8650-b6fec915f898", "value": "24576:dgeOnFB17NvmeUm4ELzZpga6qGrJF5V3gKQe8:dgeOnfj4W37g8YFvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648523889, "uuid": "f68f730f-3b78-4a8a-982d-2dbd34b2a573", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648523889, "uuid": "9fb2adac-807f-4fc8-bb2e-6e55a1bac688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648523889, "uuid": "d9cfbbf6-b20e-49af-9be9-b66d109635d4", "value": "Quotation-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7767a78-af1a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529089, "uuid": "18d4b927-f025-4224-9a55-d08cc4054131", "comment": "Malware payload (Stop)", "value": "65d995210dd06c7c473fcba4aa341b67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529089, "uuid": "0433ce7b-5792-4ebe-8c5e-860c9d60e9a3", "comment": "Malware payload (Stop)", "value": "6ba4e925a60367af40aa1eeccbc544b0ed2b6ea73f13112de046b9bb85533dea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529089, "uuid": "0b9f0fa4-156c-40f6-b4e9-371e5238cddc", "comment": "Malware payload (Stop)", "value": "778f473152139961101fb73f1c58404c9888f033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529089, "uuid": "30cae0c0-c646-4797-a200-f6a646449e69", "comment": "Malware payload (Stop)", "value": "a44696433df39232773a1f76bde53aeededf2a5e890d0ea1c60255eb6a86bb9b0d81f77aa926a65eb7de9db52b39f9d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529089, "uuid": "8cde1d7d-136e-4ae9-92a2-45c5af9b3ab2", "value": "T15B050210B7A1C034F4B716F8887D9399B83E3AA15B24A5CB63D56ADA1B357D4EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529089, "uuid": "bf1cf941-4de8-4846-9da9-f510b28ab6c0", "value": "5b781a7e94da324fe985d05bb125d645", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529089, "uuid": "f880423e-e130-41cc-b2b6-2b0cbf3525ba", "value": "12288:NAXKb/19WIFcrev9Yit85EOs83o37+30Kn5Y4yRI3YZW3HEAq8lR43ZXOAz97EHj:3d0jrEYit8iLOn33YZW3EANQ3ZXHaTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529089, "uuid": "616513b9-9fde-4b0b-b0cb-ecc64f991123", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529089, "uuid": "706ffd61-5b00-4736-a923-66b8e02dd5d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529089, "uuid": "8597d0a2-1eaa-482b-b2da-4bd8b7efdb9e", "value": "6ba4e925a60367af40aa1eeccbc544b0ed2b6ea73f13112de046b9bb85533dea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4efbd98f-af77-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648568750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568750, "uuid": "02fd265b-1011-4511-ab08-fbc20a8b9ec0", "comment": "Malware payload", "value": "37b6881840414799aef986e83e65cc92", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568750, "uuid": "23f66a04-4833-4f6a-9cb2-53b7a7b83cc6", "comment": "Malware payload", "value": "6bd84db4a6aa7f3c1293129130b06802912c9d648415afbcc8e07e402da7295d", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568750, "uuid": "4ddc4dc5-7a2f-4527-9260-dd46c2ca8bdc", "comment": "Malware payload", "value": "82b981f20e308654d13a50cf0f316d9981cb6553", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568750, "uuid": "ae351b34-919e-4fe8-be6c-b386fc7f3a2a", "comment": "Malware payload", "value": "a98aefaee655363a0bc706bffe042612a930ea0999047063bc246e584da0f799824d675d3c76c9b083d959a650a50660", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568750, "uuid": "6b89a1f6-768a-48a2-9b0a-20f62906e8ff", "value": "T13A15AF3AD29096FFC163BA7A6C36F180AC113DE1D614E50527DFDE4E4A397822724787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568750, "uuid": "58a43694-fa30-4a9e-ab16-a5ab4768089d", "value": "f335497b5901bcd9e242e896ee9878b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568750, "uuid": "ec6c57ce-6f37-4772-a08e-1276e4ea0e58", "value": "12288:MvdyMlRePlWuktyda+/egKRuCQ1X8eLQRNGoDTStoMsaD2F1PrIGCn:GnlRxuwTI4BqMeGNruaVa6FZCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648568750, "uuid": "dda261cc-734d-4a70-9ccd-89007cc90847", "value": 893082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648568750, "uuid": "b7872f46-1fd8-4774-9b10-9d3cf15b861e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568750, "uuid": "a79390f5-67c7-4815-be41-e49b62fe5ceb", "value": "Swqnh.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724eb22f-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648537026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537026, "uuid": "474df20d-272b-4074-a460-43c7c7e00af0", "comment": "Malware payload", "value": "552750413c04a7160f33341df71444c0", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537026, "uuid": "7bcbe97b-cf80-470d-be94-a61cb327daf3", "comment": "Malware payload", "value": "6c4b97e9204a31564927b54cbcf126af42585295ac3eb75bf45f8859ec0ac8fc", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537026, "uuid": "2307aeb1-a844-4451-8309-e3d828b3adc6", "comment": "Malware payload", "value": "8e7f30cd86736685b1b73999064c43bc854235fa", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537026, "uuid": "d42ac573-ef57-46d9-b48d-d84842c37cd5", "comment": "Malware payload", "value": "d125b54a1604252117068c1a0b6b106034ffceda80992313b193d19871a03f59656479bdde2240ac0915e02308c7ac22", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537026, "uuid": "d2404e67-b35b-4999-96a6-8ab3086194a4", "value": "T1B3141231E78C6C98D29D7AFD1770E1F1430DDEE924A9422D6AB47D7211390B2FC235AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537026, "uuid": "a7849053-9bfa-4a05-9804-3e2c55f9f6a8", "value": "3072:8YG1tduJ8E18zUx0oEbwJJb3GyGb2lmHFts5onJCjshrBTwcHjWlH3:c77z1NbwJNgbVwiJZxNH4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537026, "uuid": "1c62e075-a4f5-4965-baa4-ba9bf182bab8", "value": 193752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537026, "uuid": "4833a809-a6ab-4fb6-be93-9ac734721a30", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537026, "uuid": "6b28911e-1fe7-4b7e-8cd6-312a0d1f9034", "value": "Feburary shipping documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78697b6f-afae-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648592442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592442, "uuid": "fe1af071-bc31-4181-bc61-d84420228816", "comment": "Malware payload (SilentBuilder)", "value": "95e073f5671f65438e30274f80d56276", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592442, "uuid": "98c33320-9ae0-4eb4-ad0b-57e4b95777f1", "comment": "Malware payload (SilentBuilder)", "value": "6d4f32a3767c9941096dfb6728ffc76b32d0d70bdb9965ee74b0a80db4779225", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592442, "uuid": "6a67d8d4-bb78-4fc3-a8d0-3ccf1f76f9f3", "comment": "Malware payload (SilentBuilder)", "value": "7afba41a50b77f9fa5a8575685649e749c45b800", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592442, "uuid": "fe938f92-623b-411e-ba15-bedc3e293eb6", "comment": "Malware payload (SilentBuilder)", "value": "a4edc0fecfc1dee7e9ba7f215c7c4e2d1f0d37eeef378aa195b8a21391ba25b75eee7d05c8718a4474a5a70b9d0d4530", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592442, "uuid": "cf754480-14ed-4332-b75a-b7df84d5ddd3", "value": "T10EB39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592442, "uuid": "9dcb47a0-1711-49da-8a0f-27f30d7a90a5", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMS:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648592442, "uuid": "d190fe0d-1fe1-4818-84e7-215d1d6801ad", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648592442, "uuid": "53c612c7-97cb-4238-943d-290df63f7702", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592442, "uuid": "c4fb8fef-1740-4dbf-b17e-f911142dda3d", "value": "95e073f5671f65438e30274f80d56276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf7bc51-afa6-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648588825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588825, "uuid": "0b3dafee-3923-46bf-98e5-2c2f163ec69c", "comment": "Malware payload (SilentBuilder)", "value": "bf0bc6e94dc7b02ac6eca042c46ad932", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588825, "uuid": "b40b642d-45fe-42f7-839f-9d26e2fb666f", "comment": "Malware payload (SilentBuilder)", "value": "6d7f03a15d7e07cfbc738ccb0b064abc31733873e7ddc662815454136a5fbc42", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588825, "uuid": "805e289b-fff5-4be9-b9b6-23d07568f482", "comment": "Malware payload (SilentBuilder)", "value": "13784ea73e766ced9d4b466bebb74f675f3e9af8", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588825, "uuid": "e519d9f4-2fc3-4121-a3dd-43d7f5ffaa29", "comment": "Malware payload (SilentBuilder)", "value": "e11de49258f8c55cc08f98bc280aec4fb7c484fcbcb236b96e4bb6e34c2cfb747153872af4c432cae00a90556820fc20", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588825, "uuid": "b536df3d-cac9-4248-a864-3a85cb007bb4", "value": "T169B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588825, "uuid": "09baeacb-3759-43ca-8718-4fad8226d8b6", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMC:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648588825, "uuid": "484c182d-4b0f-4cea-9eeb-5e4b0958fbed", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648588825, "uuid": "1cad8b2f-9732-43b7-916c-bba9f8790f16", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588825, "uuid": "f6d39a3d-f48e-4589-ba9d-837ac097acc0", "value": "bf0bc6e94dc7b02ac6eca042c46ad932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5cc7e5-af57-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648554980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554980, "uuid": "caf0ee6c-d84b-4c54-b554-aaa4c0de828a", "comment": "Malware payload", "value": "3596be8687af28f73e4791037631d43e", "object_relation": "md5", "Tag": [ { "name": "pw brDzV", "colour": "#B2269D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554980, "uuid": "1236e6ba-2d8b-448f-979f-47f0494cd95b", "comment": "Malware payload", "value": "6d8e153d37719ff2a2bb5d1210c43c64b0e6122bb1d1e9c8f844f6454d37c001", "object_relation": "sha256", "Tag": [ { "name": "pw brDzV", "colour": "#B2269D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554980, "uuid": "42d04b11-501d-4c31-9f1b-ba53eb015511", "comment": "Malware payload", "value": "c3d9dffa2578f08f4638ecf1125857de7362c70f", "object_relation": "sha1", "Tag": [ { "name": "pw brDzV", "colour": "#B2269D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554980, "uuid": "737e5a98-c603-44ed-8bfb-03c92cc98f83", "comment": "Malware payload", "value": "10f38398e26fb38de1ae7dc84f125b7a9442cc819b99d3ca8c917d1fcde4767a869e08ff3529780c6fef97f836fcb3dd", "object_relation": "sha3-384", "Tag": [ { "name": "pw brDzV", "colour": "#B2269D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554980, "uuid": "db3e2f2e-ed85-4eee-b606-a7540ab46866", "value": "T1F383121558690D6CA07903A3E9E85C34F061E24974DB65E90E78E1E32CB8FDFA90BDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554980, "uuid": "2a35d898-eea0-49e2-88eb-ab2a68379048", "value": "1536:7uUFVbIVGlZhRt3n775oKkkkNMGqCbgOmqeXYF/+Nvj5lEQpl+KQfu0I:aaVIclbRhnWKqyhCbLfGzECcK4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554980, "uuid": "2fd01c24-536c-45c5-b884-3a3a10905c6a", "value": 87407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554980, "uuid": "0002142e-c031-48a0-8995-75cadb48bc45", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554980, "uuid": "5adf3483-0490-4536-9ecc-f723f618f634", "value": "SCAN959_00079.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78bca27-af43-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648546565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546565, "uuid": "752fa716-2292-4165-8504-cbead4abaee3", "comment": "Malware payload", "value": "60cb70545fbe3c96a0f82eeb54940553", "object_relation": "md5", "Tag": [ { "name": "plugx encrypted data", "colour": "#4F5179", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546565, "uuid": "6d13603b-4c16-4332-8820-dce86a898f88", "comment": "Malware payload", "value": "6dc98a3c771f9f20d099e2d64995564dd083be9ac6ed9586a6e57c20ebd4176c", "object_relation": "sha256", "Tag": [ { "name": "plugx encrypted data", "colour": "#4F5179", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546565, "uuid": "d35ebb36-6372-4794-a81d-80ac8e1765e5", "comment": "Malware payload", "value": "2294ecbbb065c517bd0e01f3f01aabd0a0402f5a", "object_relation": "sha1", "Tag": [ { "name": "plugx encrypted data", "colour": "#4F5179", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546565, "uuid": "6d4f10b8-f255-4fbb-af1d-f87117ec4a76", "comment": "Malware payload", "value": "084cc411d9156c7cee96ec4acf3e5b7fefa3dabb421cb0756d3c04f6f8e1f891856c2db74dc062cadba7cd6073aac0b0", "object_relation": "sha3-384", "Tag": [ { "name": "plugx encrypted data", "colour": "#4F5179", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546565, "uuid": "1fbac580-9998-49fa-9aaf-7817566fc392", "value": "T13AF323BD0D2FB14B039E2BFE115B8E565828ED8231D5DC0E9D822A584DF0C66A1D4DFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546565, "uuid": "99987fde-c4d5-414a-b72c-a7342a975f6d", "value": "3072:zZTf+zaNLrnwZAT3SlnasBNWLh6mUi7LlLxzFHORkcluS4IPowfCCRY:zZTmzaVngkSlgh6LULxxzF2uNIBKCRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648546565, "uuid": "6cbb9b12-3233-4e66-86d6-a07eca2e90f9", "value": 159981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648546565, "uuid": "d2b62998-73d0-4ef1-81a2-4208e8ed83f3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546565, "uuid": "bfa12fb9-97ea-42f1-9147-d2404a09b88b", "value": "SNAC.LOG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563bf60e-afa2-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648587230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587230, "uuid": "a75c691a-55e9-4685-bdf3-6279949b69f2", "comment": "Malware payload (SilentBuilder)", "value": "f02006c894c0b03c783d826deacb4706", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587230, "uuid": "11ee3798-1a3a-413c-9530-ed7f5a020e7d", "comment": "Malware payload (SilentBuilder)", "value": "6e5d4d61f6b1d0d27afe34e697395676dd75e6089767b1126d340b7c343a8642", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587230, "uuid": "a2aa13dc-45d5-48c3-a528-7f037737895e", "comment": "Malware payload (SilentBuilder)", "value": "30e97a8cc631373e10b402accbc82f47eb1bd84e", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587230, "uuid": "758f343b-31bc-43dd-b580-744b36c82902", "comment": "Malware payload (SilentBuilder)", "value": "46982874f02af8b52e2e882137ba8897a943c131b5194d7271318418e095b3ad75b581d8b1f9920ae98ec069c7d55470", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587230, "uuid": "a9d2617a-982d-4c33-b32a-7979209b8a69", "value": "T163B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587230, "uuid": "a5033ce8-909d-41ae-85ea-302515f45446", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMO:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648587230, "uuid": "303ca49a-1daa-4556-a01d-f641288eb485", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648587230, "uuid": "d169f775-9ee1-46bf-977d-11d1344b8736", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587230, "uuid": "af7c3403-90b1-454f-bad4-6b1fc6cceb7f", "value": "f02006c894c0b03c783d826deacb4706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb92b1d-afbb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648598170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648598170, "uuid": "942f80e8-d29c-45f7-8375-2f280d64706f", "comment": "Malware payload (Heodo)", "value": "86e8ee0bd1670a468b1c06d9a754d3eb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648598170, "uuid": "c95623ff-6db0-4806-ba19-cccf18d7021d", "comment": "Malware payload (Heodo)", "value": "6e65b8204a30f479fe9a429c8c2e206091dab33182544365f9567a23b12ec75f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648598170, "uuid": "ef996dc5-f9bd-4607-90e4-cb894a933d93", "comment": "Malware payload (Heodo)", "value": "b64f95f5eecd451585e5bbbaa4f8e7d5efe9d382", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648598170, "uuid": "32c28a2c-8bf0-4541-b04c-384982218876", "comment": "Malware payload (Heodo)", "value": "59a8886f5cf9a69bf6f44f340b01bebe665c2345a951858494355dd7f251ba55748d537e53a289e65e8f4ad7eae6198a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648598170, "uuid": "bf8c1919-b314-4713-844c-c9870fafc823", "value": "T1B8B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648598170, "uuid": "1de055b9-5c1e-495f-ba49-396e480c88ff", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMO:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648598170, "uuid": "d83681cd-0af3-4b4c-a668-0da0648ef0a4", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648598170, "uuid": "b2f576be-5c35-47a9-bc82-036d85868267", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648598170, "uuid": "e98198f3-59fa-4a3e-898e-4b52903aa5f8", "value": "86e8ee0bd1670a468b1c06d9a754d3eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73194ec-af73-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648567207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567207, "uuid": "7085f840-691e-40dd-954a-7c894d0725c0", "comment": "Malware payload (Heodo)", "value": "52cfb8a70fe926f92ea0eb2f6bf5252d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567207, "uuid": "efac8151-8854-4998-8650-4ecbb81497e1", "comment": "Malware payload (Heodo)", "value": "6e6726f702241c90343194ad02f02bd9ec985d66664442e82a02d39dfde8d305", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567207, "uuid": "8454b750-112a-4182-8f56-13500ffebdf3", "comment": "Malware payload (Heodo)", "value": "8b71100d08e1a2e63177107a2bb9e133dc680626", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567207, "uuid": "c46eaec7-d335-4f24-93be-59c321d70e1e", "comment": "Malware payload (Heodo)", "value": "a68c23ee06112772cf1a85b3df5e2b7fe44432b5bf54da7cedfb180a2cb5f12b281cfd4c3fcabb219406629291134465", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567207, "uuid": "764a9579-7294-4afa-8a8c-e9cb93fb7c57", "value": "T128C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567207, "uuid": "62f018b4-7ca9-4e65-a761-c00ab3c3df49", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648567207, "uuid": "bf488b2e-c34d-4454-88b1-17de223f8950", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648567207, "uuid": "88ccad82-77a1-4710-bb9f-0cb24620b21f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567207, "uuid": "a7c07774-b7b3-44ff-bf16-9e279fd977b8", "value": "52cfb8a70fe926f92ea0eb2f6bf5252d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d59c76-af86-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648575261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575261, "uuid": "17c1d70e-e43b-4599-be16-e82920d7d74e", "comment": "Malware payload (Heodo)", "value": "1ee1f59adc0447eb2a339b5fbb1acd46", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575261, "uuid": "a7928b7b-fc61-4804-ac83-474bba5d6bf6", "comment": "Malware payload (Heodo)", "value": "6ea32c0adb941fc0905a87e77fcf76d4b5a4dbb57eb6c8fc5c809f327337dd01", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575261, "uuid": "8a1409ce-e643-4287-ba1a-d481b3c23058", "comment": "Malware payload (Heodo)", "value": "ac2946d2ac9ee9c46b35d100eaa303fc651dea5b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575261, "uuid": "1b2e2da9-c625-4d88-84ee-d918454306fb", "comment": "Malware payload (Heodo)", "value": "61e014f6edb476799fc9cd312b8fe55edb792b18b20b5f21e04db966f743fb9ded7d4d0c7c8f93e15c316e201468e530", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575261, "uuid": "61dfad4f-06b9-4021-83fe-2275bb9a3a44", "value": "T1A9A49DC87582C132DE7B4B75C552CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575261, "uuid": "2f28da2f-2b53-4ac6-ba69-5065dd6bc8ab", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575261, "uuid": "fdc886ba-ffa4-4292-b442-5984a344c18c", "value": "12288:myXvaWo3sPddfrkUEpBLsORdPDpFlrh5W:F/as1dDk3HRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648575261, "uuid": "e6f7b243-072a-44f5-97e0-5d9d8509fb41", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648575261, "uuid": "80e39cf4-30ad-45bd-b714-58bd7107487e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575261, "uuid": "33459481-1d0e-4a70-b681-8f0f8aca29ea", "value": "emotet_exe_e4_6ea32c0adb941fc0905a87e77fcf76d4b5a4dbb57eb6c8fc5c809f327337dd01_2022-03-29__173413.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bf4824-afbb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648598156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648598156, "uuid": "d217d81f-70cb-4ab2-86e9-ddbe601f91e8", "comment": "Malware payload (SilentBuilder)", "value": "0834fc1bdfa7726ad23eae86316d6d04", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648598156, "uuid": "0aa2af7c-e0e0-403d-b698-2fe85c6027db", "comment": "Malware payload (SilentBuilder)", "value": "6eb16e0690e24c1b65d09c39133e26dee115930191fbb0b6a2a6bbf2963962c1", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648598156, "uuid": "cc3ce981-cb20-480f-9d5b-9136b11beb65", "comment": "Malware payload (SilentBuilder)", "value": "15d428648ea8f8986ad3b455e60e2f9c05a63ed1", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648598156, "uuid": "504a096f-8d84-4671-99d8-08e91a1580a1", "comment": "Malware payload (SilentBuilder)", "value": "4999aa84e262f812392803fae3452b9ed8277b7c68dc8ebacde98117863be2c0a2b7cd6ad26bd637fd0e608541599684", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648598156, "uuid": "2e5ae556-5eaa-4dcf-8270-ea19f5508230", "value": "T1C7B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648598156, "uuid": "20ec3677-216b-49b3-a929-496aec658a08", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMO:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648598156, "uuid": "deda87c3-e911-4f78-96d6-eae36b72ecf6", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648598156, "uuid": "d0fc1106-eae6-49be-b4c3-3a5476282c8c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648598156, "uuid": "217b2726-584f-4a65-a23e-e8d946132f33", "value": "0834fc1bdfa7726ad23eae86316d6d04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a9f07f-af3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648543845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543845, "uuid": "54e3d5ef-b9ef-41fa-9692-9d97d6a00a96", "comment": "Malware payload (Formbook)", "value": "6b3f562fed4b02f64fedca858435dad8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543845, "uuid": "07e5eeb9-0588-4ef8-b0d6-afa2c6658e73", "comment": "Malware payload (Formbook)", "value": "6f76ab522347829e2902934083acba42873a059a36a43409893dbd9dcf2f8323", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543845, "uuid": "4728cad4-c1d1-4dc2-abab-d1e28fcd1a7e", "comment": "Malware payload (Formbook)", "value": "6203e89386f6f8fa2ea0a1f5547de2db317960af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543845, "uuid": "e2db9d10-b677-4423-b6b9-9e60c52183c5", "comment": "Malware payload (Formbook)", "value": "4526492b87a8e7a888b8e4ea5766faa2e9ee64b9aa8db536a32d1ad8acfdb8b93289cd45de9eee6261c8ce251b6fa4b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543845, "uuid": "5c9db8c4-310d-4897-9a56-e3f848a8f8d6", "value": "T1B734132672D4C427D6A341731B38AB274EEAE30B60BEAB4F17245D8D3522581A81D7B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543845, "uuid": "649f397f-b59c-4c5b-8097-82e73059e60c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543845, "uuid": "62cfe95c-2358-4d1f-a14b-84950838da72", "value": "6144:HNeZmyhS6PTwzy676BedRaqSr6x2W0P8+l:HNlKS6J62BedRan6jcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543845, "uuid": "7991d387-4f79-4aec-bc14-dfa83780b1be", "value": 246562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543845, "uuid": "572c399f-e7b8-4699-9932-15d507396939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543845, "uuid": "a96af476-cef2-4edb-bbc7-4a62183cc17b", "value": "6b3f562fed4b02f64fedca858435dad8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b26d90-af94-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648581077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581077, "uuid": "c4c39d3f-9204-4a40-b117-377bc517d3a2", "comment": "Malware payload (Heodo)", "value": "b34ec6f67e8b12d1329c78ff66a633bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581077, "uuid": "1230dfe9-d3ba-425e-83f4-678815269f9c", "comment": "Malware payload (Heodo)", "value": "6ff86bb2d033484c9d4d9aec97ab11f394ea9b62281e22f74a4fe519bc81fb57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581077, "uuid": "ac059d84-852a-48a4-a292-6db8bff1d774", "comment": "Malware payload (Heodo)", "value": "706f082924b00b53ecb593156570321bab3b515d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581077, "uuid": "96ec743c-316b-4e89-89df-3aacfa64d38a", "comment": "Malware payload (Heodo)", "value": "4332d28edf75a79fdba878e2923cdd36e8f8e72b2ddb396e45cb7f087c5618128ac3462f834e85ff0a2e9848747252ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581077, "uuid": "529e4611-01b4-441c-914e-47424677524a", "value": "T17FA49DC87582C132DE7B4B75C552CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581077, "uuid": "ba70cc1b-d601-46fd-9dcf-7c1363c4d99a", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581077, "uuid": "01bd650a-dd39-4986-a02a-4ae888e6b3ab", "value": "12288:myXvaWo3sPddfrkWEpBLsORdPDpFlrh5W:F/as1dDkhHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648581077, "uuid": "af052fff-f888-451e-9a2e-b2a9111c65f1", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648581077, "uuid": "c9a66fe8-2732-4b49-9989-59ecb0ca16ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581077, "uuid": "8e0ff822-0340-4550-a984-929719e31c6c", "value": "b34ec6f67e8b12d1329c78ff66a633bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dee542e-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529154, "uuid": "2b6e1c91-d90e-4dcc-993a-63e3fc5c6cae", "comment": "Malware payload (Stop)", "value": "23eda0d8315b48f56f121e618dd75434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529154, "uuid": "e03b36e5-1bd2-496f-8c09-0806665832b4", "comment": "Malware payload (Stop)", "value": "703596cf1362533b7beb36bd72b994457ea1109cd3d6860bfe2cfc4b0b32a21a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529154, "uuid": "ea72c8dc-b4c1-4c62-8dd2-72fc0f865862", "comment": "Malware payload (Stop)", "value": "bade5dfdbac7bafa874970444a309a7df8ad69c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529154, "uuid": "60060159-9a91-4117-9baa-eeab1be68087", "comment": "Malware payload (Stop)", "value": "1f8de34a6c083424805c48447ba12b360f5286e8566b8a39191622e937a460917be1757547ec3ec690520c9bffb0e550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529154, "uuid": "c5d23d99-8498-4a7f-8d32-f0eda9038c3b", "value": "T1ACF422133702F439D54A357934578679626AA832DA9F8C87BB082B3F1F116D0E6F570B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529154, "uuid": "a89a10a7-f877-40ad-a1d8-d03452801baa", "value": "95ad07e52855bf052511ff6b3b1e2bcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529154, "uuid": "54fcc3d2-6d73-4591-8c59-7cd09f4a493b", "value": "12288:+tyPM1hy+isEwNZHrXVtE9sPdxBbrV9k/FtCYhepqmCZZdPx+T:+ofs9vLXk9s1xBF9CtCt0XbpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529154, "uuid": "6abd3194-4a18-4a2d-8316-089eb671bcab", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529154, "uuid": "6736cb39-ce1f-480d-9157-1d560ab75df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529154, "uuid": "5121215e-cfd8-4724-86ed-eae323dac17c", "value": "703596cf1362533b7beb36bd72b994457ea1109cd3d6860bfe2cfc4b0b32a21a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085023f5-af97-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648582375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582375, "uuid": "d04d470c-81a8-4aa2-999f-6a9e9151216f", "comment": "Malware payload (Heodo)", "value": "db6a72a35f7795e8b6f4f4fc2b63e86f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582375, "uuid": "757bed78-1c12-49da-b445-4959a6d04fe9", "comment": "Malware payload (Heodo)", "value": "7047cd3b5a3ee944d1a4228b0a9bd7bc6fb2bdc460d08d16e47528f4cda3b1d2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582375, "uuid": "2295212a-1b3a-453f-956a-1197e0cf12ee", "comment": "Malware payload (Heodo)", "value": "81f4128e4c1566f1cea37bc7001f91a9fb96bff7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582375, "uuid": "5305ba6e-1e2a-4ca9-a758-d7f36f16c608", "comment": "Malware payload (Heodo)", "value": "dc5b8a7f4cfc1849b7fb2d6806300fb0ec55d8a2c0f41d647cbe73eed9a7b0d457323eaadbc3cd2142ab171f48cbb529", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582375, "uuid": "a619d6a1-5150-40c7-a724-94d0b0c17b82", "value": "T124649ED173F0CA77E22715333EE597BAB2B9A564DE32C6836394CA4CEC320554532B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582375, "uuid": "3e87e4ea-c6da-4f8e-8c7f-3c4fff269740", "value": "1ae872d29ae3f3837d6c8d15813e59d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582375, "uuid": "a34a1840-e1fb-41f5-86c1-0bc61f527e8f", "value": "3072:yETHGNaL1eByO0+yJvoXZ13zVMrJAZ/swfkCWNRTlJwrySDJUi3IXjUlziMN3To2:DIuOkoX33WyZEwtWNRByDlPdOkiB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648582375, "uuid": "3aa2fd90-9d51-4376-9c97-ee92329cb8d7", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648582375, "uuid": "962ddb06-c134-41ff-8884-18c68d081ae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582375, "uuid": "8c79c04f-2e97-4673-9fa3-0d04577bec14", "value": "704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770574ab-af24-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648533169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533169, "uuid": "81548bde-2a6a-4121-836d-814ea31b4f3b", "comment": "Malware payload (Heodo)", "value": "6d2550788b0fd0ef1b4ae4f45928410d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533169, "uuid": "c113343b-8a42-46c8-a69f-70fa780d9f04", "comment": "Malware payload (Heodo)", "value": "705b31046d7bf92087a0166e61ee8e8f95a11dc546e581b33619fc49e2cab308", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533169, "uuid": "13114395-5412-43a6-b36a-1c68d0d95dd0", "comment": "Malware payload (Heodo)", "value": "449e320901876450623336b88fa57aaa37ccf5d1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533169, "uuid": "734bbf3b-79b9-4fd7-8384-759374f88f2f", "comment": "Malware payload (Heodo)", "value": "66299dba0496b422be33b4b6a304377798f4ea61024ac873f2afa672254326ab36f767105103ea45b22b4056ae448ef6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533169, "uuid": "dd2ca016-68b4-4e03-bc00-0318c6e338fd", "value": "T19D746DC237E180F7DA6255313EE386466779BC648E328A937354BB8DEA31AC3E535740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533169, "uuid": "b3c10453-f9c0-4f2b-8d27-7046bf8f6479", "value": "72b3528e45595fafbd5f24ce92204592", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533169, "uuid": "29e8e43e-10b2-4820-a380-2fa669d5b251", "value": "6144:aPHIFvHxVBxWrhtOjMcD+t14e13gvXr7fa+CYSWSiNX:aPoFPxVB0r/OjMciV1yja+3rN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533169, "uuid": "fb9b80f4-eee1-4ebf-a75f-26df8ee970cd", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533169, "uuid": "01e2aecf-0966-4b8f-933d-5176724ab25f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533169, "uuid": "8093c47c-ffdc-494d-979f-a3f1f42fbc96", "value": "705.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6314f8-af2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (CobaltStrike)", "timestamp": 1648536646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536646, "uuid": "089324d0-a865-4f79-88d1-230eedb23304", "comment": "Malware payload (CobaltStrike)", "value": "b51bb921feb37fdcfcdf2169c7335561", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536646, "uuid": "34cd391b-6cba-40c9-b268-254ecaa799ca", "comment": "Malware payload (CobaltStrike)", "value": "7064529ddb46b07e38971cce47bc9eec1f07d30616e863f6528375692f231283", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536646, "uuid": "22fd229d-e9ca-4ea9-9034-1409fc407c70", "comment": "Malware payload (CobaltStrike)", "value": "29c4221de26d746ce9a0df70c5b5bb33df94fabc", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536646, "uuid": "fc9e5ea6-dffc-4dce-9699-8193a9599164", "comment": "Malware payload (CobaltStrike)", "value": "ffc32c4198ad1a888b8024c0b4bfa08bea7f23c4080b9938997a422dec8b6813341fa27aaf8d731c6846d6203d79bd14", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536646, "uuid": "24252a48-e6c5-4f3c-b543-86eb0b0bb39f", "value": "T1E3C35B5773A431FCE537C27AC9920A05EBB2B83607219F9F076446561F233A09E3EB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536646, "uuid": "74741d06-15d2-49af-a93d-69d19fc6c76b", "value": "48a7ad3bb40b97434264dfa0b637ffdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536646, "uuid": "c2814e0f-9432-428c-bf8f-75c9ed4ba2ef", "value": "3072:pcdKwd3TGtGi6aiZa/utKn6n6MhDUdlQz:pe3TYGxpZaMnAl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536646, "uuid": "c2d81c78-8c05-46c3-8df2-9f2e752fa37a", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536646, "uuid": "c2046d89-8d05-4473-a6b9-e21d6a78c765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536646, "uuid": "3d0df4be-9b6c-4540-87e8-e562a4da3eb5", "value": "b51bb921feb37fdcfcdf2169c7335561.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec2118a-af3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648543812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543812, "uuid": "8970f49e-6dfa-4463-a965-b44362595907", "comment": "Malware payload (Formbook)", "value": "694199269a9a455dc84e388f592ac636", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543812, "uuid": "f5bbcdd6-e722-49a1-a9af-8d2c22a001f4", "comment": "Malware payload (Formbook)", "value": "7074a1c66e9cb6a328332b150d8011ee1f1c3a03318e960fcca03fce5bafa64c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543812, "uuid": "c544c20b-7005-4100-b898-b5e6c9ab13c3", "comment": "Malware payload (Formbook)", "value": "2151d500ca62c8ff90dd8c9a0f0a54b25c1624d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543812, "uuid": "57f3e97c-99ef-4bd5-aef0-89edf976641d", "comment": "Malware payload (Formbook)", "value": "81ec2912407c3ba7646e918df332a4aa78f873b4d848a9639d36fe7bc065246e82cafe9407b437c37a7871082ea5713e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543812, "uuid": "160303bd-768f-4089-98e3-aba4e20e1adb", "value": "T1D9341214B1B1D0FBE5A316B00E7BE32BDFA6071524A2924713906B9DBF73782931E706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543812, "uuid": "62f30f5c-6c8d-400e-bbf8-94eb34fd4311", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543812, "uuid": "377c265a-66d4-4c9d-9b6b-771229659bb7", "value": "6144:HNeZmoBjDPyYqYCI9YFEC+3i7LjtZ/faPwbAtNEcs1Bk:HNlUDlqYpiE53i7LjH/3IEcsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543812, "uuid": "387ad63c-d467-4b40-96fb-9f5492491b4e", "value": 247622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543812, "uuid": "ac206cf4-a324-4d5b-bf6a-21746caa3243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543812, "uuid": "10e951a0-3622-4ed8-a2a4-af67f4657b06", "value": "694199269a9a455dc84e388f592ac636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eca55be-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648537047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537047, "uuid": "80894cf7-a099-4419-964b-784ceeba6173", "comment": "Malware payload", "value": "c8954cd424b527298552d148edd33164", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537047, "uuid": "b1e8fe69-39a5-4810-8873-9e132b2a4995", "comment": "Malware payload", "value": "7154eb3cdc9fcbad073aa099e4767f3672106ec28133d2c32145ffe902f5575e", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537047, "uuid": "adc3293d-0034-4fcd-995f-5f2d8e0e5562", "comment": "Malware payload", "value": "f0adb6a63941289f584991fd1221e2c2caa93987", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537047, "uuid": "8f2cd93c-8446-4db0-b819-f0f8e2f16b9b", "comment": "Malware payload", "value": "90001270aceeb0ac909169491671053894c0c2512985ff77104d6ce71553f76a18c38c662e37a101acebb91e8230ce5e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537047, "uuid": "4bd8f528-ae0b-40d0-9e37-84b2ce3efbc1", "value": "T1681402672A941841D4EB4AB034E548E03FBEED97C4EA418F660BBB5F0132DCD9B8571E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537047, "uuid": "06010de2-b8af-4c2e-95b9-460e29adbc0b", "value": "3072:cLvj6QSHyBdAwMWdcQNzIaB1ZgqqubhhoDybkYWk87KsCwkZcyMkV7:8j6Q+yjfMWdTNzIafyubq3Yjq3B1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537047, "uuid": "2b38ec74-9433-4af5-bcf4-0ee82d210a2e", "value": 192088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537047, "uuid": "e5bca7b9-2141-4b0d-b125-9e1498e3eb4d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537047, "uuid": "57cb032e-7e7d-4bbd-9620-0a1b378d1b98", "value": "Specs & sample photos.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80abac1-af7a-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648570215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570215, "uuid": "929d012a-06fd-4fe1-9c13-271b1dffac42", "comment": "Malware payload (SilentBuilder)", "value": "a438359421319af59fc48bccfb22ba2c", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570215, "uuid": "0b2f795b-e67a-4d29-8ad8-3a7d37b6ed66", "comment": "Malware payload (SilentBuilder)", "value": "723395fe95e3d656d422955edae3e78b38c2665cac6e68947fcbd18817801e4d", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570215, "uuid": "80d404d9-f393-4893-b325-79f5d760c8ea", "comment": "Malware payload (SilentBuilder)", "value": "88f026eb44ebdba6d0f217c8890d2b25b734eec9", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570215, "uuid": "232114e3-3c3e-49c4-9ebd-507f47c212a1", "comment": "Malware payload (SilentBuilder)", "value": "0f2d670f8b1392055c96fa3a9faffbbeffba9dfc75a4d84142bd04a624f4713fceb9ceb62974bc55fe3951c1053d41b4", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570215, "uuid": "285b2c63-faf3-4dcd-82fb-97049d943d77", "value": "T11BB39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570215, "uuid": "19ec7e1b-c3a1-48b8-bf72-4d6bfe5174e5", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsM1:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648570215, "uuid": "5478fc84-242c-4822-b89d-c861b6160e01", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648570215, "uuid": "f937362b-2ed2-4344-bf11-97bd517c438c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570215, "uuid": "de23facd-2f56-4332-99b7-39015cd88212", "value": "Ihre-Online-Rechnung-023867-vom-29.000.2022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b034ffe-af37-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648541309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "1ce3e71c-de75-4aba-a145-f06e9f73c40a", "comment": "Malware payload (Heodo)", "value": "ce0439ef452d2f38c9fb95c5ed6aa804", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "e6646214-0644-4255-a87b-70e9e9521ce8", "comment": "Malware payload (Heodo)", "value": "723f1f229ce49f203c5ed1ae81f564485d6ea066df90c951698610904b4ba0a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "9da0891a-61b5-43bb-adb9-afc8dd04e3f2", "comment": "Malware payload (Heodo)", "value": "96d580046dca27509c2f773c9cf42410bdf05fea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "3249c737-7ee7-4353-94c4-f7b922d25ff2", "comment": "Malware payload (Heodo)", "value": "e409667b9fe3f9c3dc01a7b2145be0827d1bf00a3bcc89589e9a047fdc0c7f8a71fa6784e900e3f76688ef2c90336165", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "821c3c14-aca8-432f-b8d1-31190b8ee187", "value": "T118C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "2d021bab-3c3b-43c3-8e07-6fbc8dbd0499", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "e4b8b765-5601-45f8-887b-1c50a9f5cb68", "value": "12288:iUV7ciwHX3ew9aYU3pcc9inFijaQeL+nZBb:UiMX9Iuky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648541309, "uuid": "a16226a8-e0c0-4bbd-8ea6-6b0f7927bf52", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648541309, "uuid": "4778d044-3a9c-4719-802d-8ee014730886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "e5cf4c74-a3ca-4307-bef8-7fe13171fcf8", "value": "emotet_exe_e4_723f1f229ce49f203c5ed1ae81f564485d6ea066df90c951698610904b4ba0a9_2022-03-29__080821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b67a996-af37-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648541310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541310, "uuid": "1c7b084e-b7e6-41de-9beb-00e6ff69ee9a", "comment": "Malware payload (Heodo)", "value": "324adcd7609e3b71b86cea015a776056", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541310, "uuid": "2c6acfd7-6078-4bc5-8aeb-b738147f53ad", "comment": "Malware payload (Heodo)", "value": "72d77fcea3c6da9f538f811a1822d347453f4776c8cfaa9b2e513c6fd7a5433d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541310, "uuid": "82ea94b5-0486-45e7-b222-768affc2ba2a", "comment": "Malware payload (Heodo)", "value": "aa937ed0dd9e0d5087e664678632f78e002519cc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541310, "uuid": "be32d944-456c-4451-a911-5ca0781f67c0", "comment": "Malware payload (Heodo)", "value": "1732fe1cf784469186981edf1349551d7df8bb86c37b134de0310ad658307e2d2e6a84d87090725fd4a9c6bdacc161a9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541310, "uuid": "a7409b7c-e83f-4e53-b57b-8564381ae10b", "value": "T135C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541310, "uuid": "d2b05a26-3429-4e03-b8e0-57b9585269fd", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541310, "uuid": "da39148b-ed7d-488f-80f8-54713c80deb1", "value": "12288:iUV7ciwHX3ew9aYU3pec9inFijaQeL+nZBb:UiMX9IQky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648541310, "uuid": "1ffd16fb-0715-496e-aeed-818575da4bcf", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648541310, "uuid": "693640dd-681d-41b0-b648-0fab14662423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541310, "uuid": "a3e28679-70fb-44d7-9dc5-bc02c98dfc69", "value": "emotet_exe_e4_72d77fcea3c6da9f538f811a1822d347453f4776c8cfaa9b2e513c6fd7a5433d_2022-03-29__080823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad80f3c5-af2f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648537985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537985, "uuid": "b731e050-379a-4170-8e63-d2f3e71344f6", "comment": "Malware payload (Formbook)", "value": "cb474928be91bac1a4fc7959f16b1d4b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537985, "uuid": "0b647d2d-60b7-4926-a634-1963bb29aeba", "comment": "Malware payload (Formbook)", "value": "735acbdbd4869497d9309e4c9a431285d2c08e5cfb503b5bb944a458823567aa", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537985, "uuid": "002b7282-4528-4e33-aaab-745d6bdc234e", "comment": "Malware payload (Formbook)", "value": "2bb9a07098f18c0f65e0c4b5f496642fb2cd9f24", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537985, "uuid": "e078aedf-9a39-4e9e-810b-1e168166f621", "comment": "Malware payload (Formbook)", "value": "116505f71278fa9b35824c4c0b290756cbae2a4fdb69868b679a86b958df8014ff0c95f914071d3ffe58227e7b295e3c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537985, "uuid": "e4bf81da-14c6-448b-9dd0-121a0f2d40d8", "value": "T1EF440136A9C06B6BE4930E71C06EB36CF7F1AF9003255A47D78C3F7789F245646492A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537985, "uuid": "1eec9c49-2b78-4a54-b49e-0474e7c6e76c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537985, "uuid": "d59104fd-67f4-4473-8902-a22ed4426b5a", "value": "6144:LGiAC2sS4I72pTGclJf4cG5Gktenf1iutqLTm:b2sDVGgJfQGznd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537985, "uuid": "abcda78b-05b4-4aaa-bb7f-702a107f6e02", "value": 265152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537985, "uuid": "d5c9163b-37da-4fa8-8317-51d6bd53589d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537985, "uuid": "a36e8a61-07d2-49b9-800b-2da8cc0f67dd", "value": "DHL_119040 receipt document, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470c7065-af12-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648525357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525357, "uuid": "02eab476-567f-48f5-9cde-0b1168cf8b16", "comment": "Malware payload", "value": "e3f48591199eaa0ef4b287c144de4c12", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525357, "uuid": "6dc06948-28ce-4261-9e95-d7e934b3f66e", "comment": "Malware payload", "value": "7495ae45f748068707e3351b4f7eb0e4f2666981904f7e933fc53e9614f80e72", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525357, "uuid": "d55a08ed-823a-4932-a93f-6fbe6db972ae", "comment": "Malware payload", "value": "697f9da47f696436b1150a49e29b6514fa32b443", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525357, "uuid": "5f219145-882b-450f-a0f0-bd1042af82c0", "comment": "Malware payload", "value": "9b4fd1902f5fcfea6a3058fac2e1df82a6da2507d2402694aa9e7f22cbcf59baccf883d650ecb0f4cc8cc53e3f6e8cab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648525357, "uuid": "5456fb95-ad3b-4d18-b4a2-60060ba5d2a9", "value": "T142754C19AF291FEBD02FCF314AAD43131C9C5D4B62C62B35A77CDE58B196D0A09E3858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648525357, "uuid": "c4b0ccf4-3085-4cc6-b167-7cc1a38965d2", "value": "24576:ZSmZremF7MKEcrGD87erdybskPCIsdO88ANVUmUE1niPfPg:AK5F7hrGDWv4pVLUE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648525357, "uuid": "2a21b3f5-bd72-4903-b30e-7ec384d2442f", "value": 1629080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648525357, "uuid": "dfc46634-3bcb-46b9-8c40-c0dd8a3c8d52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648525357, "uuid": "78afe527-6b0d-4727-a677-bb25b6b15869", "value": "busybox-mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e24f21-af86-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648575257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575257, "uuid": "373ec1a3-ff20-4cd2-9294-808ff24ceaea", "comment": "Malware payload (Heodo)", "value": "c1bea20dd936c29bedc5aa7f914705c3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575257, "uuid": "38e43e3c-700a-4502-a2cc-73ac3fa426b2", "comment": "Malware payload (Heodo)", "value": "751b814923dbc1002d5c21c56de0ddb1f561a4e25b2be63a064cbc1aa6e38f0b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575257, "uuid": "6370c506-51de-4392-abed-1b31caa84d7b", "comment": "Malware payload (Heodo)", "value": "810a68428cdea9544f492ced2874bc85b4546c51", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575257, "uuid": "fe939f52-103c-4e1d-900b-c3fff0e47859", "comment": "Malware payload (Heodo)", "value": "e5be050afa460aed18aa7ccd62f39118c300d24e91ba69fcd28c4c618d81642e29b943705ef11ce353f1a4e947521f5d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575257, "uuid": "51d934af-4d86-4dc4-95de-36c05321d0ab", "value": "T149A49DC87582C132DE7B4B75C552CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575257, "uuid": "0e38764c-b57a-4112-bd68-70407cb6f922", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575257, "uuid": "ac886073-49cb-42fb-8fa3-0f13dee450e8", "value": "12288:myXvaWo3sPddfrkmEpBLsORdPDpFlrh5W:F/as1dDkxHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648575257, "uuid": "c9df5096-6e1a-459f-8514-fb9bdfdd2e16", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648575257, "uuid": "3c01f88b-1417-4ce9-9c82-bec7623c0290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575257, "uuid": "6ff4fb22-cb86-43f2-a755-ceb07389c946", "value": "emotet_exe_e4_751b814923dbc1002d5c21c56de0ddb1f561a4e25b2be63a064cbc1aa6e38f0b_2022-03-29__173408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759817eb-af26-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648534025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534025, "uuid": "b53263f9-bfd0-4b1d-892b-ad92edb6179e", "comment": "Malware payload", "value": "f7cdedfc08ffd66a1580f9396a419f7e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534025, "uuid": "b60b169f-7ba0-4c0c-b900-bbedd6acb7a2", "comment": "Malware payload", "value": "7538676c2833cf165c5f2210126a9a71c2026190984e47246b3fcaf4529462ea", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534025, "uuid": "4a0f1bd4-2543-4068-9bf3-78f0a693c43c", "comment": "Malware payload", "value": "487f8d3907ea3e0a0a7575ec5514e530f8eac006", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534025, "uuid": "32f96724-cee7-4366-9b65-257ef3af3285", "comment": "Malware payload", "value": "ff4736c8b4e9b2de91a4c3198083e4ad2cc539c259cdca1ecd1a521a2b7007adbb3877abcc6675920bbd6856ee4bbe54", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534025, "uuid": "3e150cb9-fb84-46e4-bd50-65016ab3b8e4", "value": "T1A0649ED173F0CA77E22715333EE597BAB2B9A564DE32C6836394CA4CEC320554532B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534025, "uuid": "35a38a64-1d8e-4f1c-b72c-57d9ef82e15c", "value": "1ae872d29ae3f3837d6c8d15813e59d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534025, "uuid": "427e38b6-b697-4cdb-9348-89859ac75933", "value": "3072:dETHGNaL1eByO0+yJvoXZ13zVMrJAZ/swfkCWNRTlJwrySDJUi3IXjUlziMN3ToS:yIuOkoX33WyZEwtWNRByDlPdOkiB8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534025, "uuid": "d326d97b-3122-4a9e-87a7-e3e0869cf317", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534025, "uuid": "cf849e29-9948-426c-b2af-bb4f63f36e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534025, "uuid": "50a2cf78-5962-4827-ab3a-0f224c5b8f40", "value": "hiaokpds.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ea47aa-af43-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648546649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546649, "uuid": "6f5af34a-b050-41f4-b6a9-a55ad347d1c5", "comment": "Malware payload (Formbook)", "value": "696f755b096c1b9d24e621aacc8ddab1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546649, "uuid": "742ac364-d141-44c8-a3b3-cb60b164adb2", "comment": "Malware payload (Formbook)", "value": "755563f333f32b67a9920bc004ca720c9ad07a7d04d0f29fbbc0e7c634973ef6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546649, "uuid": "ca30b7db-45df-4bc4-bb34-1732ec154ef7", "comment": "Malware payload (Formbook)", "value": "348964ad28acd9156b99a98c15206536bc821d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546649, "uuid": "a3ad7261-8758-45b3-bf93-e2ec8d25178e", "comment": "Malware payload (Formbook)", "value": "e8140d2cef908a2290b5ae1d8fc365c4e8cb7df4eff7ff1244533f46d01a4b1bad54c2c578b39a2b2f5d978f1e3120a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546649, "uuid": "f2853d24-9144-491b-abf3-a1156dddc1c7", "value": "T1E5057DAEA3918977C13327788D5B97F4AC1A7F402F2498472AE83E4F7E386503535297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546649, "uuid": "877e69bd-f14d-4446-99fd-5c1f1920fda8", "value": "dbf1300428baed4574f07bfbbe98b092", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546649, "uuid": "147e1bc1-45b4-4b45-a058-5e741f426d94", "value": "12288:k8XoVKkPa3yFwp0ShMnn0sAIpxxfBy2oYWVwyUAPdCL9/ZHi:zYIkCyFwXhM0jIpx+h7UAPdCLHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648546649, "uuid": "133c47b8-f0b3-4605-82a5-559b1025c5a0", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648546649, "uuid": "a4e95e8a-fa11-4c05-94fa-6309171f69db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546649, "uuid": "a85b8e1a-9f62-440a-9b3a-20e9da764454", "value": "comprobante de pago SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0e6a41-afa7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648589654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589654, "uuid": "812913df-51af-450c-8c63-54332610ade0", "comment": "Malware payload (Heodo)", "value": "cc1309db3179344ebc5d6ee7a6f68399", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589654, "uuid": "e63881ac-3319-4ad8-a6c2-8e0aba42bc9a", "comment": "Malware payload (Heodo)", "value": "75c6ba64d5475adb769cbbb7bba0e1005b666b5c99c385b37266e83a73cae710", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589654, "uuid": "61119c54-e246-44e4-8b7e-0ae55cd728fd", "comment": "Malware payload (Heodo)", "value": "bf7a370681c80d3de53f0eda3a530ef5fe77b395", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589654, "uuid": "666eaf40-6e76-4a8b-b4a1-ec523f272a88", "comment": "Malware payload (Heodo)", "value": "e3b0235cd69f40fc537b55224b8bdfa4259a2b14218f5ce2f5af0dffbc73348e3879aca5ff6c3d56985a9428be9b7921", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589654, "uuid": "5b3bda2d-aedb-4363-9fe6-3e395514ade0", "value": "T1BDA49DC87582C132DE7B4B75C652CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589654, "uuid": "64bf5459-1cdf-4bde-ab1a-f9da19cd1600", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589654, "uuid": "33e556c9-128a-4fca-8e5d-57f385e72404", "value": "12288:myXvaWo3sPddfrkOEpBLsORdPDpFlrh5W:F/as1dDkZHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648589654, "uuid": "abf3748a-b0d2-4668-8d6b-0a92465bfe27", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648589654, "uuid": "2ecfd2b8-7267-4ff9-a7b3-434e989a48c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589654, "uuid": "3d751d90-b3a8-4d24-acfe-5989f866e347", "value": "cc1309db3179344ebc5d6ee7a6f68399", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00bd8310-afa8-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648589664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589664, "uuid": "300e907b-8422-4127-9d7f-3c62aaac9c2d", "comment": "Malware payload (SilentBuilder)", "value": "d184a795f1538be4236624c2962fea6b", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589664, "uuid": "13c3ca94-c0c1-4c3c-8763-4020ad29701a", "comment": "Malware payload (SilentBuilder)", "value": "763aa1575b640a655dc00661ee174dfe2841c1e63072c4cfa50ece13c99e6756", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589664, "uuid": "d20c5304-abed-4d65-835f-e5a926ee840e", "comment": "Malware payload (SilentBuilder)", "value": "0da8fb7c74685b3ad11d0671f90b1727046cd6ae", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589664, "uuid": "3c5ac3c7-3eea-4d5c-9460-1c6458ca8d74", "comment": "Malware payload (SilentBuilder)", "value": "9ab539c08e4a00fb2ef18b923e9a4f2965d5f1f8ce251e4ce45cc97f239356f32f26eb6e85285451e8c38312988dc004", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589664, "uuid": "b4ac16e0-f973-47cc-b1ea-b766b01b1d30", "value": "T18EB39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589664, "uuid": "3bec2bf1-46b6-4557-b8d1-be704b1dc1e0", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMS:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648589664, "uuid": "47b6671b-a029-4de9-aa8a-6eedbc9564ba", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648589664, "uuid": "7616458d-712a-4209-8efd-dc3ab52cc797", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589664, "uuid": "01069a1c-ab5d-41b3-993d-0596c5c77d4e", "value": "d184a795f1538be4236624c2962fea6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bec06b-af0f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648524154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648524154, "uuid": "757648b0-5702-4598-b03b-b3e36b6685f0", "comment": "Malware payload (Loki)", "value": "8dd69a7371891376dbf89405104a7202", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648524154, "uuid": "a4341bd5-fba7-40ea-aef8-0e0463c57b2a", "comment": "Malware payload (Loki)", "value": "7642c30cee6aa8c2ca74e267f4522ec280ae3fc402056eb07187a10dd0d92885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648524154, "uuid": "4116d5f9-e9e8-40e6-bcc7-267f0225e863", "comment": "Malware payload (Loki)", "value": "0da568ad384aeaaf038154e2e0137af1adc21619", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648524154, "uuid": "f95f01c8-1c4c-477b-b624-f574b4e3c909", "comment": "Malware payload (Loki)", "value": "b9518a2e9011e80a06c9349fab758539e350bfd2f4d848e8f973ef33a56e0110a9187d6e2bf2227a4baba51774de6249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648524154, "uuid": "1902a1ca-5ec7-4a51-a310-c42f4057844b", "value": "T126341290B6248033E87292721E758B9FCEAE193135725F4347807DCD39AF6D1A81FB68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648524154, "uuid": "06e8a1e8-02ca-45e1-82ac-735bd927cafb", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648524154, "uuid": "d4f85cc5-3baa-491a-b2c9-0b84223a121d", "value": "6144:mbE/HUbTyonkv5KWQMqhXF268zChYt6Wj0/tsSngK0Pf7bL:mb/ev5KW2P2X+hIQ1qp7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648524154, "uuid": "ce90efc6-3145-484b-bea9-7755c0f1b0f9", "value": 247844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648524154, "uuid": "0c79a09f-bf31-4e5a-a45e-069d28b874c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648524154, "uuid": "6fdb7554-d95f-4f20-aaa3-8bcbba2fcd71", "value": "REMITTANCE PROOF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e013d0-afa3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648587582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587582, "uuid": "8bf8317a-f912-4c97-b9ff-716a26a2b01f", "comment": "Malware payload", "value": "3416e4a4905c9c32a276a8819d465c49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "wslink", "colour": "#2273A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587582, "uuid": "9bb3c62f-495d-447f-a916-d693bb4a5fbe", "comment": "Malware payload", "value": "770b43f3a9950e89e644e3d230b17fe431382988749aff4dd37af2b32571ab5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "wslink", "colour": "#2273A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587582, "uuid": "96a92c6b-4b98-4767-bb2e-c725d2603e18", "comment": "Malware payload", "value": "961fdb593f7a901ac1305a69dfc0ece31301cec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "wslink", "colour": "#2273A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587582, "uuid": "cbf2fe72-3c87-42d0-ae19-953a7c955cbd", "comment": "Malware payload", "value": "c7571aaffdb81978632d23af5135e0b20bffef7590eefc553ffc0c36c38d17661569427701712969f8f5e008a950ff5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "wslink", "colour": "#2273A6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587582, "uuid": "ec38fb6a-d6e8-4d63-a085-8d1694de2da4", "value": "T187254B13AB4455E2D9B7C178A47B821397F0B45603B0EBEB97E4A5790F93FC562BA300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587582, "uuid": "cac74183-dcf5-4ffe-af6e-26b083b3e787", "value": "924e3a91a9838185230da3ffc45ff04e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587582, "uuid": "21e09210-125d-494c-b8ef-b0418bf487b0", "value": "12288:QzoMLh8jiGbLFvsLjrurTveI9GyxaxtGgIbxra1CsaYk:9MLh8j9LpcjrurjeIUyaI9r5sa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648587582, "uuid": "c3a4575c-91aa-4e40-96d2-7b5ea763fd6f", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648587582, "uuid": "749c18ff-61a0-4bde-bebb-57bf5d90e96d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587582, "uuid": "bcf235e8-8df8-43f7-9222-3f2122f0b959", "value": "770b43f3a9950e89e644e3d230b17fe431382988749aff4dd37af2b32571ab5b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9984158b-af38-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648541817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541817, "uuid": "7c06b0f8-8ab9-4a20-9ac2-7d8db66434b6", "comment": "Malware payload (SilentBuilder)", "value": "8b1d9593fe06c56af28e20317bad6575", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541817, "uuid": "4d50bde5-5af0-437f-a230-61879cda9d6b", "comment": "Malware payload (SilentBuilder)", "value": "77b6ad6eef00fee7fe7375467e9721c3717b843fd4de508c68b5a1e76ba1dc55", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541817, "uuid": "62bc41f5-1b8f-415f-82bf-8e27ebd7239c", "comment": "Malware payload (SilentBuilder)", "value": "67c2b590137562ba9da0dd3df496c5bc786bfe21", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541817, "uuid": "047bceb8-5f93-442b-851f-0f0ae578bfb0", "comment": "Malware payload (SilentBuilder)", "value": "eb3be55f2a83140cecf5d9d9f5b20e58275ee98070894b77522b85f2ec1f52c231ef8230e67060ede75e938820932232", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541817, "uuid": "23c5f591-0c59-472c-92c8-514941898d75", "value": "T14AC3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541817, "uuid": "e257a88a-697c-42b8-8493-b81e2faab305", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCR:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648541817, "uuid": "01d231a3-f2c5-4469-8c39-98643473063b", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648541817, "uuid": "12cffe5b-6a0e-4996-bd98-db970ba7b106", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541817, "uuid": "6fd88dcf-a5de-4c96-845d-63886c99ffe5", "value": "SecuriteInfo.com.Exploit.Siggen3.30291.3570.31783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bf3acf-afb0-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648593154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593154, "uuid": "7a8c215d-399b-48aa-9e39-e12bfacc0f69", "comment": "Malware payload (SilentBuilder)", "value": "3837026a2c7501b53ff44b6f5748233f", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593154, "uuid": "76275d1d-68e6-4493-b4ad-88aff988f54e", "comment": "Malware payload (SilentBuilder)", "value": "780842ee666eee15433cecc5089ad60af4b2d3c041d601a6863f9d6b036c7934", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593154, "uuid": "3436d94f-bd4e-4de8-8e60-e672b59ada9d", "comment": "Malware payload (SilentBuilder)", "value": "d29c177ceafe7c9f8010f5d45ba341cd8d50982e", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593154, "uuid": "4764fbc3-4d1a-418e-aa47-eaecadf22462", "comment": "Malware payload (SilentBuilder)", "value": "011db82830c600863064c1ee9e6919f90eb80511e12aa44e07b92aba0ae323f2b976ac7f9580b8a9b6defc9fd562f4c3", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648593154, "uuid": "53c275aa-d7db-4f5b-bcad-24d6cf7651e3", "value": "T16DB39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648593154, "uuid": "10920c13-ebf7-4c71-8ae4-b8cccfa394e0", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMe:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648593154, "uuid": "d8f08521-1f66-4c13-856d-0b9deac72b83", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648593154, "uuid": "67be9995-9fd9-4025-bea1-ead2eb47e174", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648593154, "uuid": "f0c4f26c-7981-401a-a9d0-cd8031e79e1b", "value": "3837026a2c7501b53ff44b6f5748233f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4163a5e3-af8d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648578176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578176, "uuid": "c79bfd7a-25d2-46f7-8f21-7c7a48849866", "comment": "Malware payload (SilentBuilder)", "value": "ca3ea4f588bebf151473d967b105bb8e", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578176, "uuid": "d0243042-a124-4d19-a86a-4caba55fe237", "comment": "Malware payload (SilentBuilder)", "value": "7861d640149eb159ed9164bf2688e262d0a1af003c88cd7c09cd0829d39cc9d3", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578176, "uuid": "5d92288a-ae38-4e29-a125-ec24c3e634bb", "comment": "Malware payload (SilentBuilder)", "value": "6f1df7e98caaa27b617e6c8abe3a6d4145f86414", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578176, "uuid": "9685b471-4030-4b53-83f6-3c813bd69256", "comment": "Malware payload (SilentBuilder)", "value": "a564b815523267d60536579a7a770e9b06d04179362e978c5f820d3663d48ef3480613961cd21d859aa92c0caba816d5", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648578176, "uuid": "92e08e08-7a44-4f52-8a65-60be22bb90da", "value": "T132B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648578176, "uuid": "4d95b2fd-8de4-4c5c-ae3c-fca9e86f7c94", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMd:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648578176, "uuid": "20271c54-ce87-4d05-9c8b-b99139f895b4", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648578176, "uuid": "2a455909-62b6-466f-9ca5-53665c3fc3f4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648578176, "uuid": "9f5c32d4-4456-464b-aba5-9cb3f9d7e197", "value": "ca3ea4f588bebf151473d967b105bb8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce09bcce-af50-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648552213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552213, "uuid": "93522645-7082-4a1e-9141-1fa58307827f", "comment": "Malware payload (Heodo)", "value": "c17786f7b527ec1fbaef83815a4425db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552213, "uuid": "a92567b0-5f89-4ecb-b638-6df0870c3eba", "comment": "Malware payload (Heodo)", "value": "78bfcb0ac7355170ac9634ef1c252c11c90982923b94dfbac0e1db882d75e0fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552213, "uuid": "48d9c09e-5b3d-46f6-8ebc-115bf6a102f1", "comment": "Malware payload (Heodo)", "value": "486deada992658b2ffd592e2e5cf4e01c1963eb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552213, "uuid": "69d87f99-4b23-4548-b9e6-67918b17374e", "comment": "Malware payload (Heodo)", "value": "c78bdf85dee3f051ac5fab50c10c93920481a161f2dfdc009cd5a4572a950cf1da769f639821441d3848d170b7e1994d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552213, "uuid": "b645552f-0746-4fa8-a8d6-29c82fe7babf", "value": "T120C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552213, "uuid": "e92794be-a5b5-431e-8cb5-7005c4616be8", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552213, "uuid": "fe2a7fd4-da79-4f6c-8fdc-0d02bc468c38", "value": "12288:iUV7ciwHX3ew9aYU3p5c9inFijaQeL+nZBb:UiMX9IDky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648552213, "uuid": "03499e34-0d04-4bfc-a136-284c28d314b8", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648552213, "uuid": "3ca6ca28-45ed-4c6b-861f-499b32a0ccc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552213, "uuid": "ea8a3e3d-846f-46dd-8efc-746ecfae5034", "value": "c17786f7b527ec1fbaef83815a4425db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830b43eb-af51-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1648552516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552516, "uuid": "9f4f5bdb-bb2b-412f-a7f9-c4856ec2b644", "comment": "Malware payload (AZORult)", "value": "8674572a45220229c391d194968052ff", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552516, "uuid": "0fc7bb37-0b0b-46ba-a639-3b120e4ba332", "comment": "Malware payload (AZORult)", "value": "7961043e036570e36fc2331c650f6062933d7ecd53fd1e388104c75492fa2bff", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552516, "uuid": "fe92cf6c-67ac-4dab-8fbd-43c3ac427d0b", "comment": "Malware payload (AZORult)", "value": "2b866726876a28ac6ffb61cc068588297322facb", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552516, "uuid": "e36e75c8-5053-496e-a6f1-f6139c0ee65c", "comment": "Malware payload (AZORult)", "value": "7f5fc408253804c4f699e894f7d6dc61960924167502755e531ca6ace91c986c6b7f867f04ff6ee1cc1879e19fdad051", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552516, "uuid": "da8326ba-1096-4f7f-b679-bb885da235b6", "value": "T17951664E708B74181635AFF3DE5B144DAAB34387957A05603A15ADDBCE3623CA394CAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552516, "uuid": "d00b8cc7-2b8a-456d-a03d-e6a340ecebc8", "value": "48:JW59a+v6ZGCMkunhTS2wKJJ01rSA0CGZWVP+pIypeipt90BdWkO:EvLnY+J01rSAo8Zwzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648552516, "uuid": "95fae61b-4930-4009-be75-82479cedcf52", "value": 2715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648552516, "uuid": "ea173912-3dd4-4f6b-874f-b370d537271d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552516, "uuid": "167990f2-73ca-4a62-a44a-085bce67d7bb", "value": "2295_901_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a4140c-afa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648586563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586563, "uuid": "c36969c2-4232-4048-862e-e13b6576ed69", "comment": "Malware payload (SilentBuilder)", "value": "8197581e4dd42a18d8dff404df72802d", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586563, "uuid": "9fcbd212-c5e4-4b8c-bd41-e80d81844678", "comment": "Malware payload (SilentBuilder)", "value": "7978e1782a2a41228368d0df94c9c2d6485874d86eb57d38bcd0133b65eb5fa3", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586563, "uuid": "b41f739b-03e3-4fad-843d-999bcdc8623f", "comment": "Malware payload (SilentBuilder)", "value": "6af39df2a4e4f6acd0fea3737f3beee3cf9649ce", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586563, "uuid": "3664e890-cf5c-46f3-8380-01f72c850dc2", "comment": "Malware payload (SilentBuilder)", "value": "318d6981d7fac9c96cb8c5d49e6dc2b548905d56b3c691cb7d1a2955f48217728f3b31b3ed4adfffb57d666260f7b159", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586563, "uuid": "7e9f1bc6-17fc-4f55-bb36-eebd491de13c", "value": "T135B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586563, "uuid": "7e83238e-7c77-4366-a0d5-d04654863b0a", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMS:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648586563, "uuid": "12910da2-5579-4930-b33c-62190a6dc93d", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648586563, "uuid": "14e449f3-29e3-4ced-b863-7130023cb29a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586563, "uuid": "9bf4c281-4619-4d1c-afb4-ecaec0c4b4e4", "value": "8197581e4dd42a18d8dff404df72802d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e62f99b-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529128, "uuid": "faec0ec1-a3e7-4666-a431-b0d0821b6df7", "comment": "Malware payload (Stop)", "value": "78ada58842629a7c72f4ffa09877332d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529128, "uuid": "62040ed9-5e21-4022-bc81-9a4b8495e913", "comment": "Malware payload (Stop)", "value": "79a45215fb18155b4ce7d6d4cde5351b7da9d25b0850431fd7f1b8373e9041b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529128, "uuid": "4a5dbbaf-fe7b-42a0-ab5c-651dc317a152", "comment": "Malware payload (Stop)", "value": "b23c9b062b87df292edfb0c10ad83d1c26a91d37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529128, "uuid": "8f85f7bf-5388-456d-8be3-2d00af692c72", "comment": "Malware payload (Stop)", "value": "0034b7efe20b1db6afe906eb84b0e4795d3fcc7ad6a44bd5210a6f25932494f60e17176f17c4aafecac05e534a6d79d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529128, "uuid": "b020a02e-ccdb-42ef-82d2-64d088366f36", "value": "T1EA050210BB90C435E1B326F459798368B63FBDA15B3595CB62E53AEE1634AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529128, "uuid": "ee938a54-81a8-420f-9a20-cc16dbdd1dcc", "value": "962dcf4a4b969d5194f73601a217ba6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529128, "uuid": "6f3a67f1-d91e-4460-9bad-5f88ba79392a", "value": "24576:TJEqWxuhKqz0oCGd4BxMIf9AXTXVJDZH+T7L:TRsqz0oldMryZHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529128, "uuid": "f3dd7699-a5b3-486a-a291-b766fd70888a", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529128, "uuid": "4e20d4fb-4e17-47ec-bdf5-21cd81ec33be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529128, "uuid": "647e692f-7879-4ff3-bc05-5f7140356307", "value": "79a45215fb18155b4ce7d6d4cde5351b7da9d25b0850431fd7f1b8373e9041b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6293c22-af24-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648533382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533382, "uuid": "efd2e048-06fa-42ea-a682-a7771032bec9", "comment": "Malware payload (AgentTesla)", "value": "424e191292d5b971688a60ad1b289ef9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533382, "uuid": "eb645254-74d6-4df8-b338-816fe128a46a", "comment": "Malware payload (AgentTesla)", "value": "79d7e1b3e651eae4bcfa82ba8200fd8cb1d979442b5dd79cbdba7077aa101cfd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533382, "uuid": "f5442e29-5caa-4b27-b909-e04cf00f5097", "comment": "Malware payload (AgentTesla)", "value": "e570c1d47a71d4e18432c17d90b618e8f92f2c23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533382, "uuid": "7f3f56dd-203a-476c-bfef-5df8fb26fc9a", "comment": "Malware payload (AgentTesla)", "value": "591cf64611a956bc5c898011a43488e6ad6a007612d5bcdc4d06c0e55011ccf4bc65786967810f35e58a9d1f6badb012", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533382, "uuid": "d2229da9-cf40-4790-8a10-2ee1c342721b", "value": "T16EC32AD2AB44CE9BE96E5D70C5A6A49C3719AEAA84C04F8EF4C135DE0D37158312FC4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533382, "uuid": "6ff87322-3d46-4eaf-a083-7574980a8c5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533382, "uuid": "c4f16f7e-d556-4147-bdfd-e614a6767369", "value": "3072:NONvX5npAdI7IcIclIyfT5zti2CD408i:ANvX5npeI7IcIclIyfT5o2CD408", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533382, "uuid": "28e2422e-4446-4f99-a255-a5618e187997", "value": 126464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533382, "uuid": "ce97925c-9909-43c6-a3c0-b3e7eeb3557d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533382, "uuid": "6fbd0fc0-bd6a-443c-b3d5-aef43b54d881", "value": "DEVOLUCI\u00d3N DE PAGO.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3956b85c-af31-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648538649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538649, "uuid": "f350babb-67cb-41e2-9ed4-e99888056933", "comment": "Malware payload", "value": "c33f47cc62bdee557377c85787827905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538649, "uuid": "a21006cd-4404-437b-bdfc-a82798b25c08", "comment": "Malware payload", "value": "79e5eeb1587ff6a8221660e3f7ec7dca0ef40b3c697954d00cfa9021bcdbe433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538649, "uuid": "1a75c978-dae2-4f4b-9da4-7f8558c0c847", "comment": "Malware payload", "value": "b0445811c2aee4c0cb299038bdeb482f2b0458ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538649, "uuid": "b185e4a8-5f25-47c5-9348-667828660816", "comment": "Malware payload", "value": "717d5e0a41ac935e994d3293bb5ebe9d54c1bd9044347cddff4236b1a6d96e1c8d931bf2fdd4835908499b82645c857c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538649, "uuid": "b191efcb-452a-45d2-bfb2-c5b0b06c04c3", "value": "T18676125ED2E8292FD078573285735310987FBAA1BA578B2287FC784EDB393101D69E13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538649, "uuid": "04d12a98-c96e-418e-bc9f-76f66428abc8", "value": "98304:9hAkpbEANbqysYJv/axie/72zJHmF9nuwo9O+93QCt5WdEpUq:NbESbq1YJv4CVyxuwYO+SWeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538649, "uuid": "bf6313f0-2b4f-4599-a4a5-d2166cba0db3", "value": 7372029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538649, "uuid": "272de46a-004e-43ba-ba64-6a7d6034f6ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538649, "uuid": "47edc0bc-ea9c-4492-a694-0be9437c4b44", "value": "c33f47cc62bdee557377c85787827905.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8b475d-af5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648557468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557468, "uuid": "cc8dc02c-dd18-4c4e-87f3-20924ad4f173", "comment": "Malware payload (SilentBuilder)", "value": "1ed9928c32b89b5639d2363ee0f785bc", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557468, "uuid": "98ed4ba0-daad-4f40-a0ea-b6234cc59823", "comment": "Malware payload (SilentBuilder)", "value": "7a5b147c2be82394748096af958934a7f6e81d8f44c3573b403a55d3d9dc442b", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557468, "uuid": "4f0b3886-0d0f-4570-bec9-2c4ba8e92f8d", "comment": "Malware payload (SilentBuilder)", "value": "4797980e5d7fc70c84abb46e16f651551a48f0fd", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557468, "uuid": "e2e117e9-5f97-4913-b1dc-8dd4e3903b91", "comment": "Malware payload (SilentBuilder)", "value": "4ccae39f1030ae39bd209aa0a835f10dac5452741a3bc64db809d671c482ebf88348e95547aa3491813bfda67c4213cc", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557468, "uuid": "ed49ef51-2d74-4a71-ae91-669ddab3d495", "value": "T148C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557468, "uuid": "a98d612a-a15d-4492-a168-fa82cffe7245", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648557468, "uuid": "cf7501bb-b372-47c9-bd77-c1d51efc0d7e", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648557468, "uuid": "a8b8cdcb-6ef3-45ba-85c1-1644439b5c17", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557468, "uuid": "c7528d1c-e8ed-4e77-b753-0c844d1e058e", "value": "iMedPub LTD_4.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f9a135-af72-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648566473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566473, "uuid": "53866ec0-8669-4c52-a112-ca3e8db2b2a5", "comment": "Malware payload (SilentBuilder)", "value": "22960fb274223ba07a9bab8c3240c68e", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566473, "uuid": "af4c4b94-9b3f-4010-bd74-5eba38e67e96", "comment": "Malware payload (SilentBuilder)", "value": "7aaabe1538be02ec9f5621ff8cea6980d26a8a49c605afa4884e46847efb76e0", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566473, "uuid": "21191f1e-dd51-4fae-858c-464860f86bdc", "comment": "Malware payload (SilentBuilder)", "value": "0211e09cc3dd6732bbdf4f514751c875d95f685e", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566473, "uuid": "8af7140e-e1bf-41c5-a3af-027bdf2ae1f7", "comment": "Malware payload (SilentBuilder)", "value": "ae1f3c02887bb226d32c4e9556d9acd1c0530450041fd679f9418c9da38d8b5de7d42686d74292039a3c26f06f41f5c1", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566473, "uuid": "37880deb-f340-4143-b32f-f3e435822b8a", "value": "T1DBC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566473, "uuid": "7acfa2dc-0741-4b35-be4e-4a69a3af6f45", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCc:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648566473, "uuid": "472efe14-df73-4bc5-a870-e7ecfa945053", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648566473, "uuid": "328b0e9d-f1b5-4b81-a365-31ebd6726b7e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566473, "uuid": "569defa6-4770-4fb1-952b-a728301f8f2b", "value": "22960fb274223ba07a9bab8c3240c68e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51db236-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648536279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536279, "uuid": "4261268e-fa97-421d-a3df-ead774c896bd", "comment": "Malware payload (AsyncRAT)", "value": "dc3a51aff947f48a0abed64d7b6e2509", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536279, "uuid": "5a209721-6dab-4984-86ec-8d223e5e5b17", "comment": "Malware payload (AsyncRAT)", "value": "7b0de2532b96ff0f42c04e48d7515c4dbc8356f74443acd4a94d185d9a9702ce", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536279, "uuid": "6b47b4d1-f1e8-4dab-8175-f9d5ec589758", "comment": "Malware payload (AsyncRAT)", "value": "6d7285c2a902103edc3fab427d11efc0551f368e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536279, "uuid": "72ef606b-de4a-421e-abf3-e645f0b5fc6a", "comment": "Malware payload (AsyncRAT)", "value": "0efa3aa705a9159e3130071470edcbded986f9c95488bef40816fa4935e471532b71da1dd983daff230b72591a9a8e77", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536279, "uuid": "bb9f963b-c1b4-45fb-b614-1b87dbae2824", "value": "T119C3BFF027909DD2EADE5697916D9D8D2636217BFEC620CC404EFBD91B773418E0E882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536279, "uuid": "f2d10ba6-b46e-417e-9c32-de99d82f820c", "value": "1536:6jM85N6O70ZPjQbiYasnQ7UoUo40JFFB9faIzwXK/K9nSx8qvBsbOC9TWLGu865p:6jM85NDYsbiPf8FaFPvzNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536279, "uuid": "8a7ffcdc-c892-4b7f-a845-bc1d77f0ae8d", "value": 123505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536279, "uuid": "29c61058-0013-42a7-a18d-4388e995bfe7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536279, "uuid": "3dca10b7-7969-4153-aa3e-8d69432e8e4d", "value": "\u041f\u0440\u0438\u043b\u0438\u0432_83-6803391309_202203029.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61b62b3-af66-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648561702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561702, "uuid": "97fb23e3-0e4b-43a2-87e4-160772c77bd2", "comment": "Malware payload (Mirai)", "value": "bc879c9e531b5cf05925851413e3cdae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561702, "uuid": "f4a2a9ff-9644-42aa-9887-3697a0a9c421", "comment": "Malware payload (Mirai)", "value": "7b26d67f1ba19c92ef25f03e42b8857a91b9b459ac482c95d3c50d31075fec72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561702, "uuid": "6eeacb4b-fac4-499e-8e03-8faceb11f88d", "comment": "Malware payload (Mirai)", "value": "6d38f414244cc6046cc68b21ef09d1b91e22b29f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561702, "uuid": "c4cacdf8-a147-4b6d-902a-f069e4295ec3", "comment": "Malware payload (Mirai)", "value": "bad69f454c0dc812754ed3666a6446ef82119f4ed69d9eeda67c156601edb2fdd0a6aca93c0181c4927ef81d76c1276a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561702, "uuid": "89725ff4-7ed1-46ed-b8b5-4174c6e9f9c0", "value": "T11C834C20A97D2F26C4D0B57F22FB8351B2E2260E1AB4965D7C760F4FFF1468068572B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561702, "uuid": "1db9647f-7aa5-47e3-809c-fcd8a54fe825", "value": "1536:CvzWH2D7lAwtzeFT6fcBjeqDUNxNcFKhlki6vFf3fAfiqFtaFFp:MTzNcHvFHAffFt+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561702, "uuid": "44e656b6-1693-444f-bfe5-89ab1907e6d1", "value": 82764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561702, "uuid": "40cda0de-d03e-4a73-9cf7-2474dae205f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561702, "uuid": "8cd1b9e7-0cbf-46be-9a1b-4b4c838b76fb", "value": "bc879c9e531b5cf05925851413e3cdae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82565e88-af6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648563682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563682, "uuid": "b38c9d6d-acb4-44a2-96c3-56099a4bc469", "comment": "Malware payload (SilentBuilder)", "value": "d95dea8016ac220d47320aa21b256461", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563682, "uuid": "2d7ccbcd-a912-4596-893f-1825f6b799a4", "comment": "Malware payload (SilentBuilder)", "value": "7b74429180051edda738a7d1142e2d6eff97319e791962a7ba14d2d682a6d9f1", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563682, "uuid": "7c159d73-9e2e-4146-9d9b-8a2d1ae86418", "comment": "Malware payload (SilentBuilder)", "value": "fc9167fed940ff54064233622317e261b743c842", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563682, "uuid": "7451eb47-b53c-4eb0-857d-d2e326723f18", "comment": "Malware payload (SilentBuilder)", "value": "4eaf02bf29e06db2282ae8b0f7cd6b4ca346388fd95908715f8c516f69bb1b9bdf0f3eaf90c4fc7609b5408b54bee937", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563682, "uuid": "f90b8d39-ee25-42e4-ad53-df77315db539", "value": "T176C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563682, "uuid": "c1903c2a-2fa4-478a-bb41-c8840e299527", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648563682, "uuid": "c5b72bc9-7007-4037-9760-44c4f8a10b9d", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648563682, "uuid": "0a93f0bf-841d-424a-b54b-5b99d92447cb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563682, "uuid": "441427d0-56f2-45d9-8878-62e830b40302", "value": "iMedPub LTD.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838d46ad-af63-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648560248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560248, "uuid": "d3209974-2b53-455a-adf1-d3ff118001ed", "comment": "Malware payload (Formbook)", "value": "6cf383648060026ba3796e811b8295d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560248, "uuid": "99184d28-9144-4f2f-adc4-cb584c7c4997", "comment": "Malware payload (Formbook)", "value": "7ba4005d4ce0c88a425a076e8b82e32bb248944a93ddbd14bb4fbda4b90c6422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560248, "uuid": "4cc0eacb-a9f1-4c5c-8f59-25801f4e5a71", "comment": "Malware payload (Formbook)", "value": "bc507c75f83bc86ec6b03f942c6b7fede7c3b754", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560248, "uuid": "85c13c63-da72-4ab3-8c97-10bf3c66a1d2", "comment": "Malware payload (Formbook)", "value": "62b205ad7964127e6cdbebc0e0f7d527fd0f331eb430214b8e043a3eb2680c87c980c29c14eaafbd63d165ae94133972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560248, "uuid": "316a64bb-6630-4b92-a41b-f707411816a1", "value": "T1F6D49D71E2F8AF9BD53D93788071845677F5D822E334CA4EBEE910C64492BC24B32B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560248, "uuid": "79552d81-b108-4c22-b628-7daae1adf465", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560248, "uuid": "2290d9e9-be0e-4be5-90c7-abb479198991", "value": "12288:k4N47UctuwiVYZdo9wED2TYsO5Nrhn0urbZMniNU91H7Oc:k4N47UctuwiVYTswXO59hn06biiNaH7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560248, "uuid": "be165691-04cf-4787-8410-a528663fe3a7", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560248, "uuid": "ec4b57e7-a5bb-495e-ba78-f2a23b8be782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560248, "uuid": "6df7898e-7537-4b00-b823-bfd0326a8deb", "value": "Swift Ref MIDLGD12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e613b6da-af35-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648540656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540656, "uuid": "bea7b9a8-d412-451a-9a45-299a0eba2dae", "comment": "Malware payload (SilentBuilder)", "value": "fe424e8d586527633208b7e60c021931", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540656, "uuid": "e286f913-825e-49f1-8f99-46694ed65719", "comment": "Malware payload (SilentBuilder)", "value": "7beadd8524b68364f7bcd7de4b413b90ccd64016d6703a27462d56ee699c600b", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540656, "uuid": "141f4649-2ea3-428d-98cf-2a9c5b3d007f", "comment": "Malware payload (SilentBuilder)", "value": "ffdb90c885aa1c93bae0820a315a38c72237b621", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540656, "uuid": "fd7c7aee-5c90-42e6-8a39-03d99873fc92", "comment": "Malware payload (SilentBuilder)", "value": "646180d4a72da4eacce56545da33708f832d565bfb24a3c1b324931c019b94ef762970da3169922e84c221fde01633fb", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540656, "uuid": "b7f8cda0-d83b-4205-aaf5-a275d22335f6", "value": "T152C3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540656, "uuid": "7caeb0e5-718b-4cba-a412-48cd4b163106", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCR:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648540656, "uuid": "b474cc4f-efe9-4ad1-a6b3-3bfcdfa8c6bc", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648540656, "uuid": "5364969b-596e-4b9a-91ce-fffc7c9b1d8a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540656, "uuid": "29b7f8d7-efd8-435c-b967-3dd2bf6bdadb", "value": "Opast Publishing Group_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c188cb-afa0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648586552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586552, "uuid": "aae05a36-10c7-415f-9598-c49c2de4ec89", "comment": "Malware payload", "value": "8628dc97c8d27d1b3dfcea2952a12b2f", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586552, "uuid": "f92af8a6-7c6b-4248-b477-ca6486c63edb", "comment": "Malware payload", "value": "7bf1dc8f35c99f9d3a1d337a70482f7818a82fc80d4e3b9476471b52e5b3604f", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586552, "uuid": "c10d368f-33e6-4cf6-91e1-eda866335a2e", "comment": "Malware payload", "value": "8776a7ff7614dbb3be092ee9f49113c1189364b5", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586552, "uuid": "3c446548-9f39-4503-b981-cdf1f9760ad5", "comment": "Malware payload", "value": "3b32fdfc6999b1eb7670882693bfec064100fc36cea2ed657ab65a3a0965d93df02d1984ac156c093a36ac8e078340a8", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586552, "uuid": "d5a23ed1-d595-4536-8f99-165476975a5b", "value": "T196B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586552, "uuid": "5ba9ec12-58a1-4724-9274-65b761c901e9", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMi:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648586552, "uuid": "ad6bbc02-5bda-458f-a930-99615a4e2087", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648586552, "uuid": "4c5a4b4c-0f79-42d6-9a1a-99466ac33adf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586552, "uuid": "5d292f82-d570-4237-9cd6-fa91d32afaa1", "value": "8628dc97c8d27d1b3dfcea2952a12b2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42fb14fd-af57-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648554986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554986, "uuid": "32ac3f85-0a91-4cab-a120-179a3977f68b", "comment": "Malware payload (Heodo)", "value": "93bf45cf075f4d8e690046ba964e348f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw brDzV", "colour": "#B2269D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554986, "uuid": "0c009813-dcc4-4486-9aa2-bf231740bac0", "comment": "Malware payload (Heodo)", "value": "7d09fe24b3775a8a09d77ec24eaf580ccabca0cd3f374deeb040cafc09892df2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw brDzV", "colour": "#B2269D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554986, "uuid": "d83ed887-d6ff-4f58-a30d-714d29adfcbe", "comment": "Malware payload (Heodo)", "value": "e2d8537a92919452c47449d5b1f524a91763dde6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw brDzV", "colour": "#B2269D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554986, "uuid": "4a0b18a9-4afc-4ea3-b064-def77a2d0dcc", "comment": "Malware payload (Heodo)", "value": "2bc86cc793c4844859e2b894ce0e510c848891dd542829927cec2a3115bf5007ab4ad1ec0f90ed8fd58f1699dce9612f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw brDzV", "colour": "#B2269D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554986, "uuid": "882d888c-14cb-4e71-be9c-42ee56a00aba", "value": "T1D2C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554986, "uuid": "d713cfd4-4333-4739-bdd3-9ff185ebce33", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCI:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554986, "uuid": "b844a798-c27b-4ea3-b4c8-e63a778bf3da", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554986, "uuid": "1119e290-26b5-490d-b1b4-68f90fa449ff", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554986, "uuid": "b85f2a3f-b965-40cd-ae91-e5a5be747a27", "value": "SCAN959_00079.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d57e006-af13-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648525932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525932, "uuid": "1de8a78d-c611-4d46-8125-902369b9f87d", "comment": "Malware payload (RedLineStealer)", "value": "1c292bcd90fbcbefdee77404ea88da83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525932, "uuid": "5ad62fcc-61f2-4403-985b-9cdf45f95183", "comment": "Malware payload (RedLineStealer)", "value": "7d124975437e9e3d3aab4a9fcb067532ad6cd8da6c99fa6a183f3343dc33f06a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525932, "uuid": "86799699-08d1-4a10-a78c-807be69e5942", "comment": "Malware payload (RedLineStealer)", "value": "3ec69f232e445bbe016fe37ad1d158f52ebe2b74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525932, "uuid": "568de4d3-24b9-40e5-8718-1a3ed99ff460", "comment": "Malware payload (RedLineStealer)", "value": "067d407eb190c4ba2af00f16951dc9a6f205110af6d5e4e1eb36d47c8da0505bbef5fa8dbecca770d0c32bb74bdf64ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648525932, "uuid": "37f43e97-b7ea-4649-b390-0d574adb62e2", "value": "T100D423A9B6C4DE48C1D6FBBE1C29B5A7E076A106BFC03239F2B94B0695448C3E71D05D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648525932, "uuid": "6dff388d-c65e-4719-9e20-b7aa3c238f9a", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648525932, "uuid": "94ee455a-4f5d-4d21-a2a9-6b81b198a063", "value": "12288:Df2a4AALA/fNXCQC8Dp3/5QS03ULaHNqrxlKIQNozVkjzbFHP:DfT4knpCwDp3RkEaHNYK3sVkfbFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648525932, "uuid": "8ff2ea9a-aab6-4b9c-930d-049172cafa0d", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648525932, "uuid": "3744642c-b748-4b29-962c-83ca45be91ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648525932, "uuid": "2a901408-923b-46fd-af5b-31e90d52c85f", "value": "1c292bcd90fbcbefdee77404ea88da83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b05c97-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648573190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573190, "uuid": "17e4b9af-372b-49c6-a696-d370e204025c", "comment": "Malware payload (Heodo)", "value": "96ef521a38a8be7d69675727ebcab1ec", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573190, "uuid": "088c8a86-f0c8-44d5-a315-39df14785162", "comment": "Malware payload (Heodo)", "value": "7d802416dfc0522e641b121da6bec6f5b2b4f1357dab51c7cb08d81894099893", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573190, "uuid": "857d8e47-7d4c-4f75-a6fe-f7aea7c1f005", "comment": "Malware payload (Heodo)", "value": "183c1cfbbe0f18668df0883083ef1b04d0692648", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573190, "uuid": "8c91616b-01c1-4829-bf60-abcc888b4c22", "comment": "Malware payload (Heodo)", "value": "2a434eab952ec36f3c6fbc80ec5a5c0ff72d6344d88f8bc1e7f04e37e314d58aeb77039a3eb2e7198a5adc7ed9813500", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573190, "uuid": "cf2fb0b6-7490-4dbe-a45e-02c17a0191f2", "value": "T107B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573190, "uuid": "50b3f8e5-b061-4ed0-95e7-83c32a7e5f79", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMd:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573190, "uuid": "57481d2d-d9e8-45ba-896c-8651a18fbaea", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573190, "uuid": "8ef91be3-7793-443f-b9e7-d51de06d5e8b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573190, "uuid": "f1b1ba35-4117-4819-8395-7b5ce2d20e59", "value": "96ef521a38a8be7d69675727ebcab1ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812ed285-af26-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648534045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534045, "uuid": "6de33d17-456b-4afb-beab-98583ee72a01", "comment": "Malware payload (Heodo)", "value": "13acc609e572e4521215e703396f03de", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534045, "uuid": "2e42eb5f-bcc5-4be0-9269-526ac6363150", "comment": "Malware payload (Heodo)", "value": "7eacdd78be5701c5495922e4a6c8b9be9b8dffa5f54a7a67162ee772e3648974", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534045, "uuid": "e7bf9caa-cbc3-4243-99e1-f6516b241602", "comment": "Malware payload (Heodo)", "value": "c8bd13796ed72f70228c29921b2075d6ea68196a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534045, "uuid": "887a6560-fcca-47f2-818b-6cf4b474b3e2", "comment": "Malware payload (Heodo)", "value": "9e79218be04c37c5fc5e51d610701f03c811fa2594689fe4a61d77b5493055f17739be053fee061edd3a02513e0ea335", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534045, "uuid": "0fc6b3f4-bc46-458a-9d03-2ef7fc54be92", "value": "T173649ED173F08A77E26705333EE597BAB2B9B964DE32C68363A4CA4CEC320554532719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534045, "uuid": "bf6564d7-223f-46d9-86eb-05113f05b8bb", "value": "1ae872d29ae3f3837d6c8d15813e59d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534045, "uuid": "ee2a20a3-ae92-468e-8a20-c23746beb23d", "value": "3072:PETHGNaL1eByO0+yJvoXZ13zVMrJAZ/swfkCWNRTlJwrySDJUi3IXjUlziMN3Toj:wIuOkoX33WyZEwtWNRByDlPdOwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534045, "uuid": "9b0e9bce-7694-4356-9fd4-f8553307a426", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534045, "uuid": "aedda498-c568-4010-aa89-340ebcfe970b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534045, "uuid": "1a1dba96-c3ef-44b1-8055-6a7cc2a47f4d", "value": "jaiweodkl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b35a24-af96-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648582054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582054, "uuid": "d88886b8-b4fa-4644-810c-36cc69353f9b", "comment": "Malware payload (SilentBuilder)", "value": "d95fac7e35cac9c22f635da67aaa0ef9", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582054, "uuid": "24f774d2-47f3-4c2e-9189-4b6e0a3e83a9", "comment": "Malware payload (SilentBuilder)", "value": "7ed99a8a0c1cadd54c0a1a62dda6d600091e392ab26b5c421b7d3cf2929d80e7", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582054, "uuid": "3b5d24bd-7e4c-4f14-ae74-84e95e2048bb", "comment": "Malware payload (SilentBuilder)", "value": "6ea38c028b0af6d90c17229359897129e37a153f", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582054, "uuid": "047fa7bb-347f-4efc-a2c5-ea7d661ea460", "comment": "Malware payload (SilentBuilder)", "value": "16713ac07030992b78c477ac7990db6f82ed975e68d1ba819c18456a470794e1db2a30568c293710a313d24263595a11", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582054, "uuid": "52ad1928-39e8-490b-a6f0-3a19b30af4fb", "value": "T1C1B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582054, "uuid": "670487d1-7703-4919-93e4-e3001f336308", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMj:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648582054, "uuid": "c32d512e-3f69-49f5-a801-56d29099e083", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648582054, "uuid": "4fec2202-3e4e-4e36-b5bb-e7b22554bc5e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582054, "uuid": "79f5751e-c35e-4ead-93aa-ca05b0698386", "value": "d95fac7e35cac9c22f635da67aaa0ef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e59e0ce-af2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648536456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536456, "uuid": "3ef9e351-4593-4d24-83fe-c699624e0e9a", "comment": "Malware payload (AgentTesla)", "value": "1bcb6dfac243f6fcab671fa93c14dc7d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536456, "uuid": "48788203-5d6d-43a1-b8e2-0ebcb7271899", "comment": "Malware payload (AgentTesla)", "value": "7f0f3941419dd02e82dc168fd0e2d56e07a86e584cad9b6472d028eefb66007b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536456, "uuid": "f3661479-4cbf-45c1-a7ed-aa077d04e63d", "comment": "Malware payload (AgentTesla)", "value": "3db5a9391a8962c7467acce9b0e0c82afaa70d59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536456, "uuid": "df8f9686-e7b7-400c-9290-10dc382d1a03", "comment": "Malware payload (AgentTesla)", "value": "5fc405f898c438fd35cd71ab2987f4cbe6b4a72c08411224ae1539f4ecb57ba6b9c3c35315b98cf57e9f4d37689563ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536456, "uuid": "7a9157db-2afd-41ad-92be-862cd81b6bd4", "value": "T1769567F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E5E6651EF6A11F90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536456, "uuid": "b88e44dc-8a1b-46d5-83ea-52597fa2ad3b", "value": "12288:cLZOAOZn+K3yZ1b8FIQtV6M7cQEBDnn0YJCrqwpoHjm3m1rWl:cLZXK+K3O1b8uQpcQW70qSoHjm3m0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536456, "uuid": "2ec1aece-2197-4c99-9614-2e21dd102800", "value": 1901686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536456, "uuid": "ac7fbec6-b35d-4679-a16b-a95e090dae68", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536456, "uuid": "90153c6a-6b98-4610-b4da-7bd091aeb2b7", "value": "RFQ DRAFT PLLC105009207.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecd3051-af2f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648538094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538094, "uuid": "7eae1fdf-23c3-4556-84e1-321cc9bcc3f8", "comment": "Malware payload (Loki)", "value": "bd2dd1068e162306e73850bd8c55c24e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538094, "uuid": "b8ed9ed5-6752-474e-ae04-162ba32da709", "comment": "Malware payload (Loki)", "value": "7f53682c2fd56627127d7bae102033cac802301dba51cd441b2f25138b84ff09", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538094, "uuid": "26f373df-ebba-4f17-bd2f-b4d6ff2a2929", "comment": "Malware payload (Loki)", "value": "9797937608e19ae3e80bc75bfcb5b7826fc51197", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538094, "uuid": "05026530-99e0-462c-a2a0-902e85d03054", "comment": "Malware payload (Loki)", "value": "321a878088fb2a99ae412b79131b8f5fa1e3923254d49ed15d3fb7186929bca99ef2b9fdc5395f6dd85e95c3bae91de5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538094, "uuid": "e8521b5a-ac3a-4511-b2aa-6a04d6d98d32", "value": "T1B01412483196F81FE7719233A5A68366B730DF53CF699286541F33EBC234A151239D1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538094, "uuid": "7560d07a-adf0-4ebc-8225-3e2f8324489c", "value": "3072:PahWGxv0alyCy+GEuLoxirgig+2kT05fdLgxH7ccdjLgzUtQaine+OJlv2O1kg51:ihV5tGEuLkegiXbTwd0m+j0zUK1/OXvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538094, "uuid": "313a08c6-b4d3-4457-951d-ad6f69007b81", "value": 192312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538094, "uuid": "146ad1d4-ca04-4a77-ba15-8a81e0c2c5c2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538094, "uuid": "ae2868e3-3696-489b-8154-be248bd5135f", "value": "DY2048 PI Revised.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3fd11a-af4e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648551082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551082, "uuid": "1e6a1e6f-27f6-4b6e-91fe-33e48fa57374", "comment": "Malware payload (Heodo)", "value": "2cbeacf969e5f414c7fdd8319ec4f8fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551082, "uuid": "50a115d4-7a06-4cad-89e0-b5c8b683d779", "comment": "Malware payload (Heodo)", "value": "7ffc634edb08b466789b86c94080321e82cdc06160341f70f31b75ab5a276468", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551082, "uuid": "6ef3ff6e-60b1-469d-a104-d8f1182fab80", "comment": "Malware payload (Heodo)", "value": "99cf2fc4da5aac909493ae619a2d11c8326bb1f0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648551082, "uuid": "a83168e9-25b6-43d6-b36c-4697f0c8cb84", "comment": "Malware payload (Heodo)", "value": "3d5ca51266f763a3256cf36abcfc8c21ec552600ce91367a25b7ef112af4274b1bb4b3a63cf6f1ae92f226d4d34bd478", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551082, "uuid": "2717245d-bd02-446f-953a-3c5a3debade8", "value": "T104C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551082, "uuid": "39374da8-fba6-416a-b914-dba2c2900101", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551082, "uuid": "d4297263-cd89-47c0-8f2f-117e43979cf4", "value": "12288:iUV7ciwHX3ew9aYU3pGc9inFijaQeL+nZBb:UiMX9I4ky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648551082, "uuid": "09799cd1-b499-4779-b760-06ae69b73bb3", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648551082, "uuid": "c99532ec-e5af-4247-8124-9fc805558136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648551082, "uuid": "9c084b0a-7e83-4072-8740-aa1c368323e8", "value": "iPurVp0M2ht1PyK9UTEsf8wR.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61859373-af5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648556325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556325, "uuid": "fe75d447-f85c-4b2f-a269-2fdbd462cd2b", "comment": "Malware payload (Heodo)", "value": "22f33b99f971664b945545a42cb78b75", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556325, "uuid": "4e6c7871-90a3-485e-a079-f0c4e8ec4533", "comment": "Malware payload (Heodo)", "value": "7fff027fdb387dbae2deca5ca30597fe798160d9861b17b024cc3115e6b552c0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556325, "uuid": "e159d61c-3894-4926-811b-ef0696464be0", "comment": "Malware payload (Heodo)", "value": "7490dca2a86112a9a5a608f34b110b922a3a3cdf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556325, "uuid": "0ab7011d-f3f8-4c4d-bc84-fbd12e3a0583", "comment": "Malware payload (Heodo)", "value": "3d406922dfd6f471517c2da909b20ec201e483fcfa189938b3d72f00b49c34118cbc8c35842e2c7c5a7d0619368054f5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556325, "uuid": "0a01027c-4a3c-4f73-8676-ba2368cc032d", "value": "T14DD45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556325, "uuid": "ddbeac1b-a5e1-4936-93f4-c7d19add296b", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556325, "uuid": "8e63ad6c-6a47-4aa3-8ee0-0f51b3ca2531", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzpipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+w6ooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648556325, "uuid": "e9df1eea-9a2a-4e52-ab46-9a8a272518cd", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648556325, "uuid": "7c0f8d3f-c272-4241-896b-ccf80bf4a49d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556325, "uuid": "de0b0371-125f-427b-8986-7c9868256ff2", "value": "emotet_exe_e4_7fff027fdb387dbae2deca5ca30597fe798160d9861b17b024cc3115e6b552c0_2022-03-29__121840.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a66b1a0-af3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648543804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543804, "uuid": "0fcffe1b-e5fe-44fb-8bb9-de79778778f7", "comment": "Malware payload (Loki)", "value": "8ed91cbf8c2702d43aac51dd61dbad66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543804, "uuid": "ee5b7dca-13bf-4c7d-8a63-30774dcd94e5", "comment": "Malware payload (Loki)", "value": "8011dc75a842f822773bf50574e94a420d7c06ee80b98c11ca89d3ce9b970012", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543804, "uuid": "91ab0dee-35e4-468e-95be-3799353f4c9e", "comment": "Malware payload (Loki)", "value": "637db0eb2f6cb2fbe08d5a2eb3ee768bc4e3c831", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543804, "uuid": "ad9f74fe-57ef-40f5-a866-0d9efd31046c", "comment": "Malware payload (Loki)", "value": "f672698168db35315024e5fb7ab13f1ef0eb33988b874f80a8029b03f3245cc29c93303a872c25483af2d9c93972a024", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543804, "uuid": "64fdd83b-6e49-49a0-b4e4-2a93a71a5ea3", "value": "T101340251ABA08462E4225B715D3993B79BFBE6116173170F5300DF4EFD22DC2DA39B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543804, "uuid": "f48fa0d5-f043-4261-9614-d56b91c799ef", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543804, "uuid": "f15981a9-3d35-4139-ba29-e7958a7c824a", "value": "6144:HNeZmQwimNsxl6a1FcX8xC8fH+d5zUh0Z:HNlQM25FnfWd5AI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543804, "uuid": "9ff50431-303e-4533-a013-5eae127fcd2a", "value": 236533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543804, "uuid": "584090f7-2b8b-4b8c-a210-b37922af52c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543804, "uuid": "069087c5-3bfe-4fbc-b622-db88933b0fd1", "value": "8ed91cbf8c2702d43aac51dd61dbad66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dcc763-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529164, "uuid": "8478926a-b973-4d94-98b2-b886c786b43b", "comment": "Malware payload (Stop)", "value": "dd74d4a4248723f209d153f0725b1730", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529164, "uuid": "428bd143-2fd5-4caa-bd74-4397495dad87", "comment": "Malware payload (Stop)", "value": "80628757406344d2053361607f9b117cceccdf7f906a4c87f17fee06e01f2026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529164, "uuid": "20702f15-ea45-471c-a099-ed9a7d9c2538", "comment": "Malware payload (Stop)", "value": "a08d3d05fd3c2927f39da0f76be92ce14e24b043", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529164, "uuid": "6b7ebc2f-752a-44f1-8b81-b7ba6e5ad023", "comment": "Malware payload (Stop)", "value": "4f35f94412f48ba083f8141e44af21d9ccdcf83962a9d962601822059bb54ed6736cf0715e8b7770b93ae06fb7c7f426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529164, "uuid": "c8a896da-8423-421a-b67c-2d9195f8bc1b", "value": "T139F40200BB90D035E1BB22F44ABA97A9A92F76B05B3491CF23D626DE16357E1DC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529164, "uuid": "1517c38e-fc66-4bb4-a0a7-9f5ad86b046a", "value": "112f301b72f7079fdf51b59676b2b142", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529164, "uuid": "7feb61d2-153e-43cf-8267-3c6b57ba696f", "value": "12288:pQqUOnrdIVmek0P46wdNhnc4wLcwIOH0u51YThoVIYau7hN/Qmuuvs:u3OhizP46wn+427fH0u01BYaYHQmuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529164, "uuid": "cbd66b27-5514-4330-b505-e3f6ae60f0b6", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529164, "uuid": "18ee214c-5d0c-42db-91c7-d04736a0b913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529164, "uuid": "28c4434a-5662-409f-90a8-7503932503f4", "value": "80628757406344d2053361607f9b117cceccdf7f906a4c87f17fee06e01f2026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824fb252-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648536194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536194, "uuid": "8dcbb0e8-fc88-457f-8b9e-e23e7dd94777", "comment": "Malware payload (RedLineStealer)", "value": "4845d3c1c1a58d1e2fe77c3d2fcb2e40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536194, "uuid": "87968c43-4b3a-4edd-8c8a-0820548d2c48", "comment": "Malware payload (RedLineStealer)", "value": "80eaa1af395a9df796e07a40530e9d59b3559988d8009e27cd6320d55e5542bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536194, "uuid": "6edc9f61-58e1-4224-b1a1-67dfd5fb287f", "comment": "Malware payload (RedLineStealer)", "value": "b4b029e5adfba787f99baeae5088956c723d49f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536194, "uuid": "2c0cf2bd-99c4-4ae3-a1ec-d4777bee3e82", "comment": "Malware payload (RedLineStealer)", "value": "d9c6521cae4e692f89a6989a9be691cb5d1189aeeb3a475f24902de5800ae072c88943ab4ea1fb823d3eace6ca132a6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536194, "uuid": "e6df72d4-c091-45ea-b32f-7c8a3c6026e4", "value": "T17F84BE00BB90C035E1B716F58ABA93A8753E7DB25B2155CB62C57BEE5A306E4EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536194, "uuid": "aee79749-15e7-4b94-85e1-b9cc277a9cf7", "value": "962dcf4a4b969d5194f73601a217ba6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536194, "uuid": "0605f7a1-54c4-409b-803a-b2dc4ba2b402", "value": "6144:XzkKO7QQ9JO5DYhQFo07cAzLl5HCEUoxlDE9GBcSTcZGmt25UFV2s11:XzkKO7Q5DYmFo0555Nxo4NIt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536194, "uuid": "b5bcff22-a5b4-4291-be13-6c54744169e6", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536194, "uuid": "125759d2-f014-4dec-b619-9b1921b66f83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536194, "uuid": "7fbb2eb1-6e7c-4ba6-afe2-4326a275a442", "value": "4845d3c1c1a58d1e2fe77c3d2fcb2e40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768ca38d-af63-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648560226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560226, "uuid": "91b0e792-3917-48d8-9c48-02525ffb949d", "comment": "Malware payload (Formbook)", "value": "f150deeeef54904013238e18aa77c322", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560226, "uuid": "8125c636-b8e5-4f99-8f91-639185d43e48", "comment": "Malware payload (Formbook)", "value": "80f7c7687c73fabb3dfb10825a01ff6b68d943c75ded1eebaf90784fb6132f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560226, "uuid": "5f0f86a3-73c2-4280-bcaa-a187b2785349", "comment": "Malware payload (Formbook)", "value": "797e39e335aee334564fbf74185cbe9e7ff38a88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560226, "uuid": "b4a89e8a-6ae1-4a4b-8676-9ef057b99d48", "comment": "Malware payload (Formbook)", "value": "3ec7693262ef7f4114fa66622679be52390fdb74bb4616b090c47765c26c6198222fb5b5c580654d34535b8ca5a7c36a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560226, "uuid": "4f95bbde-8b0e-4cfa-9551-55cf2990f96b", "value": "T135341208D2E198B7D1C24E300837BFBAD37F678A0064D54BAF456FB56912B5A898D7E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560226, "uuid": "49e78797-0e3e-473c-9bf1-164b311d5380", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560226, "uuid": "799ae3e0-6710-4e8e-a48e-fdf4d3629df0", "value": "3072:rS17XJiDxmJJWDTczB/qB59W709UKv6FruUzszI6FsC9bJQRcikR9Fw82Fvg2GRj:rGiXTczByBFvOmIIseJNikMF3GoGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560226, "uuid": "bf7684f1-8d17-4cad-ad6c-d4370086394a", "value": 248427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560226, "uuid": "92ffa0be-93f7-415d-804b-590ead05b969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560226, "uuid": "1c7fe3ac-e89e-4371-86c5-74b8a0a097ec", "value": "DHL express.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fea6a4-af35-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648540678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540678, "uuid": "44904d17-0d96-4e31-9d0e-cff8d4fbe0a8", "comment": "Malware payload (AgentTesla)", "value": "b1e6b5e71c78e1ced0f1202c45d52ec3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540678, "uuid": "4701fcec-1f44-4a48-9e0c-3ca5e4a965d8", "comment": "Malware payload (AgentTesla)", "value": "81136ef7299680eb006669d2169cde0d5e9573831af9a187db053eba68c845c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540678, "uuid": "c99de93f-4872-4143-a99b-0f88f67d561b", "comment": "Malware payload (AgentTesla)", "value": "6bae212e893419bbbff6d1118c3abfa683e86fd3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540678, "uuid": "40166013-bc79-4398-9922-6e5ea9164eae", "comment": "Malware payload (AgentTesla)", "value": "5326dfc6fb9e7aa8b7d8ed7ac415e6c5a454e645b8704ffbaedb783ebedbdfe60256b392995a52e203fd4b4cb2406401", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540678, "uuid": "feabee2a-faf3-42d7-a871-9771354de178", "value": "T155F47BFD57D4214BD3E08AE12921EAA51E3FF4B2D42B0ED66D2883057A3A7117E33593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540678, "uuid": "988c151a-46bd-4d4d-924c-8316cd63b13f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540678, "uuid": "1cdfc9a3-d1a7-4fe2-aca3-76a8703913b9", "value": "12288:tNR2CB6/EOZoafBF/r7TT2h0c0lBJGrxbHX:jR2CY/EGzF/r7vc0GR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648540678, "uuid": "e04131e7-8fba-4857-8fe6-b6b8870a80e5", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648540678, "uuid": "6060da66-edfd-4e73-bb4e-de73b53f45ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540678, "uuid": "9e18f187-e1a8-4dac-8073-302aeec531f2", "value": "fattura richiesta offerta 00223848885 03292022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5def9b-af68-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648562568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562568, "uuid": "8cf53700-6044-4fb7-bfaa-cebd12c473e5", "comment": "Malware payload", "value": "a41434aab92bd1b9a07bdf027ed5e255", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562568, "uuid": "a31e583c-a0ac-4987-ace8-f4a801e516f0", "comment": "Malware payload", "value": "815cdb2784c769357c1fc5e50f78e2cf84288533b86a2d63ba21248d93174e27", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562568, "uuid": "af2cecb3-ceea-40c1-855d-4abcc7e2cdf4", "comment": "Malware payload", "value": "e03be566aaa220feff54e658882f94ab83e86a9c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562568, "uuid": "b63dcc98-300b-4695-828c-a914803249bf", "comment": "Malware payload", "value": "feb8b5179a8a201113540c1367b17ce8d564486a75316b03bfd65e7de28a1707581978b5f720429209b1b7a1f558d6ab", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562568, "uuid": "f0747a19-d95d-4915-b932-8efeb41ddf26", "value": "T1C29533E030DED340F0284A3A8C5868EEE59D75816F94B099399E54E5CADFC7AC73718B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562568, "uuid": "53d456bc-b52b-46c8-9db8-477b74bd96c4", "value": "49152:1ZfG6629REYLfAgmo1YMT+JRJcQuc+2h68phgVVA:1Zj1/876xT+JRruc+Y68phyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562568, "uuid": "560e9c0e-b8c2-488b-9842-62866504bc4e", "value": 1918811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562568, "uuid": "06089666-74e8-4bc5-9d67-1dfc2000fc89", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562568, "uuid": "66e502a0-2235-4517-9fec-1112c3c567ff", "value": "h63m90m45b_money.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6534e2-af6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648563674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563674, "uuid": "4318e136-0f41-4bce-8356-6368b23a0ae6", "comment": "Malware payload (SilentBuilder)", "value": "ad8f9037db04cee507a3ef8902e8b45d", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563674, "uuid": "569f6572-372c-417e-8b5d-6da67c8f611e", "comment": "Malware payload (SilentBuilder)", "value": "81be8741d8fd657ade4bbab88b1658eeb6ace95b3384f2e6a0c680c2c49928ee", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563674, "uuid": "94adee21-a2eb-471d-afa4-f45fb7219dd5", "comment": "Malware payload (SilentBuilder)", "value": "82f92dbd3ba0f087ef9afaf86727aaafc1598a36", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563674, "uuid": "9290e2e1-1688-4b68-8b44-2e2f256e23f5", "comment": "Malware payload (SilentBuilder)", "value": "657ee241d578f9041452952f367f096d87e7db313e9414e3cd98ae5343fb25ebfb50700075c71c3af444327355502e25", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563674, "uuid": "bff1658e-3cdb-488f-b95f-4471c55f2373", "value": "T100C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563674, "uuid": "3d90cc38-17f5-4071-82b1-6b4049aa32c4", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCI:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648563674, "uuid": "8b0a7027-ee71-4a8f-9b87-1d93ad384d0b", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648563674, "uuid": "0c84626e-02dc-454a-813c-a60556c9878b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563674, "uuid": "de073666-7171-4a5a-9dcb-8c185eaece43", "value": "imedpub_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d3b06a-af1d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hive)", "timestamp": 1648530157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648530157, "uuid": "79810acb-0a2e-4e62-85ad-4f2441f6fc45", "comment": "Malware payload (Hive)", "value": "5089de515e12e79c727501372fb9b24f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648530157, "uuid": "90e359ec-374f-419c-9185-997a1d55398b", "comment": "Malware payload (Hive)", "value": "81cdc2455998d49d23ba4cc6df45c6ddd0dfea6e582e7703e9ec41cc3e1bbf74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648530157, "uuid": "151cf4c2-a2c0-4c12-8f94-7730afeeb782", "comment": "Malware payload (Hive)", "value": "1898216cd467628d87ebc4e3037b9d3f9b371a3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648530157, "uuid": "0d46395e-ca19-49ec-8e4a-8c083a660848", "comment": "Malware payload (Hive)", "value": "adaefae318db63d231adb69149ddd9e263f4544ed827d893198005c5b45a32cacefeb3025563f25b080a98647b429a72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648530157, "uuid": "ac70f304-6b2f-4524-bfa8-b9b8bf3130e3", "value": "T120967D50FDEB50F6EB03553048A7E36F67306606872ACEC7D6446E96EC37AD20973229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648530157, "uuid": "3995e6d6-413f-4928-9ae4-ac5a00f9b571", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648530157, "uuid": "b0c01304-ced4-4864-8891-147d400ecd73", "value": "98304:wikPDhDkzZpil9a5RzBsDL39SCAoH0TQ7AFl3sErIwPV4W:CUil9kzuncPoHiTNPKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648530157, "uuid": "dae0aac9-8380-4af7-9a52-ec7d9a759837", "value": 9425920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648530157, "uuid": "f368161f-007d-4ee9-baa0-8a8eabcfa4a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648530157, "uuid": "46747f73-28a8-4236-b6e9-f5530e1c7a02", "value": "frpc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f4f7f3-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648562128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562128, "uuid": "8f5d321b-cbb3-4e78-b046-ba4ce6ea41a4", "comment": "Malware payload (Heodo)", "value": "4d698be9b5083049db5c56445f632e74", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562128, "uuid": "e9a5369f-8a0e-4134-be89-2bffc7b154fc", "comment": "Malware payload (Heodo)", "value": "82092f684a3c9aece91280c7167b5806133c622341efd1461734cdc00c2eb49f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562128, "uuid": "c87c9eff-519b-44ba-9683-c339c146a8f7", "comment": "Malware payload (Heodo)", "value": "26d26a45422ae553f2463a42fd0e39386169decf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562128, "uuid": "bd52176f-12a8-4d0e-a428-8697c71fb1f1", "comment": "Malware payload (Heodo)", "value": "3b6e42b652b9b93d8203b8b9a35a61031b88d0b2b90107f9e297d6b6427ea684ee665fca8bd3d68c773dc760a628bf6f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562128, "uuid": "8c997e41-c8ba-4fd6-8f33-cb53c18a5ea6", "value": "T16AC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562128, "uuid": "a9a1910a-d700-484e-ab3e-c1ac4bc2c657", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCc:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562128, "uuid": "bc6bcd3f-90e2-4913-8a9c-35dabd647c61", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562128, "uuid": "461a82a4-2f10-433c-a6cb-ab9e6b48e1fb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562128, "uuid": "c4319076-9ae3-4e2b-9e60-fccc918992bc", "value": "Fattura N 000072-19 KRF 29-03-2022(1).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bd9985-af30-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648538161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538161, "uuid": "f45eeb73-40ce-4607-af13-64c8136fe7c5", "comment": "Malware payload (AgentTesla)", "value": "feed5549134c288ce3e2adf0d48cdfb8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538161, "uuid": "e0e5182e-9331-45b7-a83a-8c7edf0e14c8", "comment": "Malware payload (AgentTesla)", "value": "821e93d7a12769242213e9723fa7453cc23fecac4a7882a7fcf5e3b954cac110", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538161, "uuid": "66d12237-4469-431b-af4d-bbbad04ec253", "comment": "Malware payload (AgentTesla)", "value": "33fd4d9b6e79fe4c19d3c7c816c56837799d064d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538161, "uuid": "9ec72c5a-f217-4513-b9eb-230b413bb40b", "comment": "Malware payload (AgentTesla)", "value": "cff437349b1b285fa37140daa2af37909904a0155dc048ac070e5d2d652c18587932b07138814e4c41e133a2365c86ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538161, "uuid": "f5df9ccb-1159-45b4-b72f-96411281ca4e", "value": "T1C0D401236786AB19CABC337D0162ED1113F0F4E62271CB1E6E9952EC65633816F3B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538161, "uuid": "c8d1c7f0-97ca-4e1f-a274-d74c5ee5600c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538161, "uuid": "f7f3e25b-77b2-4da8-9c4c-87d4cde7589f", "value": "12288:70xp3763UoibLpUyc15YLgdo1VxAvJ9cEOm:70nuOhNc0nri9cEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538161, "uuid": "0303eee2-2ac3-4f3c-a8d9-a552e879de98", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538161, "uuid": "58452715-c0fd-447b-aa0b-888c49358ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538161, "uuid": "8441625c-2e37-4cba-8a6f-2a8d48bc9bb4", "value": "feed5549134c288ce3e2adf0d48cdfb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddad6b4-af51-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648552561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552561, "uuid": "b3e4febe-83e4-44bf-b31e-26caf67eb454", "comment": "Malware payload (AgentTesla)", "value": "a92f4df91b5396719cbbe19bc30ffb4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552561, "uuid": "91c4741a-b956-4cb4-b97d-7926e7d13f9c", "comment": "Malware payload (AgentTesla)", "value": "823a3d1789b8973815a905fe7cbe48bb1a3135fa70f3de52c6e345540736a312", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552561, "uuid": "78d8b85a-0ebd-4c75-b672-f77ffa97f36f", "comment": "Malware payload (AgentTesla)", "value": "368bfbabfe8c00ef6a9e03df7eef7f9bf6184797", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552561, "uuid": "f5002661-a20d-4c3a-97e5-a5fda7c0aa69", "comment": "Malware payload (AgentTesla)", "value": "85db1dd99fc29daa7e0e3f58cda1585c324df540ded72313a730752e84ec8ee6b5a3450ececb23ce8aa59f352aa98b1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552561, "uuid": "91257af6-fa3f-4ab4-9f60-1fdf1990e547", "value": "T1381327025EC54EECD4BB0D7644F2A16402635E0758B67EDA6C7F350A9BE32840B2B7F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552561, "uuid": "47d526be-fedc-4555-99af-cb46878e767a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552561, "uuid": "eeff918f-69d1-4900-8624-a823894517fb", "value": "768:QUvk5N1P22PrhQPFarli6AkAw89odfpAKVN1EKp2XOGJ:/k5N1PLPr2PFUisP89oUKVAKpmOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648552561, "uuid": "9ba2d75d-d86c-4259-bae8-78deb88f6e5e", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648552561, "uuid": "1d394207-1853-48de-9946-1ae5fdaa2615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552561, "uuid": "839e2dd3-94cc-40fe-a8c0-0c9717963530", "value": "ORDEN DE COMPRA 80107.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77ffb79-af05-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1648519936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648519936, "uuid": "42ccdeea-f5c1-4fb4-848d-c09b40b95376", "comment": "Malware payload (DCRat)", "value": "0bc83b1fc4e023add37a0c79c9cd03aa", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648519936, "uuid": "d997a34b-494d-4854-bc7d-4f579f3ea8cf", "comment": "Malware payload (DCRat)", "value": "82450ee9bb709d99aff3ed006f9129dc3fc53366fc4a8188c9ec9f4a1e70da38", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648519936, "uuid": "cb3a6e8c-3439-4a3e-a9bc-4d4b8c4a3e29", "comment": "Malware payload (DCRat)", "value": "65857fce0774f12b47df70b25f7459a6f14540d1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648519936, "uuid": "b8a9599a-97a1-4d16-86ff-f4b6aeb4b3cd", "comment": "Malware payload (DCRat)", "value": "2d0cc49df2e7e59e831b950d314a81ade045571a185b203dafbcbc7a2dcfd61a2088589fa5852f873ce3d539c59ec52e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648519936, "uuid": "0281835f-5739-4ad1-a829-42cc982640d2", "value": "T1E1559D127A45CD27C0661B33DADF801847A9BD02AA27DB1E7E9A375E16013B79D0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648519936, "uuid": "5a16685a-eee0-49a9-ab29-ff950414db05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648519936, "uuid": "5c061d31-cf14-475e-8976-8ba7c284f6c4", "value": "24576:XHQxd1DXodUpZ5NHrmmN62X7s2s16qSXQjE2US0vqvg1T/ByO/yF50:AxYUPPrdLsjRSXQjEnqGNrY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648519936, "uuid": "b5b8d084-e636-44a4-9e4a-65b500f7f8c7", "value": 1372672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648519936, "uuid": "903b6dfb-7bdc-4307-9f89-858769bd2718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648519936, "uuid": "83aff911-af59-4375-9ae9-57f088c96427", "value": "0bc83b1fc4e023add37a0c79c9cd03aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12defe9-af47-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648548272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648548272, "uuid": "d74364cf-86db-4286-b9ac-d364f8b0ebd2", "comment": "Malware payload (RedLineStealer)", "value": "06a5e12664739e13595f71278a074c1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648548272, "uuid": "b02980e3-a4db-40a6-ab62-027cd43b0d30", "comment": "Malware payload (RedLineStealer)", "value": "824c7429fac609d1f05450762ebe444410e7db099bc1345156794860c4177d8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648548272, "uuid": "6f95db5a-d7ae-497a-8a2e-8c9c1523f4de", "comment": "Malware payload (RedLineStealer)", "value": "ba7108f95e9111ace723f7435592d0453abd071e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648548272, "uuid": "e0d8af37-f7ad-415f-932a-720efb2f41e7", "comment": "Malware payload (RedLineStealer)", "value": "3e2e21d83d3caddf67dddcd85b03899a794340f69efd52f97303bb63fb4f56566c6c882d8c26c7faef68ae8c4359b782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648548272, "uuid": "ee95a3b1-4848-4548-bdfa-875d1388ed24", "value": "T1EAD423404B620AAFD445AA7FDE6F802659573F1D1F0A34189BD874E7F148FA172F882A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648548272, "uuid": "9d0433d7-e13a-4639-9404-e825741808dc", "value": "f861dd32adc9349a099e42cbe1eca980", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648548272, "uuid": "708feab4-b763-4d15-8f41-2b5bb779b744", "value": "12288:KyBeyTQzyIMOEJrcYkP9WrNOEj0Grx7e5HsSko8l3Qbjpp+p:zDQzyKEJoYk0hOEwGrxhTpojb+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648548272, "uuid": "75e0d662-35d1-462e-afd5-1389044250fa", "value": 621096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648548272, "uuid": "f1f2a4b8-6447-411e-bb07-0e88aed943f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648548272, "uuid": "4933d7b9-a87c-4de5-a79a-22d476cbdc3a", "value": "06a5e12664739e13595f71278a074c1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efaded4-af29-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648535383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535383, "uuid": "90f3b218-4721-4056-a712-693d24434bdb", "comment": "Malware payload (Mirai)", "value": "2e40dde66cdd38ba59a89cfcc27feb15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535383, "uuid": "f8b06276-caee-4aeb-9b69-68bb003c0ae6", "comment": "Malware payload (Mirai)", "value": "8266f6d8e68b894785685fbf28a70a1afd830e16fe6d612ee14d797026f1091a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535383, "uuid": "53fa35c1-73be-40b9-a097-d4cf56c008e7", "comment": "Malware payload (Mirai)", "value": "60f4b082990db9bd4a897fb20b42a2cfedac704c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535383, "uuid": "8fcf169a-1a00-4207-a79a-471db1f711a1", "comment": "Malware payload (Mirai)", "value": "1a196ddaa028869b8bc811e9d9bf9c1be21e0a3deaecc9f2cdb023af675f727bbc9a86940ba4844ad2d49defe8b6e53d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535383, "uuid": "e0994a03-46f6-4d23-a50d-72a9ba3cb6b4", "value": "T125935BD6F501DE7EF85BDBB648624E0CA531B2604F630E239767FD5BAD32098590BC82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535383, "uuid": "a9591b43-d7f7-4595-b371-f73f0d955bae", "value": "1536:f3TvjmJ3nZPB0YQRsCbkNe/H8y85ni7zaGQeuacWjcW0JcWcBlA3CeMLDEsx4z6r:fM3n5B0YtCbkNAHY/GQeuacWjcW0JcW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648535383, "uuid": "e5fd1552-6807-4d59-91d5-12538c71fa70", "value": 97664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648535383, "uuid": "5d8ee31d-a79b-4be6-bc98-b4da6aff9036", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535383, "uuid": "ef9315aa-3d5c-4166-a12d-7b14c5aa1dc5", "value": "2e40dde66cdd38ba59a89cfcc27feb15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9048c3-af89-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648576720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648576720, "uuid": "db56f609-5d13-4687-8938-f935d3500b96", "comment": "Malware payload (SilentBuilder)", "value": "6e9cbb9f975222f87340d123ee10ed27", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648576720, "uuid": "4eb44bbe-64af-4b88-a3e4-c869332cd8cd", "comment": "Malware payload (SilentBuilder)", "value": "82949dfed8639199d9a4ee44fdd0f4e946c8636cbc904cdd5dc80f5ad1035bee", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648576720, "uuid": "fca40137-db43-4cd3-8ce9-33af456b6b80", "comment": "Malware payload (SilentBuilder)", "value": "a77ca32063e1098861392da472112170ad07459f", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648576720, "uuid": "58d130e0-09a6-45a3-8e61-e6ca5121a003", "comment": "Malware payload (SilentBuilder)", "value": "487a5ccc6f4282db0a06b80417a0a288ca219694899188015bc1fd631f5eb33e2eaa8d8cac1dafb7cc84e19d4a430bbb", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648576720, "uuid": "b8a5dd9d-9194-4729-a5a5-bc4b9310fd3d", "value": "T155B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648576720, "uuid": "6e3f04a2-d5c4-4300-81f2-d0fad9a608ef", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsM9:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648576720, "uuid": "628360c2-a750-479c-bdc5-79e0c9fda444", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648576720, "uuid": "4cf9b72e-e887-4cc9-b4a5-87fc439d7658", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648576720, "uuid": "4d45e85f-98f1-4b5f-ad6b-f0daf864e0f5", "value": "6e9cbb9f975222f87340d123ee10ed27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56378d5b-af3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648543851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543851, "uuid": "9e5447e6-01d8-43dd-af92-9885fd95be8a", "comment": "Malware payload (Formbook)", "value": "e579a1039eb1d5be440cff7422fe4a14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543851, "uuid": "5bee8893-3297-4149-a517-9b50c03a7d08", "comment": "Malware payload (Formbook)", "value": "82dec996695c4efa92b08598ac9ce5c3c45ddc18ecf6b9260559ea95f8ef168e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543851, "uuid": "e524d04e-b0ff-4919-ac59-de68b6082b24", "comment": "Malware payload (Formbook)", "value": "4a6da626cd653eb96d59e26cd1e5ff686a3a7312", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543851, "uuid": "1c4bec5b-ee33-4353-ba68-a038e96ef9ee", "comment": "Malware payload (Formbook)", "value": "552220a441e93bbfc46df6f45a2fdb3cd12b5ce8babb5e79e6d4090cd030b9fe86407f9c2e537e5547aea861f9db8748", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543851, "uuid": "1bd1a135-8272-44a7-b5a8-91c812b47c32", "value": "T19A0523A91B80FA83ECC56D767825BB0AB772A12262734317FD05AD5E9DB0BE0744042F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543851, "uuid": "0a7a61b1-033c-4ebf-be0f-3ba599081400", "value": "337ab288605433a43621ee254e169733", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543851, "uuid": "9002d2db-42ed-4140-b498-652a3ee0a07d", "value": "24576:YL2emidyOe0P9psKgK/cRgOnmq9g6vU2sNdDiY:YL2YegbcOU7m682s/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543851, "uuid": "4eee0a1d-76ec-4c67-9cf9-50410b0de820", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543851, "uuid": "22ada261-08ac-4a45-8e26-898de73a7f86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543851, "uuid": "c5ba9490-118b-4c1e-aa39-e637a9a81530", "value": "e579a1039eb1d5be440cff7422fe4a14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a42f30-afa7-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648589650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589650, "uuid": "717ab5ae-a353-43db-982f-3a6136e02c9d", "comment": "Malware payload (SilentBuilder)", "value": "4c854b20e33af3fa9dbcb4c7098bcc92", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589650, "uuid": "49b52bc6-d03d-45d1-86e8-f4feea218fb8", "comment": "Malware payload (SilentBuilder)", "value": "82fc4fee02805ea0fbd6578b5e33d809165c90f10143c644566ea6991cecc4a8", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589650, "uuid": "1bf1fe26-e632-4aac-8cca-be824ccfb4e4", "comment": "Malware payload (SilentBuilder)", "value": "7c52251d88a8d6b0df68f811725c6bf75fb01e88", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589650, "uuid": "d135f6f3-3a02-46f9-968f-f6b4dd5af766", "comment": "Malware payload (SilentBuilder)", "value": "80c7e36b5d07f052e14fb7dffa6b5f0a31535e698510be8be858872f260cf2fe23be7a8a1bbf7da7f357125f5e35939e", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589650, "uuid": "2e302b78-803b-4f73-9d38-0983f77d5386", "value": "T1D5B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589650, "uuid": "6fe52ca9-ce6e-44d6-a23f-e9f2f08b117c", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMe:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648589650, "uuid": "8c040ee2-f03e-4a89-8ad1-b30955b3659b", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648589650, "uuid": "72a2516e-3fb7-466e-b032-47db576f239c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589650, "uuid": "bef371b0-e4d2-40ba-8794-95b5fe1189aa", "value": "4c854b20e33af3fa9dbcb4c7098bcc92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76603610-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648537033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537033, "uuid": "0232d6c0-e2b6-41b5-a110-ba0cca49c148", "comment": "Malware payload (AgentTesla)", "value": "b444e44f93f883023d8eda93962165aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537033, "uuid": "fa0733b3-55f7-4876-b04e-fe953faf3f67", "comment": "Malware payload (AgentTesla)", "value": "83015439ee9ee6eca58826df26f314b1b5d574b8d4710425b6a0bbbbd9bf3503", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537033, "uuid": "192b305f-9ca1-4d3c-8bbd-58581fb2adc2", "comment": "Malware payload (AgentTesla)", "value": "1ac980d05afe679f9bc16fea6919692be5451859", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537033, "uuid": "eb1ba1ff-2336-4839-8e42-70dafb8a09f3", "comment": "Malware payload (AgentTesla)", "value": "4590452672bc6a878644125148d2562488f0b93b1a7930b291f2f065df772c0e6f0a03d6581849d2e6ab585e7509b350", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537033, "uuid": "cb9a9af5-4a8b-43a0-aba3-7b62a1ee1e2d", "value": "T1911412077B8107B4E9B886FAAF7A77C09219ED1722D6854130BEB157CE733590937E60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537033, "uuid": "4a64d922-4f44-4951-ac78-6b8690aa9f8a", "value": "3072:0g32JSzFd3vybq49Ye/75TWipvFMD6cbT1CBGkfMSrYxqzk3PT62M+WeI7tKJq:TLzFoq49j16i52DQBdHYMzk/mTNpUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537033, "uuid": "046c31ed-b2a0-4a84-8aa9-8bd81ebe01c6", "value": 193480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537033, "uuid": "b922fe25-ba17-441e-a0a9-1ca98b71cdf4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537033, "uuid": "e4e3d6be-d56c-450b-a7ab-ff103cc5f682", "value": "order98904.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd223ea-af8d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648578193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578193, "uuid": "b079738b-8b13-4e63-b61c-e3bd43f70f00", "comment": "Malware payload (SilentBuilder)", "value": "670a181a53f3781c774cf5a9d9d8eca2", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578193, "uuid": "4eccd9b4-266f-49a2-a4b9-924e0c176d5f", "comment": "Malware payload (SilentBuilder)", "value": "832e53d262f912675fa5e4d34bae26ffa4fddfe7b80687aa7b36156f912b6fbf", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578193, "uuid": "6a38e16d-896c-4469-ae41-03b59707c418", "comment": "Malware payload (SilentBuilder)", "value": "4015fa24a0495b3c86c9f7d9a4e535775c86e238", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578193, "uuid": "bdef09c9-7f29-448f-acc8-0e1bf1d552dd", "comment": "Malware payload (SilentBuilder)", "value": "b68318cc66e0367a70eee96e2f6aab69953332d430a3077d1a742e67522d59db3a9ba2c8abfdbcf26604e97a171a1e35", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648578193, "uuid": "827babad-0746-4cdf-a298-a2ebe53c7b4a", "value": "T19FB39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648578193, "uuid": "3ce513c2-b20e-455d-a3b3-8e5d37339e65", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsM5:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648578193, "uuid": "8634fe70-b4ac-4ae5-8644-2a85c3db38ed", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648578193, "uuid": "2e2fdd43-08bc-4c5a-ac8b-6510e7446a72", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648578193, "uuid": "e461abc8-d4c9-4de7-855b-35b06757d837", "value": "670a181a53f3781c774cf5a9d9d8eca2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c290cafb-af2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648536731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536731, "uuid": "b790bc4d-81d4-4224-9365-0bdbc35fee25", "comment": "Malware payload (RemcosRAT)", "value": "c7b80400921853bb5ed15ad3f9dbd362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536731, "uuid": "7e7eb8fc-8f32-4bc9-8bc0-2e6a17fa1ebd", "comment": "Malware payload (RemcosRAT)", "value": "8342c94ddfd4cca232e9d1cd5faed48fdce02a694b062606b938401b502a0c30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536731, "uuid": "0d9e765c-a9ed-49d4-9ab7-b5a2c38abd35", "comment": "Malware payload (RemcosRAT)", "value": "ec50ac6001ce5d5c49d9ce88fbc8973f23cfa23d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536731, "uuid": "7ed26828-39f0-41bd-afdd-1e654cefb9ae", "comment": "Malware payload (RemcosRAT)", "value": "1e79314924da52aef62c67ea4d259d184599a9351650abdf024588a50f5a721bcd949c42adecdc612f562368a6b82d3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536731, "uuid": "2d89fca0-d2c8-4234-9dc9-1b9c55d5b881", "value": "T1BC34F7607E052487E68F88F2398E41E6DA91B928F351AC0F63D1BD2DC56B5F04E5E1EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536731, "uuid": "41a557c8-b404-4ad5-a7e5-d4eac2200a29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536731, "uuid": "3cc691c2-7669-4984-9466-b9129e87793f", "value": "3072:Vt/5y1i+cIZQ80OE9cxzB2FP5EAblfv2KL8QR6ru5RjBOK2bIThf:V55Ci+cIWY5BYCGlWs4k2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536731, "uuid": "3e2b1612-1967-47e4-aeb9-41bd93370316", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536731, "uuid": "415cafe8-6eef-4996-9f63-432ef19c4c76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536731, "uuid": "099ec4b8-a7f9-485c-9cbb-9f7d7536916f", "value": "Purchase Order April-EBS22-0010903.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6107c449-af5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648556325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556325, "uuid": "5187e9cb-4bcc-4bdd-9d93-9d2e2863377e", "comment": "Malware payload (Heodo)", "value": "3a2c54f98f3d2fa739f883fa2eb1cc97", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556325, "uuid": "473ca88f-d2ba-4892-bfad-5cefec806880", "comment": "Malware payload (Heodo)", "value": "83444029cf8d82c80992c2e4290474d557df615f8cfb50ef1c66093f012b778f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556325, "uuid": "b6ec34cf-c76c-4567-b58c-f91d52db7995", "comment": "Malware payload (Heodo)", "value": "48d3a9a63c8bcca63ceba37f827a3c24aac64ed8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556325, "uuid": "1a5c594e-3d97-4b18-895b-9afbce737922", "comment": "Malware payload (Heodo)", "value": "5fa5c44c8eac2972acf7685209d5e11e8d0c56c3336943fbcd670d09afce7cffe21ec5dc8f3e30d9ee5d1e2a0eb4e22a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556325, "uuid": "7b694b26-4c93-4e46-98ef-cd4ae757d3e3", "value": "T18ED45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556325, "uuid": "13d8cfae-a8f1-43b2-90e3-717f107211b3", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556325, "uuid": "6a024481-3a46-4c7c-aa61-d63af504bba5", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzvipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+woooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648556325, "uuid": "1430d482-0cf6-48fa-b798-210450b08688", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648556325, "uuid": "a871b1b4-ce8e-4eb5-ad01-ae4454b4448d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556325, "uuid": "cb5ed1a6-c543-4ac3-8de2-8d7b40ab5a41", "value": "emotet_exe_e4_83444029cf8d82c80992c2e4290474d557df615f8cfb50ef1c66093f012b778f_2022-03-29__121836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302c403d-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648536056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536056, "uuid": "4f39e90b-61f7-4a96-b175-91b9ef963e2d", "comment": "Malware payload (SnakeKeylogger)", "value": "5c09e7e7727cc8598b8293eefc7364e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536056, "uuid": "feebe284-6391-4b10-b4cb-51d362d8abb1", "comment": "Malware payload (SnakeKeylogger)", "value": "838a8fab72d527c2817b806f6978e6e36de1a101d89646855704b5a0ae044db8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536056, "uuid": "42fe4a44-aa23-4fe5-96b4-dcdf33fe01c6", "comment": "Malware payload (SnakeKeylogger)", "value": "5607560942128d43eecd7a2b2fab2671bd67571c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536056, "uuid": "3612518d-14ec-4b2e-b63e-acbae478a4ad", "comment": "Malware payload (SnakeKeylogger)", "value": "39213be95344939e50b6cbfa96e5c6c064afeffd47a93b8f86ecdfcf3335e3cac04279beb558d7a5b98f202a86e4c088", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536056, "uuid": "d426ba35-8ecd-4182-88ec-486892783f03", "value": "T1D5825D18B3A6C673D4A78F3294E70A919AB8E7169A33470FCC86153ECA437484D66B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536056, "uuid": "25180c88-3f29-4fff-9ccc-75dc2cdbe532", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536056, "uuid": "310a7c1f-7c9a-4fe1-96a5-e0316f4c0ccb", "value": "192:h1reMzqrrDI32zm/lUCJBH4kGBNMGBUKdepk0KVOyghWsxu3zXxGaBZOvX3d:Lwr83IWeOSUaepk0OOyd3zXzYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536056, "uuid": "10ed6ade-9e13-48e1-a2bc-ccd8084fa5c8", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536056, "uuid": "6d98aba3-c4d4-4f97-a221-7ac318fb2df4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536056, "uuid": "d15cb520-4224-4021-9409-d61fffc1b847", "value": "New Order,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e60254-af69-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648562805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562805, "uuid": "a1958749-2ad6-4a54-80b7-0cb71c5a88bc", "comment": "Malware payload", "value": "fdb5ef82a150b26d5338c54044039b80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562805, "uuid": "d774640b-2c03-4c21-a0f0-04126cc26f92", "comment": "Malware payload", "value": "83f2fcc70ee04b19b7ff1fbbda36be21ee7538a0aecd7f8f143d101c4f6b4456", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562805, "uuid": "e4c0c297-0c97-45fc-9dee-86cb16e73dcc", "comment": "Malware payload", "value": "59088458e283214cea85968fab0f1d202799ee74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562805, "uuid": "ef1b29fc-2706-4b95-b984-1fe2ab76321e", "comment": "Malware payload", "value": "12d8353465fd225aa657863c337a9c8f56641f5bc9856fb912ed7f4026ca764ed70b1d590483ba48a01f22f49d7377f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562805, "uuid": "a67f96ed-a722-415e-b622-23ae6e82bae0", "value": "T12685120B41F1DCD5C04C00B40306C840213918184721C2070D94003FB4500BC1189105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562805, "uuid": "5ed16c71-9358-4a3d-81cd-7993ae8c7a49", "value": "3:WlWUqt/vllEYZcFTS9gXeF+X32Zp:idqGVg3F+X32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562805, "uuid": "dc3b47e2-5fee-4b32-961d-3ec82bd46c6e", "value": 1818624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562805, "uuid": "c40875fc-ac4b-4481-9de9-e79986662317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562805, "uuid": "17c0410f-90ed-44f8-bbd6-78a81b9699a5", "value": "h63m90m45b_money_slim.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee66eb0f-af5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648558709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558709, "uuid": "1c050ebc-2297-4e8c-82e0-03375f19b8ab", "comment": "Malware payload (AveMariaRAT)", "value": "34d5a05f179b363844b7737daeabdb8a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558709, "uuid": "e1d8054b-5b38-407d-942c-1dff57a9c7e8", "comment": "Malware payload (AveMariaRAT)", "value": "840729250146593d31165c8763f43475c6d58f93ad6ce25d07aec42a3cd0b38e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558709, "uuid": "fddeae37-2a11-46d4-9df8-920599eb2685", "comment": "Malware payload (AveMariaRAT)", "value": "4b23ad5883c06b706e946811b547acba26b4a4f2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558709, "uuid": "fb8bfa6c-2f15-439f-b81e-6cf054dbd0b0", "comment": "Malware payload (AveMariaRAT)", "value": "7150937889c928abe0c616222e92177720eaa74e11e0c07256099d87b357bc3406b6b741cfa469afc8bd1031cc00473d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558709, "uuid": "23d5c2d4-7611-415b-8a31-b315fa4eede6", "value": "T1E34533FE48D0C248B1493092B649972D72DED50D6DAC691C0F7B603CAE662323DDDDEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558709, "uuid": "1e0fa529-2fcd-4406-a595-836224c9a28b", "value": "24576:zL3dusFsFAM680CQnsM15KRo7SJkwqOEaiZTvLZGqxG:Ys2HrQV15idGX5ZHxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648558709, "uuid": "aee786a2-d125-4dba-9491-2fd251dd7b88", "value": 1239149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648558709, "uuid": "7bcee746-a858-458e-8e7b-1b1fee379d3d", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558709, "uuid": "1c1b239e-57fa-4011-8f37-399b316572bf", "value": "OVER DUE INVOICES_12-08-2021.pdf.bat.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84ef6c0-aefe-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648516931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648516931, "uuid": "fcc389b6-c427-44f5-b9e9-6f0201fb235c", "comment": "Malware payload (AgentTesla)", "value": "419bbadc9c38cf07e00b807e6a7d19f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648516931, "uuid": "7aeb71eb-d53d-4d9d-a8a2-71d2b3ebe983", "comment": "Malware payload (AgentTesla)", "value": "841b0befd5a64d33a856320ee328dedd7f893ffff6a3d3a4b05124f0df6cb92e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648516931, "uuid": "cff7d167-1d8f-4543-985f-f6c0d74339e4", "comment": "Malware payload (AgentTesla)", "value": "a5be1c0b249ffc53a1ccadeca487dbad391d58d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648516931, "uuid": "6ea00f37-2ea4-434d-8331-a93acc8773db", "comment": "Malware payload (AgentTesla)", "value": "19a3d66c0e58ccdfdf3c4660a9e2fb24fc689f02e5b91af5f95727a8a901a3036458ea541cb40d958be66fa0a28ba772", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648516931, "uuid": "862cd139-c2aa-4910-9709-4e01fb9e7564", "value": "T1AE1518ADB2F0F5DEC45BC076D9681CF8BA506C66D30B410390273DA9BA7D987CF146A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648516931, "uuid": "73426b8a-8240-4b01-9161-549c172e0fc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648516931, "uuid": "74707323-1909-4284-afce-4d00afcbdbd2", "value": "12288:NeXtMBVZIlagQqT7cYglMM22RzVDqi9FolwAYzJlT8yPllxA/ivOR+E3D1qFwouO:NeXtMBVPgdHcYg7pVT3RQUlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648516931, "uuid": "36300ce3-8726-4533-a56c-963500f5ad00", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648516931, "uuid": "eadd20f8-5439-4755-b864-a16de2ff83fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648516931, "uuid": "1b5600bb-d470-4b3b-bbd4-70b9e64c4f87", "value": "POA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146c6a0a-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529138, "uuid": "20b01896-04ba-4f98-9df3-ae257f9d3de8", "comment": "Malware payload (Stop)", "value": "6d11f9077f8106643310561fdea87e43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529138, "uuid": "82dc0830-47d3-4be1-a0ee-d6335e1489d1", "comment": "Malware payload (Stop)", "value": "843f583cf4f78748dad55bf2a9265812283b31333b878dd9852f80a8051dfe34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529138, "uuid": "d1f098f2-c783-4e3d-b6d1-54588ac0d660", "comment": "Malware payload (Stop)", "value": "7dc3415f4a527ae9d203ec51fc36d319485ca986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529138, "uuid": "c1ba66c8-6c31-4217-a1a7-4abc72e8e4be", "comment": "Malware payload (Stop)", "value": "e1be9718ebe4a443cfbd0b9b6cd73565203e4f45b14127124ea806ec1d761860b8ae8380361f7ba87f74c0307be8de52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529138, "uuid": "6ee025c4-f655-46b5-aa22-d23d1cb3baf0", "value": "T193F423267E2244F3C00A433B71B451E00F56B1745A637C63B69551AC3F3A1F29BADB9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529138, "uuid": "9ba207c3-59f2-4f21-8ad4-e3a1b12c9998", "value": "98af1336ee9a8378f1e2c2d0d9027760", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529138, "uuid": "950ba1ff-5fa7-49af-8cf3-bc74960578b2", "value": "12288:/0S6FdR6PI3itOqbJaOyAUOWlqkqxfxaqTwgalsHvJUyfLMoaKXgY:/iFCPIQJaOxUZlqkqhxuuakLMoaKwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529138, "uuid": "9ef37cd9-a7f1-4e07-9f72-9df79e0eeae5", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529138, "uuid": "64f9d929-da23-4bf8-8dbe-56e2b40e43ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529138, "uuid": "4983a935-5121-4eb4-9cdd-9b5efc3b338c", "value": "843f583cf4f78748dad55bf2a9265812283b31333b878dd9852f80a8051dfe34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20da9c28-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529159, "uuid": "057e3ffb-86a1-4e65-868f-ee0f898f5826", "comment": "Malware payload (Stop)", "value": "170020d197265b494dfc60d660e5d67d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529159, "uuid": "ad5157f3-710c-4647-905b-6225a419e846", "comment": "Malware payload (Stop)", "value": "853019600fa809d432cfe1b381078d1371c780494fafedf3dcebe7129f502576", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529159, "uuid": "6f5ce234-5917-4c0e-bfec-4c4a73ff125b", "comment": "Malware payload (Stop)", "value": "ca7bb65100a502d1971dc9c1abdbbe55e70d2186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529159, "uuid": "6659590e-b535-4ff0-a61a-d7fb88f4f0d8", "comment": "Malware payload (Stop)", "value": "939bb77ca4ab47711bf02a391185d8d3bf6038da6315114aa36a8bdd09fd19b085855d60b7402c33de46beb8dfe27edb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529159, "uuid": "ebf27115-ecaa-41df-8393-7433a8fcdc13", "value": "T18B0512567591EC32D41112759801CFB09B2EAC7899304BC76BD83B4E6EF379296A338F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529159, "uuid": "6015ff22-3e51-440f-8968-d48ee59f373c", "value": "e5c179e1f9502263973e4310e0826274", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529159, "uuid": "5fe552d0-b6d4-47ae-ac25-0c4dc55ac1a0", "value": "12288:+zWQP6HdVaOOUev7zHvgr2+fupzuvsTB/8Wp7VpqLr2ShzG3SoW2Ogljz0TZk/UR:H86HdCUefYCBT5M9hNZQMTZLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529159, "uuid": "823ea278-3278-4dd8-ad22-1439d851c501", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529159, "uuid": "0652097f-4deb-4a91-9692-7c0a2f62f976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529159, "uuid": "ac0d6df9-91a2-41ea-9a29-b667af503e4e", "value": "853019600fa809d432cfe1b381078d1371c780494fafedf3dcebe7129f502576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdfad4c-af55-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648554175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554175, "uuid": "abfbf25c-b852-4702-8878-dd6751b0eb35", "comment": "Malware payload (Quakbot)", "value": "e7e8ac96d80fb4ce97a5e57a9e7f49dd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554175, "uuid": "e2c0639e-a782-4908-9d25-fee45f045896", "comment": "Malware payload (Quakbot)", "value": "8535a5a3595009a9270abff1eeacfb7fa530d692f4ef91d6be25612e3f6b4211", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554175, "uuid": "eb8f5634-ccf0-4878-91f9-253bf90fb29c", "comment": "Malware payload (Quakbot)", "value": "67a7ffae193bb1fd134d25baa90a7070c4871daa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554175, "uuid": "93337ac6-40f7-4ba6-aedc-8940d57e8024", "comment": "Malware payload (Quakbot)", "value": "b74fe949711d7e5c6da11542d9639c74e70d1319a6f57a326119e54150f006609ba44ff624e848596b67a0f145d3b8fd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554175, "uuid": "8aa7d92a-34a5-421b-bd3f-cbdaa334b557", "value": "T12CA4BFB875047DD6E56E467BCDA6ADED13B62723CAC7E4CC80647BC305A3361EE12806", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554175, "uuid": "ad783996-dd69-436b-a4a9-a82f81c4457e", "value": "f54caa57a7c19db3e8fae8f6dae53711", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554175, "uuid": "7eca8b45-bd78-494f-a8a5-d0e3d5ccefb6", "value": "12288:AX7aIrOMkgTqStzqRorZcTudvBB0lAqIMPFUwJRv/8tX5qRcpq:AX7CMndzvrZgudvn0lAqvPWwr8tL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554175, "uuid": "99984156-58a7-404a-917c-ff12d9aad62b", "value": 455680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554175, "uuid": "bf9bd39a-dd7f-4f9e-b425-e807d2d480ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554175, "uuid": "ea7e6255-a1a6-4d00-b16b-944cb4b5820c", "value": "44648,6101579861.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f881e919-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648536392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536392, "uuid": "33f68d36-8335-42f6-bc19-95085b4dfcd2", "comment": "Malware payload (SnakeKeylogger)", "value": "8fbc946e4281e310123f6f065cf8db4e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536392, "uuid": "c8be147c-e2a9-45dc-864f-75775098982c", "comment": "Malware payload (SnakeKeylogger)", "value": "856cf421c68a412371fbf6167cb5c0c4d3c5ff7ea3a49625b2c1646f4b7bef04", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536392, "uuid": "064e2188-e022-4b02-9077-75f175ab1a8b", "comment": "Malware payload (SnakeKeylogger)", "value": "dd86d9897f1e49468d38bef981d0453accd5b73d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536392, "uuid": "6e4179a6-3d30-4f41-a9d5-107de5229e33", "comment": "Malware payload (SnakeKeylogger)", "value": "7f120ad40fb91b9a34b6196a10eef2a7a13bb075b9c72db23879c113234ceb277489cfefb18cb19639ce6173b7b1ffb9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536392, "uuid": "6f04ed33-e1b0-4fde-9fe5-3723ba3da7a5", "value": "T16871F73420100DAADF4F1126A9EDFDA652F2B1378AC764DE39ACE6C60753128ED22647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536392, "uuid": "d532716e-39a7-4e27-ab01-d0b02a27ffc7", "value": "96:Bo8AmF0666/zmerq8nwkmbSb2J675dzUYrZ+6Sb5:+8AmFgwzkKwD2b2JcDUYgd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536392, "uuid": "a7a1da5c-2a00-4c92-8770-b1a7f1af9fe4", "value": 3608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536392, "uuid": "79794b5c-7e5d-455a-8f0a-0e2351f3d4ed", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536392, "uuid": "c20b19e8-ae9a-42fa-870b-5cc958cab444", "value": "ENQ ALT29032022RSI.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0f39db-af49-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648549067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549067, "uuid": "8de45583-3a11-490a-a592-f0ed8b8eae98", "comment": "Malware payload (Heodo)", "value": "a7db72dae089d39f7c47e9999195cec1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549067, "uuid": "6eac3bd6-0c6a-4341-99b4-b9ff1a684ac0", "comment": "Malware payload (Heodo)", "value": "864f3e79e19b56fbc7a6a9ba3c426200f29e61c71055e600b2c653da2a965428", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549067, "uuid": "ad109e70-f49a-45b6-9f7e-0a4bc065926a", "comment": "Malware payload (Heodo)", "value": "8646538385ce12c27cf248239f9a8dbdc0cd9667", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549067, "uuid": "a1f245f3-6347-4808-b15c-cffd0c68e4e5", "comment": "Malware payload (Heodo)", "value": "fedfe5cd2871759704de30074aab120e6936418115aca2b8515976224a535a2fe37c3d2b0c13c71b31b228c193388648", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549067, "uuid": "a493ea51-a4b3-4628-bee9-291a7dc28d00", "value": "T1D2C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549067, "uuid": "fbad950a-0e53-4f2c-b505-83dda4c094ea", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549067, "uuid": "5a05a6be-cda7-4bd2-9205-cee8efe5d99c", "value": "12288:iUV7ciwHX3ew9aYU3pyc9inFijaQeL+nZBb:UiMX9I4ky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648549067, "uuid": "6831bd6f-5539-419b-a11b-ce3881ab9de3", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648549067, "uuid": "1404b80b-f5ee-46e7-aa13-e3bbddaa331a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549067, "uuid": "54a376c4-200f-4a4f-a9ed-b04cd36173cd", "value": "a7db72dae089d39f7c47e9999195cec1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c3c428-af31-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648538589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538589, "uuid": "4047cf45-01e4-44e2-8f96-7e8d46d62e6e", "comment": "Malware payload", "value": "68bcddde2684d6083871be6134e7dd55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538589, "uuid": "2547486e-7a69-43fd-a5a8-d795b8101526", "comment": "Malware payload", "value": "8665051e721ef48705045a1bd622508c43795f54c808165a6966fa1de25f6e22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538589, "uuid": "380b264d-5614-446d-8b06-047a87158948", "comment": "Malware payload", "value": "5ed4915637821b73efbe2109033fc5fd2d7d941f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538589, "uuid": "9b4e1ca9-06dc-42ac-87c3-5bd6a1057c97", "comment": "Malware payload", "value": "a857cd7f7726c80dd3a230bce5cf46b9ab6f7bbf8fc7609b13e0c30a1b3a5e9f1b595f8b13feb3f028b0ecd5c646467d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538589, "uuid": "4491fe05-cd9d-43c7-9502-1b2ee9a50ad0", "value": "T17A56012751501DEC3A324F1EFCB1D26BFA01B92B5E08D99C9417C3A2AD62716CA3D5BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538589, "uuid": "4111831e-cbef-4fcb-aa08-934a7120bfd2", "value": "98304:qV6US9HCWXTxf7bzbnOAEQ7OMKAgJwgsep341/JxD3cQ8oJl6hru7p604Yq1jK0C:qVuHdDxf7LOAsMKN6oq1L1607pq13C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538589, "uuid": "f9a7c5df-40d7-4483-ba33-b99b4763036b", "value": 6400200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538589, "uuid": "bf7c2b4c-3dc4-4faf-9788-f9b53c9a8a01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538589, "uuid": "48bebacf-279a-4244-8599-5006509e0565", "value": "68bcddde2684d6083871be6134e7dd55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efe6f25-af4b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648549932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549932, "uuid": "d360a08f-9fd6-4a5d-9047-0ebb4ddb657b", "comment": "Malware payload (Heodo)", "value": "b2afc1585fa27f5e096a0bb2c0f90089", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549932, "uuid": "7d34fd62-5ddd-442f-9fd8-355d286e6156", "comment": "Malware payload (Heodo)", "value": "866a14c5dd422c449b0f0178630e05b0dd997eb15b8d844360e18f8f9b8d4dda", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549932, "uuid": "c56049f3-dc15-4bd5-8a20-d498f04cdc00", "comment": "Malware payload (Heodo)", "value": "7837effb8b976837feb443891b01244b757f2b2b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549932, "uuid": "41db686c-18e1-41a5-acb6-a4abaac08ae7", "comment": "Malware payload (Heodo)", "value": "db0e20ac6cd77dbbce03e34de585aa5b2acb8e528f012b864137f46c94451260d6d6eb677cae7877e69d50d128ed441a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549932, "uuid": "5d8970b0-65cb-4d0d-b07a-af46bcee119e", "value": "T1CDC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549932, "uuid": "52dc299e-50ba-4a32-b8b5-c0f342c6de41", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC8:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648549932, "uuid": "be152df2-1be6-4008-b32e-341819d04ba1", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648549932, "uuid": "210814e2-98e1-4a31-9013-866a30416ffc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549932, "uuid": "742e8bbe-3819-4c07-a5f8-ebc37c2d10fc", "value": "Rech 2022.29.03_1220.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8d9533-af6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648564449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564449, "uuid": "fbf4730d-5362-4152-b173-e2d234eec3cc", "comment": "Malware payload (RedLineStealer)", "value": "1fc826a1f712b8cf24e5c589736cf185", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564449, "uuid": "15d4783d-db6f-474f-bf45-61b3dce924fe", "comment": "Malware payload (RedLineStealer)", "value": "86d66851e61d819a92186de68dce76955499d6d615e425b8a5924e6561c9b3ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564449, "uuid": "0ee6d92a-73ed-4bbd-ae99-6b83f00bc680", "comment": "Malware payload (RedLineStealer)", "value": "d736263b8fda820d4d9949165ef495aba30614fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564449, "uuid": "a1bb6990-e556-404a-b1a1-7a38499ff04c", "comment": "Malware payload (RedLineStealer)", "value": "c26bb4f79a55616f41406b413a3aa1b0acf3f02f7e7636bd89d849584491efad13d26dd92cd9217580597e3c73ea0704", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564449, "uuid": "219e96ed-38d5-4fa0-ad42-b44546ac066d", "value": "T175F47D8419BB4B69ED1C423103EA23252A7DE771E72896CF817397CDCB13904BF9A719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564449, "uuid": "1a65a370-9cce-4dbd-9868-19479f2dc7c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564449, "uuid": "ca8b6b32-d42a-41e2-b17d-2f7218cd80d7", "value": "12288:UCSvq7i/eeEIiYAIBm8tDYjoP7o9L2R0zNOFgrfDyNlNQUhTgtiE:UwbeJm8tMOEL008PTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648564449, "uuid": "dfaf77f5-6935-485a-8b0a-434ce5d2bbcf", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648564449, "uuid": "9a719e3b-7e20-46e6-baf0-8c980b36fa82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564449, "uuid": "6b92596c-551c-46ae-8719-f0df8637d933", "value": "1fc826a1f712b8cf24e5c589736cf185.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0593bd2-af32-11ec-8e58-42010a9c0032", "comment": "Malware payload (LoaderBot)", "timestamp": 1648539278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539278, "uuid": "acd9fc35-4d2e-45eb-887c-b7c4272a8999", "comment": "Malware payload (LoaderBot)", "value": "b6a6f1b643770b0d69ce5ec6914c21e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539278, "uuid": "8d06e27a-89fd-4392-8be7-8845679b1a8f", "comment": "Malware payload (LoaderBot)", "value": "871976fda0e6cf410a176eb2ed3bb3c38dea2e26bb5a170e35e63bc62c150330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539278, "uuid": "6be01dec-c1b1-411b-b75c-3f9a12c4b20c", "comment": "Malware payload (LoaderBot)", "value": "6adb11662132064a739f475a97c0559dc406f4ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539278, "uuid": "707e2f47-ddb3-44ef-a534-60289ecbf7bc", "comment": "Malware payload (LoaderBot)", "value": "13853163dbc5ab884e8b231d95b658e25930d28ff79c6f82b8c7823968fd0d40115a37af884a266b3aed722f0e201fd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539278, "uuid": "ae2509a0-f471-40ac-a5b0-291f98b5ecc2", "value": "T159F5BE02BFD58F27C5A647398AE383647379DC804B43575BA34AB1293CB63E46B871D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539278, "uuid": "d952eb21-9ae2-4b1b-b73a-267b40a04385", "value": "24576:kHnNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+RNqN+7A6RdexYcer+5kw+:kHNDFFPJu8fBsVE6ij+RNg+UKpBvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648539278, "uuid": "903056da-267b-41d5-b542-7a18cd7cab5d", "value": 3527719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648539278, "uuid": "10374c76-d08f-46a7-a90e-7b2e437dcd58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539278, "uuid": "49ac5f0a-eb77-4777-8971-c8aa7d231e95", "value": "b6a6f1b643770b0d69ce5ec6914c21e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb49b29-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648536054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536054, "uuid": "5cc362ac-c03b-46de-8542-ae424933eb59", "comment": "Malware payload (SnakeKeylogger)", "value": "aa7372ee69da4eca16f92ee98bf53a7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536054, "uuid": "c1c8c21f-2977-480b-89a7-1aab4a9bc1df", "comment": "Malware payload (SnakeKeylogger)", "value": "871a0b2fa5664bd5ed819edb7c037b81b2b552e4ab9eec6f87adbf32d51365ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536054, "uuid": "57931223-a106-4f54-a7c9-fc980bbf7d2d", "comment": "Malware payload (SnakeKeylogger)", "value": "e76529db49cba47cb2a32d4dd64472fcf72f0a11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536054, "uuid": "b275773b-6725-4b59-a719-1c8481a4dcf4", "comment": "Malware payload (SnakeKeylogger)", "value": "ae9f27fcbfea150937b04d4635bbb646a86963596e8d9b47aca2a94b226402a68146610da19db67b7d3d513931f0a6f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536054, "uuid": "846ea8a7-9425-4dfb-a9f2-11438be0fa0d", "value": "T1DFE3295D3BF89800E9FF8A3306718121C7B6F992195ACE1D16D1F5692E7C7808D2AF93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536054, "uuid": "434fba4c-e5fe-4adb-a45b-e06f8a937365", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536054, "uuid": "09d057d6-e7fb-4035-aa20-042154ebbdf3", "value": "1536:+UgspzxlInNYOyIPx5PvuRJBb/64l8giwpiOWByO/wn0Kclw/:+Ugsp1gNYbIPx5H2JBbC0AiwBbonbYw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536054, "uuid": "61853fc5-4c29-42e5-b7e2-5100ac24a962", "value": 149848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536054, "uuid": "4e127a39-cac3-42e1-a634-40cde75e1862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536054, "uuid": "88776122-83bb-45e2-b8cf-d961d24aefc5", "value": "aa7372ee69da4eca16f92ee98bf53a7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d066e19-af26-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648534091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534091, "uuid": "10fe463c-67af-45f8-b0ad-dc3c1afc3c80", "comment": "Malware payload (Heodo)", "value": "940052bf98a98e238e5c4fd802d19e30", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534091, "uuid": "2906d91d-b925-40fd-8317-ae7a0a8edc79", "comment": "Malware payload (Heodo)", "value": "878f9b53f8ad34c0dfedbfd2bff09b54b28003b896852196e4bf03ddb7f22fe7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534091, "uuid": "cc55a6a1-1112-4fc9-8e9c-a6fe27e8037d", "comment": "Malware payload (Heodo)", "value": "c3c6b10b1799d8f61360dfe1fbeb344029abf405", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534091, "uuid": "6c418b5a-9f52-4200-b37a-567fb2c2beb0", "comment": "Malware payload (Heodo)", "value": "6b8e7053624b4daba90d68f2e1255be12cb69dc248dd6ba7cbde444a654cc16156abb4376e2296ddec3177a75d37693d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534091, "uuid": "2d7a1047-5d28-4a94-88f5-021c4557a824", "value": "T1D9158D423BC5C0B7D36211735A93A25E63A2BD248F318AC76BD41BADDE345C2BB76344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534091, "uuid": "0ff80383-a884-48bb-adce-140f74e89d91", "value": "78a3c307bcdb5955fefde2169f849777", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534091, "uuid": "76d341ff-c4f7-4d00-8f85-53ae5ad04ac9", "value": "12288:H/J+NC0xu2rPcHKeNmcZvF/SZGYzZ5Q/9N:fJ8R6mcVF/mGY41N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534091, "uuid": "e08109bf-afdb-4afc-be17-a0de5e7eb047", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534091, "uuid": "9dea645c-4965-4e14-80f5-3d349d6430f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534091, "uuid": "bb3f06ff-2fdc-426b-b123-7bdd8bbfebdc", "value": "okpas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae9e5df-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529149, "uuid": "70e20784-8580-4fc5-8218-6fdfcfb1fd8f", "comment": "Malware payload (Stop)", "value": "7f2bc8c7ffb87474ac40bd2b9caac8d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529149, "uuid": "8b1bcbf5-99b2-4555-a49f-1f5420fd3719", "comment": "Malware payload (Stop)", "value": "8894c4280a1c86b78cdf814b2c11a8598f3b9b65271440862f72c9aaf6360d3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529149, "uuid": "3da7d7dc-3cd0-4078-b8db-ea958149571a", "comment": "Malware payload (Stop)", "value": "5c82fa63eb68fee03b140c864511c67eddf94bf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529149, "uuid": "7195179d-f23c-4bb7-a808-0ba386d17eb4", "comment": "Malware payload (Stop)", "value": "96b8772fb1eebc385c9c3148f13a6e47e25051b094bc6fea7e0cf9afa9dbf3e856818dcadd98fd25de2a8c9556184828", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529149, "uuid": "506a6e13-f3f2-4b78-911f-b30028b9a004", "value": "T1B6F40201B7A0C035E1B712F4487AD3A9B92E79B16B2494CB26D56BDF1638AE4FD30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529149, "uuid": "579ffee9-aaae-4919-b7b9-249b72531288", "value": "927193c1aee812dc8814168f6e0fb41b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529149, "uuid": "43bf76b0-3529-47d6-b271-43f5752aba58", "value": "12288:80zI4V0lSjIsSVQGd5EFoA0/CeJatc++EsoSMFy7rWmH5E+N3CodguDKIob:t/ET7co/CAeclFFSqxysg7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529149, "uuid": "e5a6f410-9bb5-4c1c-845c-182e042190c8", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529149, "uuid": "c3c5e166-9db8-4fa5-8b13-5c837994efc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529149, "uuid": "174a9438-35fc-415b-8abe-caa2420fb016", "value": "8894c4280a1c86b78cdf814b2c11a8598f3b9b65271440862f72c9aaf6360d3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc1a275-af64-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648560745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560745, "uuid": "a4e65d18-ea8c-4114-8b6d-fa381dc7da38", "comment": "Malware payload (Heodo)", "value": "f4f34f7c6fd15e2c1c7c54cd6e1a6b5f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560745, "uuid": "17c7ad64-4930-4fa8-bc42-c4d9cc7947ec", "comment": "Malware payload (Heodo)", "value": "8904f28b3382154bcfc0a6230df21b35457a686c3e67023424c8f3fa9c1381c6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560745, "uuid": "336ab47a-088a-413c-8fea-38476b45686a", "comment": "Malware payload (Heodo)", "value": "98856dea9f1fa536520f37f415c32095cc925b8f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560745, "uuid": "a86a1e49-07d2-4928-ac1c-9afd60574d40", "comment": "Malware payload (Heodo)", "value": "ab277bc583f974af548a8807c85c8caacacd117d600980dc8dafb0dc3412d638c9624e04f7cd042dce2ddc97c8439a0c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560745, "uuid": "9003becd-9959-4f13-9e67-0229d0acedec", "value": "T14CC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560745, "uuid": "a1dddba4-1da6-44b4-89b0-ab3d7d4b391e", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCM:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560745, "uuid": "b41dd97e-2a4b-47df-bb9e-dcd9f9d04f3a", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560745, "uuid": "2d181bb5-a3a7-41dd-b3a3-78eecb2ee00a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560745, "uuid": "230f0838-71de-41e8-b0d9-983a5ad178c4", "value": "f4f34f7c6fd15e2c1c7c54cd6e1a6b5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00220da6-af94-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648581073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581073, "uuid": "dcc212d8-f55f-4d71-9877-51405c9d801b", "comment": "Malware payload (Heodo)", "value": "eb1e01a1acbe5680ea02fe47c2a87a7b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581073, "uuid": "4e1fa0fd-737e-413a-a923-d4b57ddfedae", "comment": "Malware payload (Heodo)", "value": "8948fdb1c6ac9b7dafba77634cc24dd3334e8c817b9feb02e03db8c4b08e7996", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581073, "uuid": "426cf7f5-7a77-424c-8b2a-c313b9e98524", "comment": "Malware payload (Heodo)", "value": "7695e77e6ce67ef356c0f891d37c67cd8cbd2a6a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648581073, "uuid": "02994cc9-1dff-4355-b04a-d562287bc749", "comment": "Malware payload (Heodo)", "value": "5279c421d3cd80099072bbb18d89c1ecf124e2203b835ec0cae69d1e689ad32941209a98a6d95495c4d16e4b7e5dec3a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581073, "uuid": "9d64faeb-bd85-4661-98bd-f01f0f30f204", "value": "T125B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581073, "uuid": "9a27ba7b-f299-4319-854a-7496c8e94a49", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMF:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648581073, "uuid": "7c55c79e-a6d3-4b9d-b033-6ab19a93b606", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648581073, "uuid": "5e5a2af9-65c1-43f1-9614-7375ed8e0dae", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648581073, "uuid": "b7cb7a43-6aa4-4e9d-89c9-c7b5e5860f89", "value": "eb1e01a1acbe5680ea02fe47c2a87a7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2992fb2-af99-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648583573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583573, "uuid": "0dfb1ef2-24ce-4e3f-9215-021745d57d5f", "comment": "Malware payload", "value": "6ef0abb8778568aed42f929a0949ebde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583573, "uuid": "5621c313-56f0-47b8-89eb-0447332013ad", "comment": "Malware payload", "value": "89d252251d9e1b0016dc3c53ec81306e64c7c9d3595750e01ae18d96d55ea232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583573, "uuid": "d4ee3b78-60b1-4893-8af7-4a47bddf62d4", "comment": "Malware payload", "value": "00e82fa8b789dacf3033659dd89f21c464716d59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583573, "uuid": "8900f2bf-90f2-4713-a4c4-879437f71924", "comment": "Malware payload", "value": "830b939e0978a34911ca0051fa9842b1fe4702dc4d1f247a35833184ee1b9068f5d522bbd6cfb74597852c24dd349f28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583573, "uuid": "24eb0b7f-9ad0-4052-b450-a3e78b96b422", "value": "T189F4124136B36FA9EB7D47F1A325800047F29A1F9562E10D8CD676DAA9F2F104C90FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583573, "uuid": "ac175a9a-ef43-4100-bbcc-5eded9e5178c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583573, "uuid": "5a0c862e-e0e8-4d03-8250-67855dcd30f2", "value": "12288:TXFjrt6X5FLFjrt6X5F0jL7E320HC3vQWUSr8AWA334vzBUX6+Jl:bCFLCF0jLw320oIW793cO6ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648583573, "uuid": "97f96433-3ba3-4eff-8681-e1c9cb3bf6a6", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648583573, "uuid": "860898d3-7e3f-48ad-8790-b1abc16f92b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583573, "uuid": "8cde3a2e-e76a-4aa3-8847-166f827e7794", "value": "DiaryG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7ea0f5-af63-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648560238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560238, "uuid": "d391099d-63e4-407e-9aa9-4f66f0629af1", "comment": "Malware payload", "value": "180bc2101b8274cdcb4efb07148d1f99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560238, "uuid": "ea1005ce-9e19-450e-b479-3516835b180b", "comment": "Malware payload", "value": "8a807c70c2c8e86be31b30a0638416a4c0303c3838eca41cdea461896909f1a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560238, "uuid": "abbdfd38-c0bf-4dcb-9c4a-ffa0863ae230", "comment": "Malware payload", "value": "e452e2eab7f0cd86dc3068c2efc618ab92f5f145", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560238, "uuid": "b1cc740d-0bee-4ce3-8f93-4df8d4056cf0", "comment": "Malware payload", "value": "1687f7a0a47571dc72ee0c5abe87cb4a1ffb52ae4868959da0a21836c03e01ef50606fe71cf4c6b88d5f018411ae2de2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560238, "uuid": "9d131fbe-9285-4923-9984-14fe73bbdb8e", "value": "T14F84F161FAE9D15BC0764330BE76D570A677FE142E04A92B3240774EB838257DAB7322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560238, "uuid": "f97af659-ba9b-48b1-8847-ed655d08e495", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560238, "uuid": "09b8e833-ed0d-4f9c-9e85-79d2b1c60b79", "value": "6144:aYa69WY0Zl/oow9HfWsVefcaPcoL+BvyIzqXsXssG:aYSYglK9+snOzL0fqXsnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560238, "uuid": "778c7910-5abe-48f4-beb1-c760bfd98946", "value": 390352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560238, "uuid": "04ba5506-b1a3-4f13-a326-3374efd5b54a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560238, "uuid": "ce0d6791-9d61-42f7-998c-b323c7090195", "value": "ORDEN DE COMPRA 50836.pdf.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e43a5f6-af4d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648550844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550844, "uuid": "bac1564b-49df-40fe-ad40-a781f3dbdb13", "comment": "Malware payload (AgentTesla)", "value": "36982faea2aeec8a481af15804c21b9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550844, "uuid": "ab30dd52-7a93-43a9-a5ba-0cb76a6044ba", "comment": "Malware payload (AgentTesla)", "value": "8b709d85ad3577911868387087b0e675dac463dc71ff3f505c19018883810e14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550844, "uuid": "308f3861-fa57-4702-857b-6bceb4cfd479", "comment": "Malware payload (AgentTesla)", "value": "7637137f3592644fe14be34b1db313fdfaa5c672", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550844, "uuid": "010cb8fc-9674-46c0-968d-e52b1f46c81c", "comment": "Malware payload (AgentTesla)", "value": "951d014fa7067a87f647ce4f3918835f3b2b178d153a5f0ddd3c789e6bd3e8ed3a86363280270458cf671ae928fff3ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550844, "uuid": "f17131bd-cdb2-409b-8e74-12bc99dbc19e", "value": "T1E9140219B66EC1E5E872E13E4180062B4C71CD54513CC72E297EB38740B2ABA59BDA7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550844, "uuid": "3299182e-9b12-4fa9-88dd-c32ed7d9857d", "value": "3072:M4BgOwBo/sdiqaT2kx2SPEDbXVXawmey2mC9TnIdyc8BHbis++BtQN8ic5KYiUhN:lF1/miqIx2SPa5zmg4r8BHbQ+bQGicHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648550844, "uuid": "33ba53ed-4edf-478a-b5cd-0f89edc32714", "value": 193912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648550844, "uuid": "33f1d86a-7024-4bb5-9cc8-081a0cbf900c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550844, "uuid": "36a79710-5234-47a3-a033-273385a027ea", "value": "Invoice - 256388002.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60bb293-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648573244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573244, "uuid": "320b6cd9-c8ad-457e-89ae-a3c1da96398b", "comment": "Malware payload (Heodo)", "value": "dc03d404a41c358c73df70a1920af4ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573244, "uuid": "3205fd26-b774-4bba-8ba0-4468e81fd7e7", "comment": "Malware payload (Heodo)", "value": "8c7f28bc2ed899653bc76171d6785199fd8840cda157d6f4182d0e9283149eb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573244, "uuid": "0bbdeff9-e0d8-484a-91d5-1dedab94113c", "comment": "Malware payload (Heodo)", "value": "810efb75649aee760f3f5546b85ac965eabd35bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573244, "uuid": "59be7976-d9fc-4e78-82a2-90bbeb97868f", "comment": "Malware payload (Heodo)", "value": "b898e0f263a510139d0c693c90df912bdc831af76b4b790fc406af81e3209fc38a91589953170266c621349644c3b9fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573244, "uuid": "cb42710d-e7fa-468a-9775-dfebb2cfeb47", "value": "T138D45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573244, "uuid": "ddee57e2-a14f-4dbd-b963-4aeb9848867e", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573244, "uuid": "b0fa5668-55c1-4247-9a35-ced45336fb18", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzBipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wyooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573244, "uuid": "167fd720-6fda-4bb9-95c3-ffce655897bc", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573244, "uuid": "2bf7fd3b-231d-4ed8-ade5-5e7652af00b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573244, "uuid": "9944dc85-96b9-4a98-8719-2bdef3044bcb", "value": "dc03d404a41c358c73df70a1920af4ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963622f7-af7a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648570158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570158, "uuid": "eac39b1d-d3ef-4534-904f-60cfd695c2a3", "comment": "Malware payload (Formbook)", "value": "fa4058c74adee3029c00d0e40d0e2461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570158, "uuid": "92d931a4-db69-4bd7-972d-2950d42b543e", "comment": "Malware payload (Formbook)", "value": "8c8afc7e873c1fc04cfc9cc2331ed6f46dad4defd1158e39f10258ee4b477758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570158, "uuid": "a2a41a5f-e367-40ca-88c8-3284c1352c64", "comment": "Malware payload (Formbook)", "value": "a4ed48f10757549cf114a656da7fc7d9d27be36e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570158, "uuid": "c60c4156-407f-4dda-bcff-269dfef9af38", "comment": "Malware payload (Formbook)", "value": "acab94408c2cbb2cb79657254d621ccd7d56a4db520e48a27de8f86269f3f1bf2aa8715add12d55431d011caf44d9175", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570158, "uuid": "7aae2dfe-f379-429c-8475-3b19cdf362ba", "value": "T1854402105BE6C03BE09A3F315934192A7BA9BE29DC241F0B7774BEA57B3134D21C9392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570158, "uuid": "9ba35d99-a51b-41f5-846c-0af74df31f44", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570158, "uuid": "76fc8eac-2095-4551-b44b-c68e914cee36", "value": "3072:61NjcVVnLpPuJbph1KmUymKMpTtBg+pVsiWSOMPbwaY7gaNTjSQ8sXNZQMIG1LhO:aNeZwpNULKMpTTg+pQSlsbjX371Lfh3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648570158, "uuid": "d3d9645b-bf74-416e-a5b8-28be9c4d9d91", "value": 260543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648570158, "uuid": "c76893a8-4b5c-4648-b3ff-66c97f8abe79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570158, "uuid": "77f6c479-f765-433e-b820-608696931b9e", "value": "DHL_AWB# 9678547836_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef16387f-af96-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648582333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582333, "uuid": "eb52097b-0ddb-4146-9170-4df5695665a5", "comment": "Malware payload", "value": "fdade8d91e7b02319a45c617b983ec46", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582333, "uuid": "30c7ecd9-ff8e-4f71-adce-3cc4862afbe4", "comment": "Malware payload", "value": "8d4ab3dcbcd3f68d5aee30f4348eb75978d7d243aaadbadb2937d5d684afd579", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582333, "uuid": "c545dbc6-bb77-4e22-b2a0-1d11918a4efa", "comment": "Malware payload", "value": "5cc16dab6f1b56b3624c5f5ac84430178cf4019b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582333, "uuid": "5e47f438-5886-4d5b-ac91-ff1a7d44417f", "comment": "Malware payload", "value": "e1a6f9f78d45aaf97a647887a6c1636191d574d39fdebfd68d602c7f958a8939ce8968cb667d580de8c134808fe34a6f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582333, "uuid": "fd3039cb-c29f-4ae3-b994-086fceaf18d2", "value": "T1BD746CC237E580F7DA6255313EE386496779BC648E328A937344BB8DEA31AC3E535740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582333, "uuid": "8ca925c1-72f8-4cab-aaf3-5cbed79ee516", "value": "72b3528e45595fafbd5f24ce92204592", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582333, "uuid": "768026cc-dfa2-4029-920e-ee4cf5d5b79e", "value": "6144:ePHIFvHxVBxWrhtOjMcD+t14e13gvXr7fa+CYSSfCU:ePoFPxVB0r/OjMciV1yja+33L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648582333, "uuid": "18612a8a-b537-49fe-995f-aab82f998cfd", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648582333, "uuid": "f0fc8cbe-fdb5-40aa-894c-d940793126be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582333, "uuid": "39bd2111-6ee4-4e6d-9923-05674ef93853", "value": "8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe3e23e-afa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648586596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586596, "uuid": "85a91e00-5d62-42ea-b1c6-aea285d972c1", "comment": "Malware payload (Loki)", "value": "b0c0941e987761d31fc81fdb45d8e275", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586596, "uuid": "14a9bd51-dbb2-4613-9f9f-90364163c41a", "comment": "Malware payload (Loki)", "value": "8d70124801f9e10b60d50eef24af2b940481c24a8d7dd90b5ecb724f36529796", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586596, "uuid": "c96cba27-4254-453a-9eac-e13045fabaa1", "comment": "Malware payload (Loki)", "value": "ebe993dc4812a5a227c16ab368734c20a89808aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586596, "uuid": "706409d1-ec9b-4ca7-98fe-d7e7df057b67", "comment": "Malware payload (Loki)", "value": "ecd365d85c6b1160fabb0b9d2437271a6c0b5d0f0b04563d12653832a3b26b3359cda57f1b1132124c43d1fdf928b4ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586596, "uuid": "cbc44034-9551-46bf-97f9-c669b0897332", "value": "T10934122477E6C073CAB299720D3F17825FAE941515264BCB0B609E9D7E366C1EE2F312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586596, "uuid": "5b001d58-3ea1-4ea5-b521-8ee5b3dea42a", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586596, "uuid": "c889affe-4ce9-4072-aebe-bd09ccd51ce1", "value": "6144:HNeZmzpkio3l5sWohB9ZHDUI3pIwGkSHDUYof:HNlzpxglBohBsI3pajEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648586596, "uuid": "db6333e1-0272-4848-b606-7f8b763b9d7f", "value": 240405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648586596, "uuid": "64632f0d-ee68-4399-91e7-075e5b1f08a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586596, "uuid": "71834f6f-bd64-4e02-b000-028340e40a7a", "value": "b0c0941e987761d31fc81fdb45d8e275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ede291d-af26-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648533880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533880, "uuid": "b1db0547-1662-480c-bafd-dfa35cab0eb5", "comment": "Malware payload", "value": "7d9bfb857cb3c0e42729a86c70bad1d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533880, "uuid": "ddef193d-4955-4c83-9b27-59f6d46d99dc", "comment": "Malware payload", "value": "8dac71bc29397838baf7e4b3cfb50964b8e73a2757a3dcb762111ca733b5a1d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533880, "uuid": "1621471a-6350-4300-84ac-ac5694109c68", "comment": "Malware payload", "value": "09ad0f3846bad47083247ca9ffc65609027aaf47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533880, "uuid": "7faa8e00-4f8e-444d-ad7a-1863a6bc70f0", "comment": "Malware payload", "value": "aef1313b0404e82323424ceac97c89c13379e02e965a88df44bf80460c56d1932ac9ab0207d79c20dea24f481da13560", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533880, "uuid": "fdf1c668-4533-4059-ba71-73056a8fa6c8", "value": "T17EA54913E7E48021F1B706305DB69B16AAB7BC519B3086FBD293765D0E326C39A71723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533880, "uuid": "ce24842f-850c-4967-bcf3-7eb0a0dd13f6", "value": "7c6aa7cb92b4940bd7f953ce159d6f65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533880, "uuid": "b75f4d67-eea3-47a2-a9db-dfb8d638301f", "value": "24576:wA7wnNTBxaewsAjZ9tAkZqhae16CGbfxEXYGaKqM:PwnNTBsljqkZqhaK6zbfqdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533880, "uuid": "ad13f181-3395-4290-9825-ec825ac17128", "value": 2138299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533880, "uuid": "d0ae0195-15a1-45e4-acc3-fcf70165e626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533880, "uuid": "61b60ae2-f4f0-4a2b-ac7c-dc806be64a89", "value": "8yhuybg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2789ad-afb5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648595558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595558, "uuid": "b37b1b9d-715a-4d6b-a21f-7b77bbab5050", "comment": "Malware payload (Heodo)", "value": "8e71340d70de3ed9065788b95dc7f32c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595558, "uuid": "fe76e5ab-6386-4d09-aa92-dea4b2c01785", "comment": "Malware payload (Heodo)", "value": "8df3f2fcef32aec4125e68197feb793704dc9d4dc3a7a2b06a048774cbbb2a62", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595558, "uuid": "b43309ba-0c2a-44dc-a697-06e23fdc0196", "comment": "Malware payload (Heodo)", "value": "3fa54282ef6b290152bff08fab6e6f6cf9aa5e3d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595558, "uuid": "4513da91-bc42-4efa-9665-87337bbfe69a", "comment": "Malware payload (Heodo)", "value": "9f3c9781ca62942b449ae326c2ec536704c5b9fecbf70a4fe85621c3343017900095a6a68d849e6c91f4118a63befc32", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648595558, "uuid": "85b01126-7398-4296-aa54-4c0fa02b0377", "value": "T1D5B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648595558, "uuid": "81a33b95-a768-4cec-bccc-a806ede90a08", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMu:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648595558, "uuid": "23e9926d-d06e-4624-b0b6-acb23ed0a494", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648595558, "uuid": "99beb835-0aac-466f-809f-e799b079776b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648595558, "uuid": "292a11f9-ef4d-4a26-8dd2-17c97c078ff4", "value": "8e71340d70de3ed9065788b95dc7f32c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29cb99e-afb0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648593479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593479, "uuid": "4c311273-017e-40d8-b31d-2adaeff16961", "comment": "Malware payload (Loki)", "value": "3772ac9996ea5fda89057e2e04f39521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593479, "uuid": "e9e8eca7-2b4e-49f9-bb3d-933aa22bab85", "comment": "Malware payload (Loki)", "value": "8e2b1b9ecaa46310ee97029140f36951897657f68fdd92959194ae20e67014f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593479, "uuid": "38cd8d57-91eb-45be-8a05-a40172c9ff8e", "comment": "Malware payload (Loki)", "value": "5b9895026ff1a1bb23a3a5504170f1ed3456ef63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593479, "uuid": "a9c4a219-efe2-4cc5-ae0a-0e5b97f285a2", "comment": "Malware payload (Loki)", "value": "1306cca4067d488c19c23f57d223ffbc4802a42a01b8473b27d99c178b5d537492c12addca65811586c6dae1129737fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648593479, "uuid": "7385e863-22ca-4390-b92f-1951c8ff1406", "value": "T1263412506AA0C17BE8619332057F17EE9BE61D573578E70B3360AFAC3D22601E59F361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648593479, "uuid": "a65f5c63-bcab-4aca-91c9-8242a3de89f7", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648593479, "uuid": "a3684b75-dc26-44a7-86aa-a2b02390b641", "value": "6144:HNeZmUINsHdTrC/M+YM+Tpbibby5jpVgrgsFhsH:HNl9shrVMgibI4rgsFhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648593479, "uuid": "d1f1e3c0-f7ba-4a3d-b682-94a8b1b0640a", "value": 236603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648593479, "uuid": "bda7cb6b-dbe4-4330-9aa8-e9fc19d24405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648593479, "uuid": "38b8f10c-455a-46ac-bcf6-5fbd68b22791", "value": "paid inv copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8082ba8-af3e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648544472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544472, "uuid": "40e82592-0066-4261-904e-6b372ae5c4a6", "comment": "Malware payload", "value": "0af11be93fd49bde3f5dc03a3b92cbb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544472, "uuid": "c22a90bb-8496-4f79-9601-4a5607e61655", "comment": "Malware payload", "value": "8e6a13a9bfd37d8f6ef83a6157de9f9c1d44d19073ffb7801cf13a44425296f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544472, "uuid": "c0df3384-35cd-4b73-881a-d390877e08cc", "comment": "Malware payload", "value": "2fd1efe5dee56cae61d8359b28faa358255bdcb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544472, "uuid": "01610a95-83ab-430c-bcf1-9b33463851f9", "comment": "Malware payload", "value": "4cfc544d7b7341af419545bf922a786ce1d7437b2cb3a18c78e9dd7b3d936e714df6fde822c2fd0263f3a9d3fb2f84b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544472, "uuid": "33fbb3d5-8e76-4a05-bfcf-10e6a783135d", "value": "T1020400EACB69C27DC5472770D4F0F5F08249ADACC5428E0B92647F2B33725862997C97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544472, "uuid": "98117e17-b961-48fb-8c88-0bf4a3c3a849", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544472, "uuid": "12a61cd7-47a2-4a8a-9cfb-ac57cba45a30", "value": "768:aIPL/4bO5T3R8c3byDhlDWEFuWj+98D5beukwA7M9SqFZR1hEgtqy2Q:HL/4bYRLglDWj98Jfkz7M9x5Uy2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648544472, "uuid": "5bccc2a7-197a-41e4-a939-3af24ea7b979", "value": 187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648544472, "uuid": "5f9539bd-2635-4d9a-b98f-73b4fd3e4685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544472, "uuid": "9436c222-630c-4ccd-a22c-86b562e77105", "value": "0af11be93fd49bde3f5dc03a3b92cbb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7fa372-af2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648536449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536449, "uuid": "ea0770b2-ee02-4c26-8267-4e510c292607", "comment": "Malware payload (Formbook)", "value": "3b61417dd02903d7ad8ee4fa83e8d512", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536449, "uuid": "6076bf3d-3935-4aa9-9355-68e7003286a8", "comment": "Malware payload (Formbook)", "value": "8e8134021d91305733bbf33cc41e5f9f0325ddf861b65b0eebec79369c0228ec", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536449, "uuid": "9971de9d-f734-4807-9eee-7485059b30a3", "comment": "Malware payload (Formbook)", "value": "a1bf9ed4873273d7d1ae9c4c3242a566b3d5944e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536449, "uuid": "d9068178-7c99-474f-9b31-7a4584ad2712", "comment": "Malware payload (Formbook)", "value": "7f03e07045a71995c6dc08fe8455951b7152d57c4ea36505fcc03b9458262d402ec068301530b4bb8c816384ca0eedb5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536449, "uuid": "b952aaf9-8330-4906-8800-6055d61bf970", "value": "T1F4A1F8A17338186BED2A95F6D575FFA302D6F1B180CB1504730CF9F00B773519AA8908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536449, "uuid": "4b53672b-5258-454b-89f2-e3c3c20dfd87", "value": "96:mUOysACwsOzJppNrNMABQfIbjo+A25T4xJJRqQyTRpXnEYV7hDU:iF7d0JPN5lGQE+X4xJJELVxEG7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536449, "uuid": "93f52fe9-a34f-464b-8cdf-fcc41b95fd3d", "value": 4981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536449, "uuid": "d6bcabe4-a39c-4fc8-bd69-94485cb202c7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536449, "uuid": "5a617d52-5f16-43d9-af03-f6fbb73bbc88", "value": "200.000 MT of Bulk Crude Oil with MV SIDER JOY.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582892ba-af9d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648585086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648585086, "uuid": "2a871496-209a-4031-afbf-a330c499f080", "comment": "Malware payload (Formbook)", "value": "3c1533bbc51eb3ab6ed5818ec7b2925f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648585086, "uuid": "0793789f-981f-4d62-a108-fca2835baa69", "comment": "Malware payload (Formbook)", "value": "8e89881e34371e10b7f9cb943183a061aab9b22853cb7192e1ac09401f4cc545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648585086, "uuid": "f4704683-bca0-47cf-8a9c-bfaf2f91e724", "comment": "Malware payload (Formbook)", "value": "1ee6fbef2497599dec7005a217a5814b3eb04a85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648585086, "uuid": "97dc4dbe-8bf7-4455-aa71-bbcfb6bd19f4", "comment": "Malware payload (Formbook)", "value": "0e8f76dd12f174ef42ae34016b0be2fb00ae7ddb7974fd6c0e9549061b51bf946a99e58d5fd58716125800cd840e978f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648585086, "uuid": "11ea85f2-6fca-47d4-803a-c020203786d4", "value": "T124350156778E8802C6BE97BB48EF400407B57D965623DB0E78C873FC0E263D2691639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648585086, "uuid": "1b573a92-66c6-46b2-bd87-1a84b8ba638e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648585086, "uuid": "c6b8cbe0-a019-4aa0-a7ed-42fd8848a486", "value": "24576:5pc+hdzasznFMOpWrAmfuCAFjTtBgDiQu+oZloF8OFkHkNF:PFMOpWkmBAFjbCikelS8OFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648585086, "uuid": "61c00e6f-e8c0-4d25-b605-aed46a350e28", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648585086, "uuid": "4bd8857a-6360-4b2f-aa40-c1af5e335ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648585086, "uuid": "d8a183ad-8365-44e0-b25f-b53742096cbb", "value": "New Order No.000053 - Project.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675866bf-af3b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648543021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543021, "uuid": "18d01bdf-7d1d-45b9-a807-fb4b2ed99ccb", "comment": "Malware payload (Heodo)", "value": "75e09d2885e41d6f9e5d3d6afee19a48", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543021, "uuid": "797b7ecd-4ded-4f44-98e9-20645d152f67", "comment": "Malware payload (Heodo)", "value": "8f4acb70fa910e2007fce439c1740a2d1ca543be53bd297395dc4a64607beea9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543021, "uuid": "3b9b5f52-3963-465e-be04-c8142eafe705", "comment": "Malware payload (Heodo)", "value": "8de7baa19632d20d14d244559d9f7033f28511a1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543021, "uuid": "9f6841e4-8045-4673-a32d-9a854e488827", "comment": "Malware payload (Heodo)", "value": "0412922ac390695f0bacbfbefb3a783ec655ecf722917c74f28adc9c7ef649cc76847da6ea09715222a40a43c0b2635e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543021, "uuid": "47021952-acd0-47fd-a1f2-421e9ba5e4d4", "value": "T1BF43E85BBA49989DEA14877548D743997323FC304F6B074B3669F3257FF89A04A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543021, "uuid": "b18db900-c949-4647-aca0-9e76d613d294", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgx5G9XSZ4XsvG:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543021, "uuid": "ab3a866b-3ebe-4ad4-87d2-245268df5cbb", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543021, "uuid": "963442c6-6631-4ff6-a70d-464f708d6e0d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543021, "uuid": "8c9f8b83-be9b-4dec-9fb5-1e6f24157dfb", "value": "Rechnungsnummer-ATR6064.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b98a224-af5d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648557711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557711, "uuid": "cbee0daf-9b99-4b94-a782-b2b2dfa11620", "comment": "Malware payload", "value": "d81bb61b36338642514c28ed6ee9a8ec", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557711, "uuid": "cce2aa70-46e1-4db5-b1bd-d30a70f6101a", "comment": "Malware payload", "value": "8fc1f6f0bf72ed8b3aa27852afbec1e923f6215afb26a55dfc45c6a59b585b13", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557711, "uuid": "eced20d0-1e6a-4bdd-aba0-c96360f6cda2", "comment": "Malware payload", "value": "7e3458a4da76041b175a33badc3e8875ac0e2b22", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557711, "uuid": "d9d768d3-d335-4f74-8287-1f901c1f5072", "comment": "Malware payload", "value": "279e4441db5ce1376a446f37334ac92d40837556a20ae113e269fefcfb5cc0e6413d83e7caf32f27a4857b72dec9e15a", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557711, "uuid": "fdb0b0d1-11e0-42c2-8e7a-20100d167586", "value": "T18CF2CFE5B67857ADCE4BDDB8AA58271BCAF8D0234724B45F510483443C6CEE8F910E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557711, "uuid": "307b6144-650c-4bcf-8751-d27a13cf12ba", "value": "768:F0+k/RO/FD+R20nE2CzpE+0ILQf/qPHf5mW:e+K0/l+RslEeLE/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648557711, "uuid": "d5d02d09-da1e-485b-870b-377e8802c197", "value": 36895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648557711, "uuid": "4f742128-153f-4d8a-ae41-3d4da282670c", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557711, "uuid": "10282561-eb74-42d1-a7fd-ec2a70ab82c8", "value": "Request for Quotation n\u00b0600 Steel Structure.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3adfd39-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648573267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573267, "uuid": "80215661-c23b-4b61-9df8-3ce12c5eeeb4", "comment": "Malware payload (SilentBuilder)", "value": "f3cacbccc54276e46353875c4cf999b2", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573267, "uuid": "9704a83e-6346-4b83-a964-71b4c5da8739", "comment": "Malware payload (SilentBuilder)", "value": "902afb7f03df7e3f3edd6d2d4caa7a2ec9530afd4f2a720d9fe66a89b30b5970", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573267, "uuid": "f4bf4d94-58ad-4c17-8b78-d78b3d807b84", "comment": "Malware payload (SilentBuilder)", "value": "3424ea99c716db59e7056c7001a48a653b2a993e", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573267, "uuid": "01d3e32d-aa9c-4553-a7d3-d3811de1aefd", "comment": "Malware payload (SilentBuilder)", "value": "ac9debcdb83126e7234b49396a796b2981773fe489240d6d9fa28b90e95283db7f7497aa0b680861bdbea3961b12ce74", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573267, "uuid": "750ce907-c6ea-417e-adac-1b8b2326852b", "value": "T186B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573267, "uuid": "3f65c6d6-6291-44ad-bf13-1628d71da760", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMt:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573267, "uuid": "2c2fe5ca-875a-4336-bfbe-35b19d678a3d", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573267, "uuid": "7052a41e-581f-42c5-9c14-920ef609eeaf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573267, "uuid": "4e4f5c8c-d6aa-4daf-9a75-2c46f3e8065e", "value": "f3cacbccc54276e46353875c4cf999b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8875aacd-af26-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648534057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534057, "uuid": "386cfd26-3140-45f8-97b1-85c838e87c9c", "comment": "Malware payload", "value": "f18beba0615ed12cf755d7ea3ce2f3e3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534057, "uuid": "bd8f2949-c1c5-4fed-b05d-5acc902e3115", "comment": "Malware payload", "value": "902db1f2dc940d759e7fc2817ec3667da9d0f3c53f7447a0ac691747891b3c98", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534057, "uuid": "184e3b1c-46ca-4d95-a160-bcbf5394d006", "comment": "Malware payload", "value": "fedccdd439fe6ceebfbdd9ae261f2be68083ff09", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534057, "uuid": "a83abe1e-84d8-46c9-bc45-510b463bf1eb", "comment": "Malware payload", "value": "e81ec4173dda8d2d01f80dd7fdfa07665d63a4c668e45eb5b240a0f424cf1bdce992115fa133d5541c02b205600d474b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534057, "uuid": "561b31d5-065b-48da-8949-b491a2ecaa17", "value": "T1F4746CC237E580F7DA6255313EE386496779BC648E328A937344BB8DEA31AC3E535740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534057, "uuid": "fbcec60d-0047-4b13-832d-2e49bffa16c9", "value": "72b3528e45595fafbd5f24ce92204592", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534057, "uuid": "2ecc1d9f-3b98-4015-9939-e0aa9294e0ce", "value": "6144:LPHIFvHxVBxWrhtOjMcD+t14e13gvXr7fa+CYSJ0fCU:LPoFPxVB0r/OjMciV1yja+3EgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534057, "uuid": "bfd3a983-5ba9-4cfa-b06b-bc128d211f2a", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534057, "uuid": "25ce6dd6-067b-4013-bdeb-a14361fe5cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534057, "uuid": "e5c2bdc8-4d56-4597-88a1-c26ff67e2b0a", "value": "kopa42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3565f3c-af35-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648540652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540652, "uuid": "c3c3b4f5-d617-483f-b7b6-4801f2115ef5", "comment": "Malware payload (AgentTesla)", "value": "0a18dc407895189c4ae1d190a2b7d3d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540652, "uuid": "f2d7d63d-2f9a-4004-9d23-91dbb971b39f", "comment": "Malware payload (AgentTesla)", "value": "905993c0c6fc055df22331028418780aa509235f529f341a53e9fad39e777adb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540652, "uuid": "865bd381-9ef5-424c-9060-d846162965d6", "comment": "Malware payload (AgentTesla)", "value": "71a7c634ab809346635a1a8c00f75da976176401", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540652, "uuid": "873bd23b-e627-4c34-8283-f43dbaf37e16", "comment": "Malware payload (AgentTesla)", "value": "f7e412c4f3ab59a244dad24b0947d158ef623fbf32c5b6ba2ac8e42ece039502e389c228f63208faf796c29efd8db365", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540652, "uuid": "f13a1254-3e74-4cbe-92a1-8d66063acc30", "value": "T11D73EB11A7A4C165D9EA8A395CF275BC0267BE03C832666BF4CDFF0D3B336404A51B69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540652, "uuid": "af19c8f3-9746-4fec-a517-5e3932c00713", "value": "192:23bcJsyiF+MwzepbyjYlPalcU6+x92JpRb:gbcJX9JepbyYlPal4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648540652, "uuid": "4fcb8a48-6a6c-45c6-9a59-7d4b25700245", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648540652, "uuid": "d331d16c-4a05-450e-a24b-57d207abfe3c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540652, "uuid": "9b9dae80-4bca-44b0-8913-7348ed8d87b0", "value": "Doc51200013784_1.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996d380b-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648562003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562003, "uuid": "7b691b8f-6522-40b2-aab8-3c35e24cb32a", "comment": "Malware payload", "value": "d42c2456ea9de66a75a29dea464a4e4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562003, "uuid": "9919227a-9082-4f85-a9c9-22a6e69251f5", "comment": "Malware payload", "value": "907e7f7e2ee47c955cf315747ab913b591e9046f51c0f3ba9a6eef696346198e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562003, "uuid": "bb16ba13-e490-4e8b-8ac0-354548188b26", "comment": "Malware payload", "value": "1e8ce36d82aab5d9ae09630bf01a77d92778d603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562003, "uuid": "8482b5a6-3f23-410f-960f-1695a7e61702", "comment": "Malware payload", "value": "98302ec83470962d81af339ab7ac7967971ed75cb42e93796ce3b68dc0558e8f9a32e0824eede2848d10afd70ca66b23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562003, "uuid": "16928f2e-ef54-47db-a558-1267f57c7eea", "value": "T1EDE333F09FF5B8A5E1252473B558B13C3BCB5D1EDC615836E28BF50A34628C224E6E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562003, "uuid": "a3af3bd5-88fb-4a3c-b3cf-26be832b1b03", "value": "0a464e2f61945ed36131666607401478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562003, "uuid": "0e6ada7f-da9b-4367-aba4-89dbb0d40413", "value": "768:fIHIzUzS7eXCHPVAfktEtzIpo9TRyG0onSwj6lGT4YEybLlY4aKHR++uVTShUhM7:Q9DCS48h0mvMkDmXPYavc7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562003, "uuid": "fc9b8bca-8fcc-4cac-aa31-bffac2f7c919", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562003, "uuid": "45cbb391-cd25-429f-9a01-ce10dbe2c184", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562003, "uuid": "94a29eae-f309-461d-8c7a-bac634457cf6", "value": "Runtime Explorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa4d76c-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648536914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536914, "uuid": "2e94f4fd-67bc-4829-81c3-bd26e8a0a9e8", "comment": "Malware payload (Loki)", "value": "a1524ee331c9d233800e61835338b2d1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536914, "uuid": "f23ec607-514d-4ceb-a65c-a56c7cdd5700", "comment": "Malware payload (Loki)", "value": "910a69b36978e9134b3d3311a59aac5f8ba1f7c66829e8490bfee85d0ffb2cd6", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536914, "uuid": "df364e8e-7ec8-4fa0-a58c-1f14c64c35d6", "comment": "Malware payload (Loki)", "value": "5f4a15e3f42b068ffdb0b54117e0b3b14543095f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536914, "uuid": "8a7c47db-62ee-4730-9d31-16bfb90b4091", "comment": "Malware payload (Loki)", "value": "40cd357fbe94f0553a6e99d54fbc1e9a4154673791aa389fdb28a5bc43b6f549cb1c05d5a60cdc5fd22982b3803ded9e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536914, "uuid": "4013d919-d08c-4431-94e5-8ffa42ea04bc", "value": "T1501402D2397E3041D79DD5BA0489A27D6273FD282A48014929FFB72EC6F499C46F7181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536914, "uuid": "f242cbf9-cd66-4daa-b631-44711341dc37", "value": "3072:vbsbXo9VO2vmRQSgqfBKBI4TgkCXsB/jVetiq/QJ2uJXIvxrvvbwAZ4cxEn4LY91:gj2+RQAUq4skksB7swJXer3TKcJ71y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536914, "uuid": "d8d2577c-ec71-4679-aea7-22961457f951", "value": 193560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536914, "uuid": "37577181-55b1-4472-aa2b-a391eebb05f7", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536914, "uuid": "9467b195-9599-46e3-b566-152832147d0e", "value": "Ex-Clearance UT190806015-1A027076\u00a0CH.pdf.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85bbdcac-af4d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648550803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550803, "uuid": "275ff312-b0eb-4f6c-a14c-a1d8d7cd4ee3", "comment": "Malware payload (SilentBuilder)", "value": "9009b2d1521f3e7e6a1b55cada6bfbf6", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550803, "uuid": "f06613c3-7a93-4fe3-b37f-e246bddddc2a", "comment": "Malware payload (SilentBuilder)", "value": "91bf5b39a9fd2b5a639e410a8125b58bde76924f778912df18496f9d54047000", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550803, "uuid": "5afba4c5-3d7a-4af0-8f3c-412ae3955419", "comment": "Malware payload (SilentBuilder)", "value": "94b85ede89dd8a4e9ef4d9b01fcc83d92bfae918", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550803, "uuid": "39fcd97b-f97d-47a5-936c-e23adc4b33dc", "comment": "Malware payload (SilentBuilder)", "value": "b58b568977a4ed6038e00e6f70528361ad418982134e9588626c9a43a50faec8d9c192002593e3ca2fd6c31ab13563b2", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550803, "uuid": "bb244b60-6940-4ebc-b771-3b2d351e9982", "value": "T1DAC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550803, "uuid": "3ff7dd3c-50cb-4dde-bb4f-39b41cf823ed", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648550803, "uuid": "92a3eaef-aa7b-455a-a07c-b2e46efe56bb", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648550803, "uuid": "cad4216f-3f1e-4781-a81a-a9a9dcaff24f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550803, "uuid": "e0391987-d07b-4580-980d-b9b3a91f200c", "value": "Fakturierung 2022.29.03_1242.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c592e50e-af2f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648538025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538025, "uuid": "e4b82df5-c86d-47a4-87c1-af788128f0bd", "comment": "Malware payload (AsyncRAT)", "value": "2361ca81240ccdd5f9307cdd3eb9ee4e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538025, "uuid": "8ff488bb-e145-4782-b654-bc0e34af48e0", "comment": "Malware payload (AsyncRAT)", "value": "91d5fd40e83493f75c087353ab3c17d1a934398bba79be8cdf14d1ec7595be35", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538025, "uuid": "b1c2f6d0-4e8d-4833-a0ba-27ae1ec143c3", "comment": "Malware payload (AsyncRAT)", "value": "370a53aaddf8a6fbad4df1c05e2136f663a8b06e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538025, "uuid": "f82d97d8-943d-4bfc-b687-70915a9c04be", "comment": "Malware payload (AsyncRAT)", "value": "c9844758a24ab9cdc5601af7dce1d6d6d2014ce29427a6217ebab4c53a4e64d94a8c491ee14fd05efca18dcc3bedb889", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538025, "uuid": "c8410951-4f21-465f-aa57-2a5fa2579cef", "value": "T1B825029137C9C536E29F063646BA8776363A7C351B21C1CBA7943D6C4E317E3AA39312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538025, "uuid": "ab1755c1-bec5-49cc-bf43-d73971cc18b0", "value": "12288:nAItMRQ+gjpjegLyo8Q6pwmjK+kk9HrGCe/n5R2swSJaGidpn8MakTJbkWEeTuIw:ltWcpVLSfZLGC87wLikT5dEeZZne8yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538025, "uuid": "502148fe-a708-4e3d-ad14-b45616b72fbb", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538025, "uuid": "858a37f1-1967-4473-a306-03a4c830a515", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538025, "uuid": "a37f74af-0b51-4fc9-bfc4-94c932423c7c", "value": "PO_4123.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238c0fce-afb0-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648593158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593158, "uuid": "05d488f7-d38a-4f71-b968-45a4d25917d3", "comment": "Malware payload (SilentBuilder)", "value": "a372ece810640159b5cca41ef70ea4f8", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593158, "uuid": "44824b2a-71c3-4e6a-8759-10cdeb2e91fb", "comment": "Malware payload (SilentBuilder)", "value": "920579a1174f8cc0b853233208e141ae75e1a36671b63026dabc79fc216f2493", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593158, "uuid": "eb5d6748-5081-4c9c-9ea8-5ef1a3fa7fb2", "comment": "Malware payload (SilentBuilder)", "value": "3cc9dd5fc3d148af0af2007b5fb9d4f29c399134", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593158, "uuid": "d493e506-0002-4e7f-9f9e-501c02efbde5", "comment": "Malware payload (SilentBuilder)", "value": "6763ffbce5dec40de4db3e447e60eea8ae3881283921dc9f1384ae7ca98027f16cda22e3ffc43f72d52a6179ff6d1eb5", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648593158, "uuid": "33f82b52-89f0-4169-b6b1-fceac3ad9bce", "value": "T109B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648593158, "uuid": "fccacbeb-881f-49bd-8a69-6a5203125f4e", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMi:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648593158, "uuid": "c9c7ba09-4a3e-4fc8-8b1f-740a089236bd", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648593158, "uuid": "ca414db5-c0e9-4573-ac7a-c8057f3f385d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648593158, "uuid": "dfb562c0-ddd1-4f06-90fe-868c8c79932e", "value": "a372ece810640159b5cca41ef70ea4f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a395bd52-af54-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648553859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553859, "uuid": "87192709-3859-454f-95ef-4265a035fb10", "comment": "Malware payload (Heodo)", "value": "8a0094b59e6a40797a744d656a793507", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553859, "uuid": "b8411f92-d92e-4c9b-99de-1482bc957cb0", "comment": "Malware payload (Heodo)", "value": "921524cbf158547c07255bd087b4783cce6f731834afef6f5ab6ede3a1fcb22c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553859, "uuid": "3d6adb4d-4957-4cdc-8bd6-14ee6a3caa41", "comment": "Malware payload (Heodo)", "value": "940d3fa1c80b581ef1c30e147ff3832f297bea00", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553859, "uuid": "20020e53-8871-464f-9363-e8a69beeec21", "comment": "Malware payload (Heodo)", "value": "05bad113a651a32e25c5ab59c9ba8d54bbae8c1075936409024aa11519b4b3dcce757ad3ec4dbfa7c7b85b61ecc13fb5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553859, "uuid": "95b002bb-d698-4851-a48a-2c909f1339cc", "value": "T146A42A51A5538073C7FB25F2CAF152B766D5AB91C73B452E02A8C13F7928E837762E20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553859, "uuid": "c5d209f4-eaac-4c8a-9ea3-92df4b060f40", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553859, "uuid": "34e88321-b0d1-426c-9764-af49f77a0b8b", "value": "6144:U/L5tYtXZ1BpFHyFjJmP/RbV1M2lvMOeL/grx2Xr3GzOi/r9WHkiyfuYyOJZr:UWBpwupxl0OeL/grx+GzO+r9AjCbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648553859, "uuid": "787004f8-7280-420b-b793-43439be43d3e", "value": 490864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648553859, "uuid": "05e1f7de-df6f-474a-95e6-74d10211609d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553859, "uuid": "864f8817-d4ea-4c1d-ac31-85e11c6e6e5e", "value": "emotet_exe_e4_921524cbf158547c07255bd087b4783cce6f731834afef6f5ab6ede3a1fcb22c_2022-03-29__113734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95103e0d-af49-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648549110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549110, "uuid": "0fb88b3c-f3ae-4d3d-8ff2-a70a38e376dd", "comment": "Malware payload (Formbook)", "value": "e559abfd18526903b15e23a80267c721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549110, "uuid": "31a37a6b-b5ff-4576-99d3-5811e92d2da7", "comment": "Malware payload (Formbook)", "value": "934cdab74883aa6b38f53310f73ffd5b8c4a175fad14b9eb5c6873653242410b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549110, "uuid": "c8c35e41-4b14-4d56-b61b-02c725694ed6", "comment": "Malware payload (Formbook)", "value": "bea3ca7b073e5c153bdc4cc4be65492f5078233c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549110, "uuid": "95fa0cb2-8699-4812-bf17-045986b3f116", "comment": "Malware payload (Formbook)", "value": "1816fef76ddf9e593592425e2937852793c1127a30f3abd21239ecca9c68050369f88d448a2a5d1a692115d33a822279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549110, "uuid": "fc61bc93-23d2-4765-b0cb-281d488f5f0b", "value": "T116A40198368FD527D8648FB21C35C46AA6799C349D79832F3310BB6C1F732E26636346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549110, "uuid": "e4b5e795-12e5-4575-8841-223359d581c8", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549110, "uuid": "ba1b34de-91e3-41e5-b24c-07d8f2548f2d", "value": "12288:sNB39rXiZsJmar88ZTvdpFrNlX96ZvazacE:sNBprZLJ9KSmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648549110, "uuid": "e87d89d9-3ea4-4336-82c6-3873ac359dcd", "value": 482169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648549110, "uuid": "b93bfb78-05a4-4804-b0fc-d112ede7999a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549110, "uuid": "e9b2ca47-0edb-41a4-8448-dd3e602429fa", "value": "RFQ#505.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b991c1-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648573236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573236, "uuid": "c0ee2734-08fd-43a2-a652-e894ef9de3a5", "comment": "Malware payload (Heodo)", "value": "bb605ad87576582d7ead6215af8a7e62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573236, "uuid": "fc3a562c-bf1c-4164-8d1f-01f90c92e5c2", "comment": "Malware payload (Heodo)", "value": "938f75e4dfc8b72dd5cdd167941343be85f8f9fa87a389caa5f1a602478d8924", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573236, "uuid": "56cd814f-bc7d-4377-be1d-89887cad39e9", "comment": "Malware payload (Heodo)", "value": "371b238bb0adc3b0ea1fb298ea0a8044c94d45ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573236, "uuid": "36ffe3f1-948b-4214-a061-2cac6a4902f4", "comment": "Malware payload (Heodo)", "value": "0c6057029f167ad6d69477a514e7c07237a88f2a1a0a32b89f74401aef02bf325801aa6ee32a79e378b7014d2852fc96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573236, "uuid": "661faf0f-509c-4da9-961d-add01427ebd1", "value": "T1A8D45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573236, "uuid": "59ee3be8-3b94-4886-8b65-c5de45d6a14c", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573236, "uuid": "a8cda1f0-bafe-41c5-b304-0d8c71adeba3", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzvipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wAooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573236, "uuid": "0175fd8e-0555-48af-b480-c888193dd267", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573236, "uuid": "17f74b2a-a403-4e21-9487-f89e8de9d891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573236, "uuid": "baab6b09-4778-4511-bc6d-3c0d0f36c9a5", "value": "bb605ad87576582d7ead6215af8a7e62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa537711-af56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648554864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554864, "uuid": "11911793-e098-4882-9c79-5aa2eb33ecc8", "comment": "Malware payload (SilentBuilder)", "value": "d4182a13c54d249e954f85c8dc2a52dd", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554864, "uuid": "4fcd17d6-10da-4d00-9398-9d0e970fe514", "comment": "Malware payload (SilentBuilder)", "value": "9398fc833cf5282292c099dc5124e054e5de70965f9d90dcfecfd07b9ee7b682", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554864, "uuid": "4a361bf2-afbf-4eab-96e2-5f747048a928", "comment": "Malware payload (SilentBuilder)", "value": "993fcb21c3e44f89baf68fe6f642a5867f4cbb89", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554864, "uuid": "31d0b777-6376-4bfa-a8f6-a2e720a25e19", "comment": "Malware payload (SilentBuilder)", "value": "c6b52d479b874a9c87904b4fd3f29993583dc7693416eca3054d741c453675bd5bfe8275bf8fe96da006d7e084a3dd0f", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554864, "uuid": "4e3e34ae-e9fb-499c-9d5f-117a03b413fb", "value": "T175C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554864, "uuid": "f2104fba-a928-43af-83da-275d2b1af338", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC8:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554864, "uuid": "ec7ca299-8f44-45a1-9649-8c11195530b8", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554864, "uuid": "814ec0e1-8471-4169-93f7-5cfe23f3f65e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554864, "uuid": "106990ff-7f7e-463d-9c8d-e472df7741b0", "value": "iMedPub LTD_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a3f79c-af9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648585719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648585719, "uuid": "5e40bf17-2a09-4a22-bbac-b3033a9450e8", "comment": "Malware payload (Loki)", "value": "4fa138fe0525ea43f96d9f62342c52cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648585719, "uuid": "e3897fd0-fa4d-4ba4-b47f-ba71f481d7b0", "comment": "Malware payload (Loki)", "value": "941c78af50e0ed8e8189bed4978278b5ab3f5370ed979d6f75196451e3d91651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648585719, "uuid": "2e7e24b8-7009-44da-8111-9035fdaf894f", "comment": "Malware payload (Loki)", "value": "d4e4ad286e169084371204b8fba6efc532767e5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648585719, "uuid": "85ea85d1-7a49-442b-bb74-76affc7bb44d", "comment": "Malware payload (Loki)", "value": "cfeef31e01575ce8c09f287c3fcdc36045a276cb1a7ef2590b3336c37f313ab21ffc3ffb323582d304a16391426baba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648585719, "uuid": "97eee587-e888-44ef-a167-47e658013352", "value": "T19BA48CA6A7C08F47D507073486F2AA39B07A9F487FF7D64E4369B4243F327C9521948A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648585719, "uuid": "95a58c0c-33d5-452e-b698-4173969a49fc", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648585719, "uuid": "7d59c105-2260-4252-bb4f-26aeecded8d8", "value": "6144:IGikTIF3HNiUAFQizpkY3I9Hyd+WxmHKSpSBuIL9OHR90Wo2:PkY3I9S04G+BEHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648585719, "uuid": "df18ed3a-d00c-4893-a734-3cca9228f0e4", "value": 477135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648585719, "uuid": "8deb9599-db3b-44e7-a3b6-b8ed6af4db16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648585719, "uuid": "1668d770-2968-454f-90c2-3b183fbb97d5", "value": "4fa138fe0525ea43f96d9f62342c52cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2243702b-af31-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648538610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538610, "uuid": "6892dc16-395a-4e1f-b814-d64f2a429c8b", "comment": "Malware payload", "value": "78e574cc274175af0d28ac9bb6a76208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538610, "uuid": "235f56de-49d6-4a43-a915-943f4fa39eef", "comment": "Malware payload", "value": "946c502d6cab6e5a78e98e3f07b992b53843ec726853bf90a53fe88db363862c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538610, "uuid": "bf3b6183-e266-4a24-980a-2d8a940b96e2", "comment": "Malware payload", "value": "356806c4c78f2f8e1eb7dcc132240256a9aead52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538610, "uuid": "ad5f3e8c-0caf-4356-a8d5-47a534d28838", "comment": "Malware payload", "value": "b3eb215d0b7f1357bdbe546f3ff0ecdd904e02944e794d2705c9f03c2f6ffa07f69703f79ea8a8b7f651216e302594a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538610, "uuid": "85e2fced-e404-4694-8457-ff232179e434", "value": "T1456633E69D57CDE1FA1204F08D91EBF824D3AD2559409D16F0833EEA0633EEB1696372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538610, "uuid": "f778a155-52f3-4a35-98bb-f1395d7d2e5b", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538610, "uuid": "4182d0ed-4757-44bd-be07-20c821159ad3", "value": "98304:okPrV0PTJnbHe/H3DbC4qW7qm085bpOnDITr7gIcX1vUOGL5q8fS0HGqqJryF:okDV0LYvPC4d7IkcITEX1cOyNH0yF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538610, "uuid": "b572742b-11ad-429f-aab6-1e0bbbfafa3f", "value": 6486650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538610, "uuid": "8dd95340-d120-4764-9f5d-4d28b64cd099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538610, "uuid": "4ae35e08-7011-412f-af0c-2bf835c7bb83", "value": "78e574cc274175af0d28ac9bb6a76208.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e4112a-af32-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648539093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539093, "uuid": "3ed0052e-52c2-4a8d-b4bd-183ed1380aab", "comment": "Malware payload (RedLineStealer)", "value": "38db5a46a3e1e749720122b74d2ffd24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539093, "uuid": "400a069d-b0be-488e-b496-2f84eaaa760b", "comment": "Malware payload (RedLineStealer)", "value": "94b0f090b6eea3eab0c799239b5a3be63245a4372272b06461b1e155c9b9535b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539093, "uuid": "dbe9de2f-8a6c-4d2f-8aea-228def9a60fa", "comment": "Malware payload (RedLineStealer)", "value": "fd07f64d2f0a88149822b8652c797ff0deebef38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539093, "uuid": "2b413786-3462-415c-ae33-9096d0a8afaa", "comment": "Malware payload (RedLineStealer)", "value": "0e2315d06b94404f2ec4e661ff1b895cdf40827e4657b7ce6a9eb1863c52a9bc039ac98d210b68017c45afbd50652df5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539093, "uuid": "f1e766eb-ed21-4100-b242-1b2a9ba8a4e3", "value": "T101D433D029C27D81E59A06B2073FF90F05F6A496CA1DB48DD29DEF4B3EB403AD41C4A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539093, "uuid": "c9b5ee75-cdb8-40cc-a71d-5a118b4ca9eb", "value": "6177777cd67f32c7dfaa28c6d6e9d36d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539093, "uuid": "d9d3ccc8-cbc5-44d5-9f31-c19770e0d3c3", "value": "12288:g4K7app/tHPgBAqzAg9MwQS03ULaHNqrxlKIQNoiMHWkSrYPiATSvs1:XRvHqzAxwkEaHNYK3V30itQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648539093, "uuid": "c0e1bfcb-67cc-4a0e-b521-0afb817ff3b9", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648539093, "uuid": "e5dd4a1b-ba39-4601-b63e-9bdad5e7389a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539093, "uuid": "7aea8c9c-6a64-482b-8793-884047825e57", "value": "38db5a46a3e1e749720122b74d2ffd24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76689fc7-af86-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648575258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575258, "uuid": "ff593b97-73f2-417e-9bc3-eace726c0796", "comment": "Malware payload (Heodo)", "value": "9760d20dc11f683019229ee48080c805", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575258, "uuid": "7655c5dc-39b6-4d8d-9f1c-83291ee9cc74", "comment": "Malware payload (Heodo)", "value": "9502e24cfcb926626cd2a99106bb79d2537bb3c5872e3a508cbe68ffdbc7f6e7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575258, "uuid": "aff8d129-c201-4fa1-b262-c44f81d49329", "comment": "Malware payload (Heodo)", "value": "9c5768cf27e3a6d3f3839604d8db8b1c6f6f6ef7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575258, "uuid": "b80a06fe-a943-4337-844d-957cb37218dd", "comment": "Malware payload (Heodo)", "value": "b5c9e3083b152d2e8082e710f2800d609aff9922d81ae4566095cc5a819bafc69b1728a2679f3ac1ac8c6bea2ea36216", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575258, "uuid": "3dc1be54-2a6f-4861-ab21-3228def47770", "value": "T1DCA49DC87582C132DE7B4B75C552CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575258, "uuid": "002ba527-2719-44d3-83d5-bee58345d1f9", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575258, "uuid": "df1b5719-5d28-4c43-ab08-aa4bbadac197", "value": "12288:myXvaWo3sPddfrkREpBLsORdPDpFlrh5W:F/as1dDkoHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648575258, "uuid": "cd4ba2c6-e064-43cf-a914-aaa4987a95ad", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648575258, "uuid": "7eb8cf08-7b6a-4059-8232-c0f77520b142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575258, "uuid": "599ebe33-b50d-4b50-b4ae-ef30d0621de8", "value": "emotet_exe_e4_9502e24cfcb926626cd2a99106bb79d2537bb3c5872e3a508cbe68ffdbc7f6e7_2022-03-29__173408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c3efc6-af5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648558042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558042, "uuid": "2b235667-d16c-4451-8a0a-efcc5106188c", "comment": "Malware payload (Heodo)", "value": "aa8c79d4efe6b3e566d8e12b2987bec5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558042, "uuid": "0feea4b3-6753-43f7-ad0c-cfdc225b7d6d", "comment": "Malware payload (Heodo)", "value": "9511817372e57c6aec96c99b4624b9e4ff65162dddbc67579e0e7431b61f1d94", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558042, "uuid": "15f9f06a-244b-466c-b952-ac02946fcee7", "comment": "Malware payload (Heodo)", "value": "254b41f63acb9ad0fa88e04528a94b3b48669a8b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558042, "uuid": "3d6d9a69-dcb8-4994-8cb0-85d97f3fd9a2", "comment": "Malware payload (Heodo)", "value": "cbb9026f3407639b6a67fe9b19a5dd1b41b5fc32a203b4f7c77be87338e0dc2e1c9d3aabc5999ed48ca1681201d8861c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558042, "uuid": "ec2bd5fc-345f-48b3-8f63-61fb4504fc93", "value": "T157D45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558042, "uuid": "06d933a3-1043-4bc1-bb16-847e795f7490", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558042, "uuid": "baf6c003-7513-43d4-86ef-099449f36a5d", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzaipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wVooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648558042, "uuid": "d87f12f4-5b4a-411e-812d-4eb044666143", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648558042, "uuid": "5668e658-2531-4f8a-8752-6081e222f061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558042, "uuid": "8b4871b1-35d7-4506-94fb-3b224edd6e0c", "value": "ZQdzwfQdt3woKasBaTRVo.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08d3be8-af2f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648538043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538043, "uuid": "e305f92b-81f2-4739-879e-62fb114ac42c", "comment": "Malware payload", "value": "c5ef9ce9ca955bd614ff63afd20edf5b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538043, "uuid": "55afdc99-491b-44aa-bae3-f8de553f469a", "comment": "Malware payload", "value": "9534e4c84184d2ee4e9bff0b58efa494f8dea707feada803c3683fe62327c963", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538043, "uuid": "316d4a1b-bc23-4312-8c42-4c1d8432777f", "comment": "Malware payload", "value": "d131f5c4d46fc7763503b97d83c67da3de8ac347", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538043, "uuid": "758b5cc5-eb8e-407a-a1e9-6ead82751e75", "comment": "Malware payload", "value": "4f35cdeaf9ae5fa66c618061d1f772aa1b5a12bffee5c04d3ae5e265254d09ee1783821759fb5fd68c19b42caa087746", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538043, "uuid": "1497c158-2352-469d-b2fc-a29712b6880d", "value": "T14816234BF586CB3BC5FB8B31656BD33680B6E034416346675364B40E7DE2284A3EB1E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538043, "uuid": "c11cb16c-5b3d-4e9e-9e9d-03f53b27b26b", "value": "98304:j6Y5AlIFrBvf/jMkQ0WWCowEUKIFrBvf/jMkQ0WWCowEUFIFrBvf/jMkQ0WWCowH:jVFrBv/QbWCoyFrBv/QbWCohFrBv/Qbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538043, "uuid": "ac7d5c0b-5702-403c-ae10-cf50d0b953ea", "value": 4063744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538043, "uuid": "0f0d4830-2e05-4dcd-8830-c3bd6f0a4bc6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538043, "uuid": "8ef8aa01-e4d7-4fd5-94f0-150067865f74", "value": "FormularioCorreios.LJ83GZP042VZT.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a21522-af3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648543825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543825, "uuid": "e4bbd827-7244-45ea-bf9b-a39b0b6da9ee", "comment": "Malware payload (Formbook)", "value": "064fd42a1630d44f682005a653d323af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543825, "uuid": "1f7e0b33-1642-4ccd-9cf3-e101177cfaf7", "comment": "Malware payload (Formbook)", "value": "9588676eff43c409821301993f0eeaf9ed248525f1003fa6ed499f4746538957", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543825, "uuid": "3aee8136-301f-44df-9492-7360c2972aad", "comment": "Malware payload (Formbook)", "value": "c04de7ac67363233ee29ac5a72b79d20c0dab275", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543825, "uuid": "c7e98105-077f-4af5-84c2-d043d1ca5aa4", "comment": "Malware payload (Formbook)", "value": "0f1e308a4022c69a43392622de83de2fb8a28ab8cf1b356a22b90a8f3a8961240dc72d7ee9db63f1eba3732d621f71b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543825, "uuid": "82e76a9b-eed9-4791-ba3b-b382ebfa720b", "value": "T11C35F1113165695AC41A40B6CCA598CC0770EE46AEBED29F3CC237DF1AB17C7A50EAC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543825, "uuid": "4661e7ec-3e81-447d-9867-1bf321cfbd66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543825, "uuid": "28b0fe46-dfb1-4d30-8fcf-ab94b11502fa", "value": "24576:LtEQtFofy7oeEhIaluZipaUGMHZx07lD6UWRotpt37CU:LtjrqycdhIAuw5mF6UWRol3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543825, "uuid": "515a4737-ae84-49b2-81fd-160f377a590c", "value": 1154048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543825, "uuid": "cb4323da-1a85-4fac-802c-75d20897309e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543825, "uuid": "c604a5bc-fbc0-4474-b51b-d2302110146c", "value": "064fd42a1630d44f682005a653d323af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3daf19-af3e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648544480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544480, "uuid": "a35dbfe9-1503-436f-9e77-d7ca2ec78ba8", "comment": "Malware payload (AsyncRAT)", "value": "be5a9260212bf1ad09d582507cd83c31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544480, "uuid": "9e32a066-801a-44e0-b023-dfb4f1986e98", "comment": "Malware payload (AsyncRAT)", "value": "958fc4d5abcfe19260c6571ca2303e24da960f828cd4c7a806e8f51c766c0276", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544480, "uuid": "b3ef5c1b-afdd-4987-9c84-93473262b5e6", "comment": "Malware payload (AsyncRAT)", "value": "4e49c1cb0e3d650b73cb1f6f0f75c415770eb978", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544480, "uuid": "128f8964-ddda-4a64-b37a-034e83ec4727", "comment": "Malware payload (AsyncRAT)", "value": "b964a46942c069b3bbef5abeeb3353290a28e548dfde11def309551588aef2fb3d31321023cd30dda5ba4e19f4d92065", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544480, "uuid": "e0580a97-b0ae-4ad3-a7b3-7011d81d3c38", "value": "T10115021827E88541FAFE57FEE4B540004B30B51B222BE71D96C628EE1FB7782965B353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544480, "uuid": "4af9464f-5f0b-4ed2-b50f-c6601ffa4ae9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544480, "uuid": "b03e6ecc-90cc-4f45-b4d9-db65df839fdb", "value": "24576:wYezYT0rbcbFZoTgu1365eNOxV1xPJCRb4AZsH:wYezQ0rbc/8UC4VsRbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648544480, "uuid": "1147788b-0317-4e2b-a31d-d3ffc6079abe", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648544480, "uuid": "e1c3140c-6e46-4218-a9b7-01de394eb8b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544480, "uuid": "bf4e2456-576f-48cb-b49f-5f33b8bb50ca", "value": "be5a9260212bf1ad09d582507cd83c31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee38ba7d-af50-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648552267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552267, "uuid": "378c39af-adfd-4d71-b642-e8ca52e46553", "comment": "Malware payload (SilentBuilder)", "value": "578ffd0a86732d2ab208e03359d68fa3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552267, "uuid": "d28e6577-49e1-4ccf-b0db-cfa020177db7", "comment": "Malware payload (SilentBuilder)", "value": "95afc5a338cfff3bc76c56bb78ea18097e81ae6f976cdd47d5f8a5d3f891d0fd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552267, "uuid": "bb7eab48-d885-4fc9-865f-ebfaaa0e986a", "comment": "Malware payload (SilentBuilder)", "value": "4d8d7fb97de03e5a619f7afa24c47371b33c7af9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552267, "uuid": "0a1fde08-64b3-4c24-b28f-dd1ce4cf3bb2", "comment": "Malware payload (SilentBuilder)", "value": "82d5c6d37e787d8376c2c2cc1d0ddd772726c910f60732ce247c8011de57f3c7fca8a882dae9b03afcacd00462490ac6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552267, "uuid": "4c6b7b25-de49-418e-aa67-578b6fbf4915", "value": "T128C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552267, "uuid": "c836fec2-6886-401c-b19f-9a39ac4ca4f1", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCY:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648552267, "uuid": "59bce587-921b-4769-98b0-ecd648a1c9a6", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648552267, "uuid": "725ed397-8ac7-4b87-a813-565c087a00cb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552267, "uuid": "45e3c6fc-b58a-4ba8-8858-d4c90fc97f5e", "value": "2022-03-29_1253.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252ef45a-af58-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648555365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555365, "uuid": "73a74c14-d768-46ce-bc63-351181d06bce", "comment": "Malware payload (njrat)", "value": "b2f13cf553f2f4d950fceeecbe1c3fd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555365, "uuid": "cc735eb8-256d-481d-81c0-37806cc90ae0", "comment": "Malware payload (njrat)", "value": "95ebe9d86550cf47b6711fbe93041a5c1156a95f904fd249fc73df69dac2c4f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555365, "uuid": "b778f426-857f-4a2c-87b6-97bc33065a66", "comment": "Malware payload (njrat)", "value": "5b2e945a224980f0d71afdb168976281d04af8aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555365, "uuid": "692e8d8b-9087-4f7e-b352-36b513602c0b", "comment": "Malware payload (njrat)", "value": "c5670b98337e22fe93d6f6eadc14d2e63d4293ed881405fc2cd60329d2fadf89e16c4971e4c3dd6f37e206de329055ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555365, "uuid": "f6e36dea-a832-4dd6-ac66-cbf94c384f41", "value": "T1F3E208067BE94215D6BC1AF88CB313214772E3838532EB6F5CDC88CA4B676D04255EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555365, "uuid": "261b6b69-ee92-42a4-8a6e-01f79fc0c550", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555365, "uuid": "93525360-04f7-483e-bc40-1a101785b42e", "value": "384:S0bUe5XB4e0XOOZzw0Q0mS03AWTxtTUFQqzFoObbV:LT9BuNC55dSbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648555365, "uuid": "a0a1e4fb-4108-4993-8be8-7164ff08b3b7", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648555365, "uuid": "58c8cc39-4c8d-43b4-a32b-a8f3e96f5721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555365, "uuid": "6999fcc0-565d-4c43-86aa-c259e6b3376c", "value": "95ebe9d86550cf47b6711fbe93041a5c1156a95f904fd249fc73df69dac2c4f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355a32c2-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648536924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536924, "uuid": "d43cd89e-19b3-4016-a0b0-97c587326b27", "comment": "Malware payload (Loki)", "value": "59849a264a7d7a4c85237a030cbce583", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536924, "uuid": "d33f98ed-4811-4fbd-9274-8565092be2b6", "comment": "Malware payload (Loki)", "value": "95f7ba12b234e683d53ca762e78ed5756000538dd4e6beb30ef3c64d0b89651e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536924, "uuid": "a2bb1fda-8b4d-4577-86cd-b2056a5c9c80", "comment": "Malware payload (Loki)", "value": "8b5b7e6d02c12b47cd12307c22539a1f5570a776", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536924, "uuid": "ee746299-a0ca-48f3-a5ef-4a114e9a40b5", "comment": "Malware payload (Loki)", "value": "89dd35701fa697effb16f313263233471866f86b222f3aa0a7c06f84951dc76e240fac4c91dfa559e29ec427e5794074", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536924, "uuid": "201fe1ea-6a3a-4287-9b11-7e45a2a2cfd5", "value": "T17914123A729E86DEF9810A394BB163F031DAFF0AC084275D76E436AF7834984C6835D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536924, "uuid": "85b2dc65-421c-41b9-bb5a-fd94b6d421c7", "value": "3072:xkDw0W/q3Tip59Kgs50b/zFNzvUx4UAKztP5ynhgFnx4rXpCbGm8o0PtXk+fjX68:2cv2TifA15If/KFYIx47Ib58fRqXKyEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536924, "uuid": "d66717bf-c67f-4305-b278-3a3b5bc96881", "value": 193672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536924, "uuid": "e38afc90-a842-4957-b3ab-84dec54dc8a4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536924, "uuid": "0666d369-aa86-45e7-8b9a-a73ef0081696", "value": "YUESHENG PO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755f845c-af49-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648549057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549057, "uuid": "a16dd2fc-7f6c-4ef4-a596-ccedd6a5c86a", "comment": "Malware payload (Heodo)", "value": "d98b0b13eb0e1a083eb2f06356bb15c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549057, "uuid": "28a98049-8979-407d-9f2a-1796e9b21dc6", "comment": "Malware payload (Heodo)", "value": "9619fd058a6759084878632b4504ca578248c84cf158cd1e621a7c5aacc3a50f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549057, "uuid": "fb5471b9-9ecb-41ec-b44c-ad87b3e190bc", "comment": "Malware payload (Heodo)", "value": "c4e934a1ebdeea935376e41531d4e2e883fcda99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549057, "uuid": "4025a9b2-6d4a-4fb2-9ca0-88a0d3b25f77", "comment": "Malware payload (Heodo)", "value": "4738e9d4e270090f53a7cef390fb255d1a6243c346363b0840b876d9c04396acba46acc838048ee68c8f119917eeadcb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549057, "uuid": "52b4bff8-031a-4e65-935c-c8e3428939f4", "value": "T120C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549057, "uuid": "65e06d2b-e3d6-4c68-b172-0a3a76882631", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549057, "uuid": "14c2e5c6-644f-4a09-a4db-63ad9a842562", "value": "12288:iUV7ciwHX3ew9aYU3pAc9inFijaQeL+nZBb:UiMX9IGky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648549057, "uuid": "a9da71d7-cfd3-415e-b3d7-4d7b43fdd50b", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648549057, "uuid": "cc77a3a9-75a1-4751-9226-c43fbd362fab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549057, "uuid": "187c9425-7328-4f0b-8f37-6d8ddbf5423b", "value": "d98b0b13eb0e1a083eb2f06356bb15c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b5b284-afae-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648592437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592437, "uuid": "4805238e-37e6-40b0-ae15-d1dd3cdd34b0", "comment": "Malware payload (SilentBuilder)", "value": "6eec2528504c7464dc661cdb3ad83a21", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592437, "uuid": "bd2e9f77-f55d-479d-ad09-a2e5ce943cd4", "comment": "Malware payload (SilentBuilder)", "value": "9677d1839a675f53ba555ab21be652c97f9759c9b2194be0756f6d99ac145f5a", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592437, "uuid": "d10dd9f4-40da-4cc2-a65a-b027733f2fe4", "comment": "Malware payload (SilentBuilder)", "value": "5018aa9c5103bbe37e30f4f19d283d8b87fc5d23", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648592437, "uuid": "5323aaae-1e19-427e-bec0-00b15a595daa", "comment": "Malware payload (SilentBuilder)", "value": "190d8d5037574d56295ad0e7d5809ba39a72d6038cf04ec4697871511c66e8d6fd7552f47a327f43412f10f7955f9619", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592437, "uuid": "4bb0cbe1-06b7-400c-8029-10e2bf2b993e", "value": "T132B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592437, "uuid": "064316e3-efb6-4e80-b10d-e0aa3ea017c2", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMe:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648592437, "uuid": "63658ba9-133a-4225-9b6f-d518dfd289d1", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648592437, "uuid": "f612cd7c-5578-4ea2-8420-d928b5fd30cc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648592437, "uuid": "49028546-209c-47c5-ac61-00b2bfd24327", "value": "6eec2528504c7464dc661cdb3ad83a21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e92c85-af84-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648574263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574263, "uuid": "9761df04-dbdd-4963-a854-aec56b6824b1", "comment": "Malware payload (AgentTesla)", "value": "36bc01f1a2d88a0d27c47a582ead8c7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574263, "uuid": "36ba5a0a-545a-4560-b738-feb32f722bfd", "comment": "Malware payload (AgentTesla)", "value": "980b3cbd822808ce9bcf9acf21c0cb4f1ca1106c47e0533e18669ade27f9ccac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574263, "uuid": "e8675ac8-4182-40b4-a425-409ead9a4eb1", "comment": "Malware payload (AgentTesla)", "value": "c80064c65ffe2db8265140be24c72d4a965ed8d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574263, "uuid": "fdf2d372-4d45-4978-8993-5e7d7215df47", "comment": "Malware payload (AgentTesla)", "value": "6bb4dfff250d7840a9a210c80dafabe87b369de4ebd9cf3bf943075d6cf8661e55a8e46aba350e3c5b0a7084932b9076", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648574263, "uuid": "50c87c21-0e52-44b1-8ff4-fad6c1165191", "value": "T16C242DC5E98465A0DD59AB716A36CD3582237EFDA874A42C28DE3E273FFB2D31025053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648574263, "uuid": "e6390b40-21f2-4fb6-aa5b-13b0487e975a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648574263, "uuid": "ffbfa4e1-1ca8-4b07-91d9-6fc544927766", "value": "6144:dbiAkztmr9r/EDpppppppppppppppppppppppppppppb3:g5mr9r/+pppppppppppppppppppppppv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648574263, "uuid": "44bf0c66-fe55-49d9-baa2-6f4720275753", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648574263, "uuid": "11fc50a8-398a-41a5-be3b-c3e7961c59d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648574263, "uuid": "b3c93f02-bad0-40d8-ba3c-2e97670b8254", "value": "SOAINVOICECN0010608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e606677e-af6c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648564279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564279, "uuid": "3a8f312d-0aea-41fd-a862-75c2b80f797a", "comment": "Malware payload", "value": "76a0c14da6c96ec9777fbbd1b7e28d82", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564279, "uuid": "67e1dbe6-7969-42f6-a1f7-098e05b26e97", "comment": "Malware payload", "value": "98c0863eb3f583ccd3b081539ec99b0236d9b23e7922b1cc046199756bcdf404", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564279, "uuid": "abe3fe74-821b-4288-b5f2-c1209581c9c6", "comment": "Malware payload", "value": "471ce487d45046d6b1112617202ebebce716fbee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564279, "uuid": "ac46a6db-90b0-4528-b9ac-7d30e64fdb32", "comment": "Malware payload", "value": "1426196241e5e8302624b4ed8531e62a10756e022c973a93271c47ef1a555951a63c74794443e5c1dfd1f08e8dbb5948", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564279, "uuid": "e0d19fa8-0c1a-4a65-b315-e48b592f6bee", "value": "T13774B040F2DA847AD6B72B34257247266A7AF9127F38C38FB3548989DE31740DE3471A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564279, "uuid": "f01be63d-f371-4f63-b42d-4f1b28c4b6f1", "value": "c0eaca862e71892f0b09074d92f8955f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564279, "uuid": "2fd1e237-7130-42e1-bbea-d880f02538f5", "value": "6144:3QfYaJlKdMDan9+2VhqOWOLt5ZZnB9iHC4CqhAMQvYqqv:3Qw+CM2n9+6qsRlSLhIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648564279, "uuid": "11253d6d-fc3c-4ac8-b931-3b666d9ae2e3", "value": 361034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648564279, "uuid": "5625b965-692c-444c-9f2d-1b12ce8cba3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564279, "uuid": "62d140da-93fb-45f8-a7ed-6f6c4e754390", "value": "emotet_exe_e4_98c0863eb3f583ccd3b081539ec99b0236d9b23e7922b1cc046199756bcdf404_2022-03-29__143114.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86014b5-af5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648557733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557733, "uuid": "d669f498-dc74-49b7-aced-1ebf91e7874b", "comment": "Malware payload (RemcosRAT)", "value": "accf136f0c8690cc7048ca72354835be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557733, "uuid": "31ac38cf-0918-45b1-bcbf-4f50624e1e75", "comment": "Malware payload (RemcosRAT)", "value": "99ae0237a900a2c83c499e263a3716761ac3104ee3a2bca1d52fc139e7877756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557733, "uuid": "d6c00a5b-9d27-4cf4-8a5a-bbfbf2523e52", "comment": "Malware payload (RemcosRAT)", "value": "9278d61fe3200365ab0fb41cd9075b70f570df63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557733, "uuid": "dc16aa66-5b3a-4fa7-ba58-f6b9a9b00716", "comment": "Malware payload (RemcosRAT)", "value": "0aac65c1c9ee45e54c00aa65fe7fb43c40e86de2975607b50b3e8fafa9476ab0da5dc606825e92221afa687775bfb1a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557733, "uuid": "15f0ef70-0d01-4a49-b3e3-fddf8d99d04f", "value": "T13A234D0CB38CB621C27C6A3980EB085887F5E5FB3A13D70B9D85166C5B53FE66616B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557733, "uuid": "2a682add-8fa2-426c-8694-2adc5d836169", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557733, "uuid": "fc4ba64f-b473-434a-844c-ce54408d553a", "value": "768:775hfzQZRyvvJ8m4Ax55ApuTpbTLh4ABO8OA1ie6jXjzSI+BqzVSUaq1LyJdzBka:7V1z2gh94AhAwTpTh4Awk67hU2yaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648557733, "uuid": "c72a4876-2893-4cd1-8afe-3305301856d6", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648557733, "uuid": "cf60b441-7d21-41d2-b7de-3399df7b04e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557733, "uuid": "f8b21e91-62e2-44df-9fa7-5c84aff34ab6", "value": "NewInquiry -20220309E8 West Trading B.V..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65ece8d-af78-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648569326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569326, "uuid": "9d3d3e34-8a4e-4b53-9d62-1adfd556c265", "comment": "Malware payload (Mirai)", "value": "292e358e68228fa0cee7fc930255ac55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569326, "uuid": "eba6b4dc-2fe1-4b80-b21b-ffc2c6d78977", "comment": "Malware payload (Mirai)", "value": "9a0cd9f14391d1d42e54eaf54bb565d66a9c9d5b6a7a761e33b73752d18924a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569326, "uuid": "a2d3bc00-a0f1-4bde-bede-e015590dc8fc", "comment": "Malware payload (Mirai)", "value": "e37a1150a47293e04fbac8950dd14a225f9e62d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569326, "uuid": "44308426-688b-4c95-bf34-aaac616d8abc", "comment": "Malware payload (Mirai)", "value": "08e3ff3c7f39c2b0ef747c4e1a80e9044e08c80963c072764a78384589417de9c9105991f69352afd1cb82b5aee124a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569326, "uuid": "57c029c6-fe71-41f5-9b56-4b835c3f0750", "value": "T1EE932986B8419A11C6C60677FE2F118E331257ECE2DDB3138D245B707BCB91B0E6B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569326, "uuid": "c5797fcc-b2b6-41f9-a2a8-62a032325d99", "value": "1536:XhnOErV41q/vadqMSahuZG+z75zVMm6hii/at+rbNMKiq+Vu8KRY95cYG:vrCJdqKuthMbIWaM+Vu8KRY9y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648569326, "uuid": "3c61dc81-fe73-4017-832e-ceae66e274c0", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648569326, "uuid": "89098cfd-8bb7-4dac-b981-a9f286c367ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569326, "uuid": "bddb6d3c-e915-41ba-a89c-fd2bdff80c34", "value": "292e358e68228fa0cee7fc930255ac55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb181d83-af1a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529095, "uuid": "e0dd9cef-ecc6-4f06-81ba-e894f7447fab", "comment": "Malware payload (Stop)", "value": "d641c207159f8eda3448dbbe661fc7ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529095, "uuid": "db91b08b-a2ef-43eb-9436-b08dba7ae8f0", "comment": "Malware payload (Stop)", "value": "9a488082120b56a0b294807e6b62599ce8a432533c57110f66c9e4223f03b358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529095, "uuid": "8e9fecee-f152-4488-9825-b27e44d149b5", "comment": "Malware payload (Stop)", "value": "f34ff2fcde22529fbbba6dbcdd2215da79244734", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529095, "uuid": "3b071475-aecf-499a-afb3-477ba160adb9", "comment": "Malware payload (Stop)", "value": "47e122fb1811cca50d39b6e56a52c1364ddb769b49dfd3eaf0a25f551d3ac0299831d9c6e958f30605b6c0564113a4b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529095, "uuid": "c40671d3-71f4-4ae3-b3ea-95c2a78f907a", "value": "T1B8050100BB90D035F5B316F0587693B8B92EBEB15B2490CB62D52ADE5639BE0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529095, "uuid": "770fd83b-d02c-47f2-a315-eb1ebf38eae5", "value": "9dc95cd500d9b0e61eeb42c26e483caf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529095, "uuid": "d4c4c04d-21ef-4b0d-9045-4329e890f29e", "value": "12288:lvM8U56QeIjpP56nV73G1fKuu6jfSfrN/UkVAQ56dWdvYzXgea/:JA6Ap6VLGMxSfSTNNVN6dSQLgea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529095, "uuid": "ee74bb25-d918-459d-ac45-0ae33cd6e698", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529095, "uuid": "1d3b651c-632e-4b3d-ab6f-9e3ba2032c8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529095, "uuid": "2ff305fb-0c98-4522-9448-efcd8cebd1a4", "value": "9a488082120b56a0b294807e6b62599ce8a432533c57110f66c9e4223f03b358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467881d6-af08-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648521061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648521061, "uuid": "ab051e03-ac8c-4d8c-95d5-866d8eff0da9", "comment": "Malware payload (Heodo)", "value": "f0b6737660fa3854077c1a7c66648e14", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648521061, "uuid": "c21ee355-a616-4759-93f2-86f186a9b136", "comment": "Malware payload (Heodo)", "value": "9a5758a15dc068ff6045534f3f11113afe60dcc99f72aee571750f5a9de72a79", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648521061, "uuid": "3b3ad490-e1b7-4935-9576-0a36e69eba4f", "comment": "Malware payload (Heodo)", "value": "b604a2f18e52846740ea563725d7bf57270663df", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648521061, "uuid": "1ad01c5b-4e77-4feb-aecb-dbc8bc3f0d04", "comment": "Malware payload (Heodo)", "value": "9283cabe88546f001f2bd619896a4b436565d30f6774557b515853237a300b48abd5bdeb0139d0f3633d1d093d6e0710", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648521061, "uuid": "a57d21a8-6717-4d34-b97d-432aca26f323", "value": "T1AD94F63073A2AD35C3E7627A8FDE82E509E79D604B7245BB72BD652949374C30F70928", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648521061, "uuid": "582af4f4-e7d0-4f24-b44b-9a16ad52d3b2", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648521061, "uuid": "98dd2664-8126-4522-9bad-a29c5cd95e84", "value": "6144:J1lq+vh81z8sN7k83Fv3S5SBB0rYYhVbGm4fyWhA20BrCJqJICX1:J1U8sNY8/z0rYebzwdoCop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648521061, "uuid": "70a0afb7-f562-49cc-9cb4-2b70322085a8", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648521061, "uuid": "36837982-c6f0-4668-97f9-555dbc68bfd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648521061, "uuid": "bbf750d4-dfd5-4e5e-852e-8c5f2f25a5f1", "value": "emotet_exe_e5_9a5758a15dc068ff6045534f3f11113afe60dcc99f72aee571750f5a9de72a79_2022-03-29__023057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f518fcdc-af54-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648553996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553996, "uuid": "fbd614d0-3deb-4b3a-a4d7-a1cbcc4042be", "comment": "Malware payload (SilentBuilder)", "value": "fc750a92d80802b2875158d308fa1279", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553996, "uuid": "52fc5a1e-1bb2-43c5-bc6e-c0fe8941a7a6", "comment": "Malware payload (SilentBuilder)", "value": "9b92b0aa30a67a25f8ee8ae9bb23320426963c6f9077a071c068a7ff39168f55", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553996, "uuid": "a9af8715-0b55-4109-a9de-cddef858746c", "comment": "Malware payload (SilentBuilder)", "value": "718534bf6875cffbdd4e93bbcf884904e4ffcff4", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553996, "uuid": "bba390dc-8118-4f9d-8775-2a1a8c4f61fe", "comment": "Malware payload (SilentBuilder)", "value": "7cba73fc80ce43d01a127c59c5c1ea2990cf1669ec02f71fe43e065f69d482251810c75ec9ea2747c283dd88a6e90699", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553996, "uuid": "cecc3e65-3b26-48e8-8f74-243eb99f09b8", "value": "T156C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553996, "uuid": "ee87fe6b-e412-44c4-aa8b-18e96c0f1caf", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC4:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648553996, "uuid": "2ca68f66-c598-4a02-804a-91dfeea6b066", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648553996, "uuid": "42cb937e-e713-4998-b151-42a60dd1469b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553996, "uuid": "067c26a1-403d-41da-bac0-f815d2e69bef", "value": "Rechnungskorrektur 2022.29.03_1332.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2deae4af-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648536053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536053, "uuid": "79e6c7e0-4ba1-41da-93bd-c0d80d86de0b", "comment": "Malware payload (SnakeKeylogger)", "value": "94438424f45ae325820609a0a28d2e92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536053, "uuid": "7e5f1cda-2033-4bf7-9c68-8b538f393706", "comment": "Malware payload (SnakeKeylogger)", "value": "9b977d2ad747cef386e02b0a52599ae0cdf318ea3ad0b23aac3447019e85b817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536053, "uuid": "afa693b0-5970-42ce-95bf-ff0f79db6cdc", "comment": "Malware payload (SnakeKeylogger)", "value": "e173c98c2afac7126b50911517dffbd787b12270", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536053, "uuid": "89e5b311-10b2-4857-9047-baedf5979010", "comment": "Malware payload (SnakeKeylogger)", "value": "f637cd868e060c1f05f03a70af99d1408bd012ba19c4ccf9753cfefefa59caadf21895bdfc8444a927c31ee1eac8b234", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536053, "uuid": "4c40788b-2ebf-458c-b357-19a02b70545e", "value": "T13DA402618F397883F2CEFA307AD6E43F87775C4A32A974995E5DBB550A301B27306098", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536053, "uuid": "2f4b6c6e-6492-4378-af30-5ec5c32d3a17", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536053, "uuid": "55f7eaf5-14e9-40db-88a3-5356f739a1bd", "value": "6144:eGiA0B+q03SPyUT6238mO2v1Vf7puYs7iCTLgnPoNnWikl:d00iqU2B01Vf7MOkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536053, "uuid": "58ef9cc8-a566-4f64-bae5-a9f839c958e2", "value": 473764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536053, "uuid": "55f9ba8e-fd43-4e21-b3a5-413aa47698d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536053, "uuid": "8ef507fb-051c-4e59-b8ef-71045ddfd53f", "value": "400876543345678876543456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83ff66b-af50-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648552203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552203, "uuid": "a1917405-2f48-4b50-ac8f-a398755d5bc4", "comment": "Malware payload (Heodo)", "value": "e2ad95deddef660556ee17a4b2cb2d06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552203, "uuid": "8ada16f9-3f34-46ef-bd92-5fed968dc513", "comment": "Malware payload (Heodo)", "value": "9bb8812b174262a2d56bc578e8b3822ef1a551e34b69e6f1dd2d56946573849d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552203, "uuid": "0c490d7f-521d-4b17-b679-66884e9b87f7", "comment": "Malware payload (Heodo)", "value": "342c2e71c601d412891034c7a02ea214623a2d6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552203, "uuid": "862ecab0-ea09-4c0c-894b-649459cfdb36", "comment": "Malware payload (Heodo)", "value": "db797bbaf0d33f5fcfafb4850765962da6a766a41fad86f4761ec9179eb98176f76eb0a154b981f2bfb4adbe112b2576", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552203, "uuid": "777e8c76-31e8-4599-87c1-16a919d80b36", "value": "T10AC48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552203, "uuid": "4864eed7-7f09-4bd4-9daa-73fa38d7295f", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552203, "uuid": "8fb8ab4f-f75e-4d45-9be3-a79966d5a667", "value": "12288:iUV7ciwHX3ew9aYU3pvc9inFijaQeL+nZBb:UiMX9Ihky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648552203, "uuid": "e852a94e-8788-44d1-b978-a4e28df1e253", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648552203, "uuid": "7d48bf37-2fd2-4761-810d-f43963b8b4b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552203, "uuid": "9663f741-afd0-4798-9e9e-87c116941780", "value": "e2ad95deddef660556ee17a4b2cb2d06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614ca09a-af5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648556325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556325, "uuid": "a6ebed09-270f-47e6-a598-02f790b7165b", "comment": "Malware payload (Heodo)", "value": "e7ada93fa98bd9c08f6c76eb0c893236", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556325, "uuid": "13eedd07-38ad-4547-8720-a5d2ab04f314", "comment": "Malware payload (Heodo)", "value": "9bd03e4f57247c45ad85cd0658ad9fa1635bddbe1e64bf6a068096a8478cbd3d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556325, "uuid": "dbeefd06-9b98-4296-b0e0-06cf0918733b", "comment": "Malware payload (Heodo)", "value": "8420fed300dd7d906f18a6c2aa6600ec95ee4c2a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556325, "uuid": "a512b428-0b75-41e7-bc11-8771134989be", "comment": "Malware payload (Heodo)", "value": "04c30ec0b17489f928d3b552f91ecfb16746fd769bf0e32a7ec945bf767e2021edbb0f4d6994c93ca34c9a1b859299d9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556325, "uuid": "49810936-36dd-498d-a011-4f9a27c28eb2", "value": "T1ACD45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556325, "uuid": "5160b266-7518-435e-bf33-5a5be6357cfd", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556325, "uuid": "b52c785e-90fe-459a-af3a-6f8ed3549b8a", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzDipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+w8ooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648556325, "uuid": "2a5fe93b-4a2d-4f90-b0d4-261619629458", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648556325, "uuid": "fec79da0-33a2-4d76-9884-9303c33ec1bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556325, "uuid": "0cab8c17-1902-418f-a30b-87e8a65829b9", "value": "emotet_exe_e4_9bd03e4f57247c45ad85cd0658ad9fa1635bddbe1e64bf6a068096a8478cbd3d_2022-03-29__121837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b0ccaf-af49-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648549083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549083, "uuid": "32724afe-e28f-40cb-9f15-94430c5290a8", "comment": "Malware payload (Heodo)", "value": "4f2192878d6ad043fcf06bdf8a3cddf2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549083, "uuid": "da8bad96-caed-4cbf-ac87-7d6960729ef3", "comment": "Malware payload (Heodo)", "value": "9bf947bf9cc26834301a49e36751bca9677253a54fe31c5e9493ec14536e72df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549083, "uuid": "29eb510e-c10a-43e3-8967-8a682aa634a5", "comment": "Malware payload (Heodo)", "value": "d40565e681c696067be9db9f5e8473d2067fcd6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549083, "uuid": "e1b45286-e6cd-4080-9b05-9fa15acdced6", "comment": "Malware payload (Heodo)", "value": "88ce97c09ffec02acde6653cf8e55ad9fdec97f2ac583aae0fcffeb172c7671e447ab90221fa98c5d6d98cd1c50552f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549083, "uuid": "429a8015-5844-41fe-b948-6d5a3704ff3a", "value": "T1EDC48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549083, "uuid": "a4030223-21c6-4981-b932-9adf70b75ca4", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549083, "uuid": "2f84cb3a-e07f-4c8d-9408-947bfc25e6c3", "value": "12288:iUV7ciwHX3ew9aYU3phc9inFijaQeL+nZBb:UiMX9I3ky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648549083, "uuid": "bb5b8cf9-ff5a-4b39-b852-c5d1e0ac02d0", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648549083, "uuid": "7e739942-77f6-4d0e-807c-4423e1cb4122", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549083, "uuid": "8187425e-a332-4eda-a9fa-ab39e4f6c610", "value": "4f2192878d6ad043fcf06bdf8a3cddf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66937234-af26-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648534000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534000, "uuid": "04d9d6cc-0c40-42cf-b618-80c13d1ca4c2", "comment": "Malware payload (Heodo)", "value": "bdf9daf07269e0b4a794e1a5b143ff16", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534000, "uuid": "22432b7a-ec7e-4b6d-8b50-cfcd56fa87f6", "comment": "Malware payload (Heodo)", "value": "9c906748709cdfb7bc346ddf2aef8175567ca62b8c128381892dc13a5da900a0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534000, "uuid": "722d5459-268d-4e73-a49b-7c5c4494a1a3", "comment": "Malware payload (Heodo)", "value": "4801a4f91b02c4db426cb9b3ed4e7e31be263ad6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534000, "uuid": "fa71c5f1-dbb9-4c27-adb9-da4ba1a26bf5", "comment": "Malware payload (Heodo)", "value": "3932d48b6260b2b0c5d0255aa0bc4a0c5c7a03f33f8df7c6e970265030ff8d77f75ac9ae204dd8225dc0d71ac21dd5c1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534000, "uuid": "5482d3b5-46ba-47df-9e18-5645704f4a09", "value": "T1A7649EE173F08A77E26715333EE597AAB2B9B560DE32C6836394CE4CEC320558532719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534000, "uuid": "0ec6781c-0e33-41d0-b255-0df971a89330", "value": "1ae872d29ae3f3837d6c8d15813e59d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534000, "uuid": "c63dad64-45ae-4c19-a0df-8aab2335f5ed", "value": "6144:RIuOkoX33WyZEwtWNRByDlPdOT6ncZe9y:RXOkoXnLETNnypWYcZeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534000, "uuid": "78e2eeda-5d55-4535-b3ab-ca55f50481b1", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534000, "uuid": "d1b5f7df-4a60-4adc-b79c-30b914d8393e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534000, "uuid": "9888abe2-b153-4b94-8c58-43a3635443e6", "value": "h98hunijkm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d245ccb-afa3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648587564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587564, "uuid": "a3d73c17-b1f5-4429-9fd3-f61846e7c6a0", "comment": "Malware payload", "value": "30c9a961e748856444d38891bad730ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "wslink", "colour": "#2273A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587564, "uuid": "41617825-46f3-4d92-9bef-fda841d8314e", "comment": "Malware payload", "value": "9cb6c80e588a6f8c3e31b392f496b51ed5022d93029d5aae1954dbe80d12c80a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "wslink", "colour": "#2273A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587564, "uuid": "abb9401c-91e8-4250-96dc-db2d14df2a94", "comment": "Malware payload", "value": "39c4de564352d7b6390bfd50b28aa9461c93fb32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "wslink", "colour": "#2273A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587564, "uuid": "14f0fcff-a00c-453e-b71c-07003b11e5dc", "comment": "Malware payload", "value": "4444737667e0d430e7ef8cb27741ebe973818064280dde44cfad3984f997562bb7574d8a51d940a681e23180a91632ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "wslink", "colour": "#2273A6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587564, "uuid": "bcfd7bd7-6dbd-4a91-8984-a15d36e9f3c6", "value": "T1116422FB93715496E1089AFAFEFC9022FD3608D9603D72E984C1C52D2EA055409BBEB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587564, "uuid": "3bf9a1a1-0f20-4335-9d0c-254e22033aa6", "value": "c74b867b863a7f5c6541ac54fa5ae17d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587564, "uuid": "225de341-16f5-4367-ac81-74a802170d9b", "value": "6144:I99sCNAG/VTRkdHA/EoyU15MZ4MSnCFRxx2qstiDcp0pm4AmAxkN3F:InAWvy2t/MmqlQwDcp00rHxkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648587564, "uuid": "7ec495e1-68c7-4d2b-95d6-ba679c35771b", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648587564, "uuid": "e9aeefff-3b5a-4bc9-a26c-520d2da71e3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587564, "uuid": "849a52c5-79ce-4661-aca9-e50348a1c0b6", "value": "9cb6c80e588a6f8c3e31b392f496b51ed5022d93029d5aae1954dbe80d12c80a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5942936-af64-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648560735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560735, "uuid": "02f06410-9fd9-4725-aece-68c3f9cebeb7", "comment": "Malware payload (SilentBuilder)", "value": "38c95c1c896d4a7b79ac1717c44696d0", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560735, "uuid": "a2b6976f-b5c2-4150-a5fc-19ced23a3e24", "comment": "Malware payload (SilentBuilder)", "value": "9cc0ea3669fa33e3dd91401e013865c29f1641425ae33257383336d00f983afa", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560735, "uuid": "b17d46ef-73e1-44c6-a7c4-225a85be33b1", "comment": "Malware payload (SilentBuilder)", "value": "608bb73e9e7d93a4c33fd5155ff3a46ea54530b9", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560735, "uuid": "a0927a71-b437-4180-8b9c-40cfc44e0b07", "comment": "Malware payload (SilentBuilder)", "value": "ee851402d3343822158473b2d6e525164b434ccb51001098dfeda1672c19830b97ce2bacac774ebad8159ce8e903998d", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560735, "uuid": "c3c34d70-767e-48ad-81cb-ad600e20286c", "value": "T1EAC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560735, "uuid": "4d3add58-bc1b-4528-a5b4-1dfa6e24e5b8", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC4:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560735, "uuid": "2cbf77a6-68b4-439a-a0fa-8c41ffead87f", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560735, "uuid": "a6fc66e1-e188-42f5-adbb-d964a4c824c8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560735, "uuid": "b4e7534e-7fbe-43bd-b155-17db9b780926", "value": "38c95c1c896d4a7b79ac1717c44696d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355d4dab-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648536065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536065, "uuid": "f9ff23f4-631e-4f86-8a60-b4807ddac038", "comment": "Malware payload", "value": "4ed9b78414fa66e83717173a9ee6f3a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536065, "uuid": "fc0b4c52-57ee-45a1-84f6-ef7a01e5adac", "comment": "Malware payload", "value": "9d400d34083c7c9128465b3c0963c710a7196483223894110a32584b8836fa82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536065, "uuid": "987ec43f-33f2-4508-98a1-d976c4f6404c", "comment": "Malware payload", "value": "61cc5669ffc72025d3e4ec06784fdc183f8a7174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536065, "uuid": "19604e14-fc5e-4ab9-8ced-acf9454c0526", "comment": "Malware payload", "value": "cea6c5e73bf0a4d229048a84f8cb269571200d91885903c33bc9d8354d99fb388ca9322a3c1d8cbfdf1c605d80503479", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536065, "uuid": "c41779a8-9e9e-44c0-9953-ce05da261045", "value": "T116432983E6C48712EC140970653B5E691B3ABF8AFE43750A21CCF52B1EF67C59D22867", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536065, "uuid": "d9fb04a1-c4e6-4619-a3cf-57c4b1311aa1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536065, "uuid": "e5f7982e-f290-45bc-8524-8c7740d0c0c0", "value": "768:EaWHdI8tRkvwgQxis56WBCfYTQwP0Z//a4aOgqxsisoxEo7c:3W9I88vRs5zF0jaOgysVQEo7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536065, "uuid": "632a0bdc-42f5-495a-96c0-c4758d1943e9", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536065, "uuid": "0b707d34-a1ab-475a-b127-42660cf4688a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536065, "uuid": "c7f2d209-ec16-40d2-add2-c18fccb6439d", "value": "2babb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963f83c9-af3e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648544388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544388, "uuid": "186f70fc-b835-49d6-a37d-77a35b559bad", "comment": "Malware payload (Formbook)", "value": "9b629485dc80ea65118e2b3ef68f013f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544388, "uuid": "805c8b2b-a037-41c2-a74c-898ffd9912c8", "comment": "Malware payload (Formbook)", "value": "9d42b1b9280301d54b45752d046405be7e1a632de78723aa46cb20c1cc43c801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544388, "uuid": "749b77a1-59df-4349-860b-1b5a91e9438b", "comment": "Malware payload (Formbook)", "value": "5c26570962f22fd69deb8357834e9a8205a43628", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648544388, "uuid": "132037d1-a922-4c5d-b203-8171d6f65397", "comment": "Malware payload (Formbook)", "value": "48bba3bc61ccc6825e65a88b8cb25e0c6b18058a0ed81397c84fbf928b718b01a30d6301d94a07d7d8833d30390196dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544388, "uuid": "3df56a45-6f95-4404-bc41-6af91c107971", "value": "T16E058DEEA3509837C1631B788C4B93B9A92ABF113F1494872BE53E8F7E346903535257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544388, "uuid": "ff3c6d25-3679-4a40-a316-ee071e888a61", "value": "dbf1300428baed4574f07bfbbe98b092", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544388, "uuid": "3e253522-09e2-4ecd-aa5e-c5cef2ac5e97", "value": "12288:k8XoVKkPa3yFwp0ShMnn0sAIpxxfBy2oYWVwyUMPdCL9/ZHi:zYIkCyFwXhM0jIpx+h7UMPdCLHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648544388, "uuid": "5b255c3c-ef04-4061-952a-25e350cf880d", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648544388, "uuid": "1acb438d-f455-4d55-a332-e8413ecaace3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648544388, "uuid": "2fd63f70-889b-459a-bf5f-b1b2d94bf099", "value": "SecuriteInfo.com.Trojan7000000f1.17828.17877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09c0107-af2f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648537963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537963, "uuid": "6afa6a76-fac7-4b8d-8990-1f7adf98315d", "comment": "Malware payload (AveMariaRAT)", "value": "f11055dc9c4c24a43286bfc7a891e05f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537963, "uuid": "773384e2-6956-4c73-8e12-e9287fafe5d7", "comment": "Malware payload (AveMariaRAT)", "value": "9d52a7814f157b00620b7405701cf26d9edc2be1ad2620905db66c87fcee811b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537963, "uuid": "320bae0b-f162-489b-b9ac-2b32f4cf9591", "comment": "Malware payload (AveMariaRAT)", "value": "788e901eccd6cb7c42d3f4555e7e0d93bc122631", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537963, "uuid": "02bce1ec-2a9e-47e2-ba23-42f3c94c9ed4", "comment": "Malware payload (AveMariaRAT)", "value": "d2a18d3b502c45502f93433fef287b689ffa05af6d112cf67d7396df1d84f7015b7d3b1976ad16d3b74abb9d8019c9ef", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537963, "uuid": "5d1e8a07-ce52-4645-95fb-c58abf7c1282", "value": "T1FDF46B020780BB58F7AD5A30BF6A6C08EE77A9736D369C5F542F220A59FE83C590154F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537963, "uuid": "12322d6c-8c55-4e01-b8f3-4c6e3e30fd5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537963, "uuid": "0901b4fb-6973-4367-8b54-743c468af9ea", "value": "12288:xILrCY7vTEoj31Nh1897QqazSYpX7md26AXoovI2yKOk+nAGrkb:Yr31vEQqbYNDpXjylhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537963, "uuid": "f76eecff-5553-44d8-b80f-bfab546d9f09", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537963, "uuid": "bdd5be08-768e-4348-b156-18159edb6a66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537963, "uuid": "031f5332-f10e-4028-8027-1a041fa3cd27", "value": "Documento de recibo de DHL,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3137260-af2f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648538021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538021, "uuid": "27ea43ac-8342-492f-a505-9fac9fbec11a", "comment": "Malware payload", "value": "5984552d9a25659058e217a3b9476637", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538021, "uuid": "a4e8a673-4953-4a69-a7c0-788da4de9c8d", "comment": "Malware payload", "value": "9d54914ae3ca258abbdbbd3d4f1f92b7b1c557394a2f94aca31e4b12de2150a9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538021, "uuid": "77c99857-bb50-43fb-a1bf-050008431692", "comment": "Malware payload", "value": "c11c0b468fddbe2628eb9a14cb08a480441c048a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538021, "uuid": "fe2644ad-04eb-4305-bf7b-c4ad5540adfb", "comment": "Malware payload", "value": "1d53d37099d582784051d013c1b39db65e2c865b334548b074c6343d3c5cf185e48b708c8334e14c687967391fa043e1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538021, "uuid": "1a17ad82-0729-438e-8045-1858b598d4a6", "value": "T13E165C23B284753EC46B1A3A4937A3589D3F7A7139268C5B67F4088C8F3A5417B3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538021, "uuid": "f1ad57e9-c6d4-4ebe-b84c-4e47a9ed1183", "value": "49152:2u0Z2LqObbMfY9BgSqLufibk7BT+DUMWGwzBtwTvoq3EukNTDA5fMK0OYZEA:kYqO3fR7R+floq3EuL0OYyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538021, "uuid": "d94bd307-359b-45a3-a68a-6fef5fe7b62b", "value": 4094976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538021, "uuid": "648e1626-e11a-4566-98c5-9acae519ae04", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538021, "uuid": "36876880-adbe-4ae8-b109-a3806cb36f04", "value": "Archivo.EndesaFact29032022.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b0628e-af66-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648561537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561537, "uuid": "e5956ef5-a93d-4268-9450-46fe6c6473c9", "comment": "Malware payload (SilentBuilder)", "value": "e5eac1f0a371298256cbd0f06f0f94f3", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561537, "uuid": "6a6c4f8c-16e7-420b-a0d7-709c2a945818", "comment": "Malware payload (SilentBuilder)", "value": "9d8fda3a866946294a06338976fe80fb2445dd0d1fe5beb3afd380abefc6236a", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561537, "uuid": "fe3468c1-9a80-4825-880b-b58225b51f10", "comment": "Malware payload (SilentBuilder)", "value": "110787142125e16d87edb4433b7cbe1a928ba040", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561537, "uuid": "8a7febc1-a498-4eb6-96d9-00c8eab044b1", "comment": "Malware payload (SilentBuilder)", "value": "e669379a962b430dd354cbaf507b19616e6ddd4bf201e16b2d070b20fd7e057f523402ae2eb8c61b336517b511253ddb", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561537, "uuid": "b9871415-d75a-4761-a59f-5196083e6ad1", "value": "T14543E85BBA49989DEA14877548D743997323FC304F6B074B3669F3257FF89A04A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561537, "uuid": "399762fe-c1fc-4fd3-888f-691d47b5f865", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgx5G9XSZ4Xsv2:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561537, "uuid": "fcb86330-cfb5-461b-8498-c9f0b3289e52", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561537, "uuid": "5e8b5085-92cf-4ad2-932f-c2e22fa5dfa4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561537, "uuid": "603d9ce8-05bc-4535-bd7b-63e71ba49d61", "value": "Documento.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe72eeca-af1a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529101, "uuid": "a517e7ed-cc2d-4f1c-86c3-93965d96294d", "comment": "Malware payload (Stop)", "value": "f8f0d19ecf2cfd816ce06614a990cd1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529101, "uuid": "99685578-2e48-4101-ac67-2eedf6e4d7fe", "comment": "Malware payload (Stop)", "value": "9da0bdb7d44fe5cef1d36d302f47e941b72c848f9e2adaf106ca16ca1905faaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529101, "uuid": "3763b931-2777-4110-86a3-76c50cd2782c", "comment": "Malware payload (Stop)", "value": "85eb8fb0b223abf9515b96976cd438a19cb5643c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529101, "uuid": "11df169b-93d0-4704-b727-0c187149bd77", "comment": "Malware payload (Stop)", "value": "10d1577994e38eb6ce6294e054a0cf20432e29e15d9766903466102f6f506cec9c6d2161606cb22c22786f165f838b39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529101, "uuid": "6e29e340-2b99-4e0b-a0c2-2d6025e53eab", "value": "T160F40100BBD1D035E4B722F8897983AC652E79A18B6154CB73C55BEE62357E0ED3138B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529101, "uuid": "72537560-3345-4fa1-84c8-2ffe839291c3", "value": "40e5c5c7408818462da1afadba1094c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529101, "uuid": "3fe4c45a-8f66-4e1e-ac89-755cfddd5bf5", "value": "12288:Nr0wKQ0iM4qgJBE6fZxoBdET+f6mXqfqbQO+FYxizPV++rs3T/bxD8y1NNxYD:iVe4kiY+f66EO+kizPVSjFDTxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529101, "uuid": "a2c3f98e-7ab4-4c9d-8191-d00e1f022e92", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529101, "uuid": "ed16ff50-8c46-40b4-8246-1226078b9682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529101, "uuid": "2dc267c6-3d5f-43aa-8709-cd0c53657dc3", "value": "9da0bdb7d44fe5cef1d36d302f47e941b72c848f9e2adaf106ca16ca1905faaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f84338-af38-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648541816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541816, "uuid": "b09c5d1c-8070-4c02-9503-c319751e41ba", "comment": "Malware payload (SilentBuilder)", "value": "43e9a1cf9ee4e836d40aaed8cf047a11", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541816, "uuid": "d03cd120-35f8-4e4f-82e0-74151c4c65a3", "comment": "Malware payload (SilentBuilder)", "value": "9e1bb022ca3f08c62015bd703680fbea96f40049495fc6515af272a58d634a3a", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541816, "uuid": "74ccaa61-272a-47a0-bacc-92320ebb72fb", "comment": "Malware payload (SilentBuilder)", "value": "da06c8f1b60eb4e34b16791e31305aa8f25f82dc", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541816, "uuid": "1fcfa5c8-063b-438c-a9ed-c5ad46f8236d", "comment": "Malware payload (SilentBuilder)", "value": "ca8c0c6f08c5b4323faabc3f4010a73b20037e2cce8460bc0ebb01129cfb2c7aaa256d98b20f43dabdcc54477c89efb2", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541816, "uuid": "7157bd7e-a71c-4e00-b45e-bd89d0213882", "value": "T1E9C3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541816, "uuid": "a98d6a27-7b01-4993-9605-b00f01f161eb", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCx:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648541816, "uuid": "a561f9e8-eee9-4764-8c30-c707f0ef1eda", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648541816, "uuid": "1b36db78-7f5f-45ed-a2b1-f82ca791e97e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541816, "uuid": "350a0aab-0279-4dfe-be10-3d2344370390", "value": "SecuriteInfo.com.Exploit.Siggen3.30291.30734.21199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90614a89-af2f-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1648537936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537936, "uuid": "8fbc9a33-9279-4eaa-a773-270512523adb", "comment": "Malware payload (NetWire)", "value": "88d2ab9d742d3c9dde1308203fb2859d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537936, "uuid": "e65ebfa5-d780-4ccf-8a3e-debdb133fe26", "comment": "Malware payload (NetWire)", "value": "9e4fc6b0c398a0fc5b436127d1e91cf8943848aeb7ef09f835e36d9069f4f08a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537936, "uuid": "6d5e9dcd-d9c4-4023-8dab-a358c098ecf4", "comment": "Malware payload (NetWire)", "value": "55bf7e9f34c708c647c8f3403883c07c433010ae", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537936, "uuid": "e173d905-64d5-41c4-95d8-0aad833f7777", "comment": "Malware payload (NetWire)", "value": "0e7b39e5ea236d724f09896f5ccd93c2d7f00e48bcc4dd29f0a4bd9ac93f9c85b83cb4921c5a16d63c0f34a0bff4c270", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537936, "uuid": "c9eb2d85-f33b-4d2c-9c6b-75d800738fb4", "value": "T1E9415FEE3087A17617234DB2EC2F485E19B52223D57890A0F609EFC90D7C219D7539BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537936, "uuid": "4fa7a1ef-5c8e-409a-8e35-9a19795a3522", "value": "24:kMtiQcESYNf+yVGVSlph6rpSV344Bzvw3vqrnjPgcSq58wkmRItdOH4n/fxLRlE+:ZomZG4d6qrn8U5X/4XJ1rTSZy2DZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537936, "uuid": "ed40a736-db49-4ab7-b1d3-cc09cae7b865", "value": 2160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537936, "uuid": "7ec0feab-8973-4c5e-b847-7866a0d1a65f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537936, "uuid": "77667f52-0e58-4235-b5cf-6b578d6d478c", "value": "DHL_WAYBILL_DOC.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6252248a-af5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648556327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "9bacf9d6-e1cb-4f3b-bd90-8e7ae35291dd", "comment": "Malware payload (Heodo)", "value": "8695b8621570f557fb8cc01e5923d192", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "f754bbb6-aac8-48c3-848e-1675afe3e75f", "comment": "Malware payload (Heodo)", "value": "9f3d2a27d8312e87ffadb658627ea6333c6ae907ee7c060899522900b4d3369a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "996c27b5-6e84-4d8e-be0e-d3f5b140f20d", "comment": "Malware payload (Heodo)", "value": "b816c969df001f69507db1e0314db9da62dfea9a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648556327, "uuid": "43d5bd54-9a52-4600-b297-0b52a373a0af", "comment": "Malware payload (Heodo)", "value": "3d1aa6e8c51e06f30ad7259aadbf35fd281c1d352f37d8a1852863328a454ff530f7ab880056a303954ae1c5c422f08f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "7ebe6316-6627-4e3c-b2fd-639aac6fd56c", "value": "T1EBD45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "5c85b409-e975-4c43-a8a6-5dda27786241", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "877a5065-0811-4f19-8cd6-83cd954ecf67", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzVipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wGooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648556327, "uuid": "a6eebab4-fe83-46c6-a12c-ab25ff523770", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648556327, "uuid": "b148f871-a0c5-44b9-914d-3e2c1c5fc9db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648556327, "uuid": "7168a98f-b968-4471-b41b-0b4f00cf6a97", "value": "emotet_exe_e4_9f3d2a27d8312e87ffadb658627ea6333c6ae907ee7c060899522900b4d3369a_2022-03-29__121838.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6883e236-afb4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648594992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648594992, "uuid": "62226671-b52d-47f1-a481-177683fd0f91", "comment": "Malware payload (Heodo)", "value": "bbec08b4c28807c94c3a05eebc112632", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648594992, "uuid": "a0677fbd-a6ff-49bd-b849-66e4cc70a19a", "comment": "Malware payload (Heodo)", "value": "9f43e61214b1805566e5b0b66b14acb9e5416f24bfebbe353be48ebfd5658581", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648594992, "uuid": "bf876e66-eafc-4685-960e-3e59be659837", "comment": "Malware payload (Heodo)", "value": "7a3e536ba7a5f85dc516c716b602d53ef1a79abd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648594992, "uuid": "a9218148-7d35-4a8f-aff4-01285b72338f", "comment": "Malware payload (Heodo)", "value": "7cb3ac77320d1fd5ad4afcb88cc286ea7a9a42580b4f9cea3d81de583c8d69f4c3178c807e32c5476ea4b3bbdca383da", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648594992, "uuid": "af9a68b2-fef0-4c70-a972-0de782e090f4", "value": "T11BB39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648594992, "uuid": "fd2fc519-792d-44ac-ad8e-f820e8843f3e", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMi:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648594992, "uuid": "a41ac004-c53b-495d-9df2-e51800d12b6f", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648594992, "uuid": "fabb2095-46f3-4202-ab82-d969ac14bb65", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648594992, "uuid": "3a333e15-3b83-4c74-b487-b0cdb1ded65f", "value": "bbec08b4c28807c94c3a05eebc112632", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c489a0-af74-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648567367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567367, "uuid": "8bad6f0b-5a97-41b8-b010-04ca92c823e4", "comment": "Malware payload (AgentTesla)", "value": "1110f05139c929e87ac0ee4ce982cab8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567367, "uuid": "dfb616e1-7ec0-4fd0-b74e-d1d3f8bf313a", "comment": "Malware payload (AgentTesla)", "value": "9fc03ede4a6507b4d4428b7f48f0308c8be0dd1b14061c46b81c091c206eda6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567367, "uuid": "b5dfcec8-2e00-4d9f-a411-4ea80013297a", "comment": "Malware payload (AgentTesla)", "value": "762d3548b30d22f8df2fbfa2f56773e4d1d8e36f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567367, "uuid": "153805c8-8c9c-42b5-b0e2-6871d93f7acd", "comment": "Malware payload (AgentTesla)", "value": "062372a6c39550e6cb27c2ac3899c44e930b04c4d94d2f2d2407d079f82b45cddf3cd4754451ad5344614c5bcfd982d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567367, "uuid": "757a5a3b-1ea5-4ef2-a971-9097f613c095", "value": "T10EB48D66E3F86F5AF1BE9738803849157BF5E84AE711D85E7DCF10C60872E584AA1B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567367, "uuid": "65aa3c90-71dc-4081-b717-b992aa0d2788", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567367, "uuid": "87163882-0b8a-467f-bb08-d9f4e04752d7", "value": "6144:/Jgo6BMrZcIjoeccAy/NYUYfi7Kuj9TBBmG9QFeVTSOyBW90K4Fb3A3p6FEwgYP4:/JgoyKq+NdHui7bj9tBUgB2+4+kFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648567367, "uuid": "d4c51a60-53be-47c3-95fe-1892563fc250", "value": 541696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648567367, "uuid": "6f74e877-91ac-4ea0-9ee6-955659fc57bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567367, "uuid": "f66f17fe-1c46-4908-9133-c909f28e049d", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4734339-af87-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648575765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575765, "uuid": "f4867123-67af-4a7e-b3a6-9cb69f7a0efb", "comment": "Malware payload (SilentBuilder)", "value": "ab24fd836d759f48a16b4eb262735913", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575765, "uuid": "457010da-67d4-49f8-a6d0-6588d35b8e96", "comment": "Malware payload (SilentBuilder)", "value": "9fc33e9c4eb9a5c84654b6bedc62be788f29a1a34daacbafbebca9d526cf0e2d", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575765, "uuid": "b661912b-756b-4333-8bfa-38dba58e27af", "comment": "Malware payload (SilentBuilder)", "value": "744dd2f982bfd62f85fd7a312058b1f0a3d3fc4e", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575765, "uuid": "10097918-ae29-4bc5-9df1-fd6b5fce1762", "comment": "Malware payload (SilentBuilder)", "value": "662482d7054dd85102c2a1f47ebb2ae557d742fb9bdea5b687d661c715d2850c6b57c1b11a59fe2b652f94954cd14339", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575765, "uuid": "a31b3153-a141-4685-8645-6e02bd14923a", "value": "T1C4B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575765, "uuid": "c814de32-f9bb-480c-8100-642248d4fc52", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMJ:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648575765, "uuid": "c177211b-64b7-4b8b-8876-8a3fe6911f3a", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648575765, "uuid": "537ccafe-a2d5-4b3d-9712-2f8c179ff275", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575765, "uuid": "6ab027c5-ebd3-4985-a38b-6e0d13eab014", "value": "ab24fd836d759f48a16b4eb262735913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5506dc0-af31-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648538937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538937, "uuid": "2931fd26-9fb4-445e-9e53-cc58ebc6a1d9", "comment": "Malware payload", "value": "d6404db5ccdde4e876622532743d7e8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538937, "uuid": "57ddc245-6c7c-4159-8920-b2cc5ee7dc8f", "comment": "Malware payload", "value": "a07e1db8413e7020690bdb9614c69c1aaba57d0c075f335c27ecdd92395f7192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538937, "uuid": "8971ccc5-dbbb-4201-86e7-a5a124693817", "comment": "Malware payload", "value": "baa936a574dc2ceeea0c17dbebfbf5bbc49cbf19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538937, "uuid": "2b318556-f1d4-47aa-9380-a0388effabe5", "comment": "Malware payload", "value": "40bc17c0b1ce49573c02ebc430406131381115a869793b52cebfedd27e349bd0204ec3d02f9aedc1215dff97d5e9756a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538937, "uuid": "a8f651d2-764f-4972-a455-679f02210b44", "value": "T1F236220277C2C075FFABA2739F2AE6059A797D644533952F13982D39BD701B2123E722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538937, "uuid": "413b4867-573c-4949-a7d6-0df15d68f4f2", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538937, "uuid": "dea72ea1-d458-484d-99e4-ce5d18d07eee", "value": "98304:+2cPK8ocYveYKCppe83U1xpx4/HHqPBnMRc+w35ErrxlgW1RcCIp:RCKTT2f1R8nqPA835dW1Re", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538937, "uuid": "a5e8e5ff-85b3-4bc4-9c66-e06aeefe798c", "value": 5214926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538937, "uuid": "86547be5-39d2-4b6a-9267-fd1df794f50d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538937, "uuid": "8396acd5-95ca-4a72-a85b-0f274d8111af", "value": "d6404db5ccdde4e876622532743d7e8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107465bb-af97-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648582389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582389, "uuid": "f7173687-dda7-47f9-84f7-29e34e6517e2", "comment": "Malware payload (Heodo)", "value": "2ee785e20e344b9fa98d1425738c826a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582389, "uuid": "d868ed35-e963-4d75-899e-07a52682a59b", "comment": "Malware payload (Heodo)", "value": "a0f1710c25f860d351a0d5ecdbf127aaab6d4d4900cfbcddb39b1284838b6c26", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582389, "uuid": "926aa39d-b902-4495-b266-0cd521feed7e", "comment": "Malware payload (Heodo)", "value": "927bdbec06caf1bf133b6703341c085de7e4cb8d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582389, "uuid": "fed0530f-bc37-4dfe-a6d8-24ccdcf7a4fd", "comment": "Malware payload (Heodo)", "value": "b562b1a0462a2433d0a4df3278db5df5e11ba29b52ee9b4cddb92179451e44494174217691e789db2e537a77ea452080", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582389, "uuid": "b414eba2-a5ca-43b7-a85a-a940352bd975", "value": "T159D32AC2A766416AC92A15703DADA4B6D7A85DBADF394FE797E3CD8D28331C4083110F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582389, "uuid": "af34f4c7-11b0-4c48-b6fb-7a414bd30fa7", "value": "28570bd8351c62f6e0c8e6211e57a6e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582389, "uuid": "d00347e4-06ae-4832-a5b1-0fcc7a68d741", "value": "1536:hw/ilkCX+Ks7iA/KQVVQDIoCk/Nct3Nli7GN/eaUbAUTCCQtVjKvXGiFt:hwalRy7iA/KQVYhe3/iB8U6t8vXbFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648582389, "uuid": "27908d86-0d02-447d-9fbc-6448e797547f", "value": 139377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648582389, "uuid": "f44885d4-498c-4477-97af-5ee95ebe680a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648582389, "uuid": "475a523d-68c4-49d8-81b4-14d81c950454", "value": "a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7d55e1-afa2-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1648587482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587482, "uuid": "767cdb77-b4c9-4101-9da3-3e74c5d3575b", "comment": "Malware payload (IcedID)", "value": "bf5309d3536cb55f8a052ad35576866f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587482, "uuid": "ef297ad7-f28e-4707-94e6-d3519a234b52", "comment": "Malware payload (IcedID)", "value": "a1d05aa1324fdc04e7698fbc3a4f212013b2bf7d7531b317d0b76e832d97a841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587482, "uuid": "03b6a013-c2d8-4c94-8ce4-282f8fe1dc9b", "comment": "Malware payload (IcedID)", "value": "db0d76c50077280cc66b6d7c0084472575c235f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587482, "uuid": "e6a4283d-5563-4db5-b9fd-106fb08f94cb", "comment": "Malware payload (IcedID)", "value": "a907b752c7902de3a9b3999b086c2a36c093f98bce0f3b347bf687f6264a20ea332ac8f66118ab3ad6dc50936505f554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587482, "uuid": "5e5d7bf1-9e59-42f4-acc6-4a80aa8b565b", "value": "T153A38C04629110F5D4639630C6727621EF32F8125379D3AF47D14AAA6F72792AE3F732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587482, "uuid": "bea016b4-e860-4acc-b52d-9a6cb85fc6fd", "value": "44a43cbba02df2f893bff93aa2238788", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587482, "uuid": "c02ef5ed-fa7a-40f0-b991-5cee9076e2cf", "value": "1536:ebhTg7JOTnfj2sqcNjuyG0Ofnszo6bpXlaVJb8lJ4/Civ3fL88IBda9:ebhkkTnrtjlG0Of4bvaVJoz4/1vLjIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648587482, "uuid": "f7f07e21-a869-4314-83bd-797aee877a55", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648587482, "uuid": "74e6eaa6-7bd4-4d25-a514-31a905331913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587482, "uuid": "f56ff9b6-1845-444f-b7e6-a7f01646998b", "value": "bf5309d3536cb55f8a052ad35576866f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bb9b40-af63-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648560218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560218, "uuid": "d2eb126b-db70-49e2-9926-6dbbcfaa37c5", "comment": "Malware payload (AgentTesla)", "value": "1555a1888a20aa428303d692d0ade57b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560218, "uuid": "3aa040b3-94d1-4398-8364-fc52b04a575a", "comment": "Malware payload (AgentTesla)", "value": "a1f63ddbe4e739dce5ef49656e77c6d37619a782a144376090df100e5b1c67fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560218, "uuid": "9e3b92e4-041d-4f25-aaef-ef47692ae8ae", "comment": "Malware payload (AgentTesla)", "value": "fe6fb9ad15cb6285439cc54163fdac3688c5b53b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560218, "uuid": "afeb51b7-e905-4b09-a7f9-136c102a0388", "comment": "Malware payload (AgentTesla)", "value": "be5cddd97954b16b0eae6266b4ede8b7eedce70fc4b9378d691e7f9727a655b0f03969db9ee1206fd4d97d3758f720df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560218, "uuid": "bd56e5cb-dfe1-4f56-92fa-2c5f5067848d", "value": "T11954121ABAD0A1BBE2C54B35593FD1B1EB77816C03D3907B87A41E9F3E732A90013656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560218, "uuid": "557689dd-f324-439f-9cef-43bd0dfa6ff4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560218, "uuid": "dfee1462-9b5b-4e38-aeef-cd1d21864021", "value": "6144:rGi+mVHhFG2MzNEszI3XGSy7USaK1/LPqq8AcBLy/GlYby7uK6Obx:R382qzI3W6zK1/Liq8Z5lfyObx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560218, "uuid": "2d871349-5e30-4783-ae11-a23a84cc13fd", "value": 298442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560218, "uuid": "3096f1bb-b6e3-4cce-a50a-8f9b1b87873f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560218, "uuid": "f0e030d0-87f3-4c34-82fc-3ceac9bc0f68", "value": "000560472_DCES003_2022_11241651_4_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27859ccb-af77-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648568684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568684, "uuid": "e72f7a12-bf23-4f2f-8d8c-ebb442c15cfb", "comment": "Malware payload (SilentBuilder)", "value": "814f395243ec6f8186afb941ddd5f26f", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568684, "uuid": "abd3fc56-18ef-431e-8722-9205be492ecc", "comment": "Malware payload (SilentBuilder)", "value": "a3fb0dda52a28de7e9dfd17b39347b7d5d96464eec6bbfe649cd22dd79cda4b4", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568684, "uuid": "8af6bab8-73fc-401c-8e11-a93301ce0183", "comment": "Malware payload (SilentBuilder)", "value": "30e79713e1d42fa520c59fe0699999920c832f86", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568684, "uuid": "65559e74-1d04-44da-9339-4357c71a39be", "comment": "Malware payload (SilentBuilder)", "value": "ea459badeab9d2c66a4f6d0fce1a704781f36a736d3f3797675dc3d7d84d0f1dd857aceff28bea66cdc085d4a4e50ec3", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568684, "uuid": "c3bafaed-5bf0-4049-b4af-71a4590c3618", "value": "T177C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568684, "uuid": "d1c09f0b-69b0-4aa8-baf0-a6dadba67aac", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648568684, "uuid": "80e43fa4-dafc-48be-985a-377f92ea4f6d", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648568684, "uuid": "40bfbe00-562a-4fb1-b21f-7e19a53a12f9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568684, "uuid": "9f1997ed-78f1-46ca-a24c-ca972a13ff05", "value": "814f395243ec6f8186afb941ddd5f26f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e40f66-afa7-11ec-8e58-42010a9c0032", "comment": "Malware payload (OskiStealer)", "timestamp": 1648589595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589595, "uuid": "7723057d-624c-47fa-853a-122843b30840", "comment": "Malware payload (OskiStealer)", "value": "0b71a53b75074c03a48bf23774b1c5f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589595, "uuid": "c9801b3e-4316-4285-a00f-9c1d78ad80ef", "comment": "Malware payload (OskiStealer)", "value": "a414ef0d5392718a4307dbb6a5d38ca3285d9aa002d93ee1ea5d45320d082769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589595, "uuid": "be4fb303-e972-402d-b05c-516d60c70423", "comment": "Malware payload (OskiStealer)", "value": "2779f6615e0ab9292a73bff2c6b9fafc34e7a7db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589595, "uuid": "daa92154-5286-433c-893d-a3de541a87a1", "comment": "Malware payload (OskiStealer)", "value": "07e76ccc788685df84f113ba51090f465acabd03321945b162c8ddf386325cda8c46990c96167afba365c421965d0b73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589595, "uuid": "09b9bfc7-d9f4-49b7-a50a-65225fdf2faf", "value": "T177A4ADD6E560F676F40F9830916C3E180B0A5EF671ADC445CAEC7C5A3CA2B1D364AE63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589595, "uuid": "cff64d40-d1e3-4686-b742-45f30fa9b5e9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589595, "uuid": "bb0b3034-0d44-44c4-86f9-7078101e3861", "value": "12288:t4BNPBu4B2mublq5FzAFKXMd1f5r5LEij4D:t+L2mu540FjZl5wke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648589595, "uuid": "4f7e8b12-ab0d-4d40-8b1b-53aefc890b56", "value": 448851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648589595, "uuid": "2aded5c4-fdd9-491e-8328-8f648d1723b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589595, "uuid": "991701f9-1502-4978-86bf-5841ddb825d0", "value": "0b71a53b75074c03a48bf23774b1c5f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425104ab-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648561857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561857, "uuid": "234de755-afea-431b-b764-f765fdd6c059", "comment": "Malware payload (Heodo)", "value": "9956aa1d3ae06f7a99177668d74634a0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561857, "uuid": "2fdfbc37-fa1d-460b-8503-b87830c31eaf", "comment": "Malware payload (Heodo)", "value": "a55140bb9742ae02a6dbd2a7dd8505ba6e5803d9873d68b7b33d0df71cf9f127", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561857, "uuid": "fc105de3-4038-4ae2-b169-b55588186b2a", "comment": "Malware payload (Heodo)", "value": "db9138d7995a84391757c89a9320b67e3e2766d4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561857, "uuid": "ae5b1705-8137-42cf-9022-3e6d7d7e9e63", "comment": "Malware payload (Heodo)", "value": "eae1ac931c8aa0311468950b8ab438bd308005c636791106655be979bba8175574e28e6473e2680d2f1b249e9f02d351", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561857, "uuid": "bbf53216-a503-40e6-ab0e-6bf7f775a069", "value": "T195C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561857, "uuid": "719f95f5-e0c2-4d49-81c8-0e3bd4a16d2e", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC8:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561857, "uuid": "e9a8c5e2-77cf-41dc-8b9d-c3012dd60bd3", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561857, "uuid": "6cc92850-60ed-4e25-9256-a44d89570948", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561857, "uuid": "2d9cce0d-4bf1-4cbc-b326-f6d1fe721a8f", "value": "SecuriteInfo.com.Heur.6917.7182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9a6904-af5f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648558683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558683, "uuid": "6b14dfd2-41df-4878-8d36-aff4846f520a", "comment": "Malware payload", "value": "8a91d34ccedd26f7d83e7c48e45e6949", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558683, "uuid": "4dcd6353-40b5-4150-877c-67e67f1b4fe2", "comment": "Malware payload", "value": "a5bd43addba8f7b4294187ee49528897da49464572f1985d3d1c24cb0596214b", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558683, "uuid": "931d0d91-b42a-4c48-bd56-1fe53a60145e", "comment": "Malware payload", "value": "ac0fb2e791f8ff50baf120736d8c038f788ee4d2", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558683, "uuid": "e2b1e6f0-47f7-4c47-ac1f-379a6a3fbf1c", "comment": "Malware payload", "value": "b46ee53fc68db1a627eb9c3b1d649e87d1067f6f60927a1f4d6109efafc2950e699414e3982eecdbf6c9cf027ee88281", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558683, "uuid": "d5c7f5ff-33d3-4b50-acc6-fcfa59ac992b", "value": "T1F9F2D1E875F0499FE553C93496A4038B86ECD4738F29303F451886846DBDDE9BCC84AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558683, "uuid": "f44e3569-5eb7-4373-bd29-0a9abcdf2725", "value": "768:KY+k/RO/FD+ZA2FydV2B9A3BS3vmiT7u+3YPp2LQ:D+K0/l+NF8VgUc3+ivC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648558683, "uuid": "e9ad0e47-63c5-4455-8d7f-3890f2411cf2", "value": 36894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648558683, "uuid": "fe25f490-c6d6-415d-8fe8-d55f30f75fe4", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558683, "uuid": "4575f39a-a995-432e-bc6e-90e1ab1b02b7", "value": "PURCHASE+ORDER.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71d0137-af7a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648570267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570267, "uuid": "ebbb50d6-27ae-48e0-b482-378e1de6dba2", "comment": "Malware payload (Heodo)", "value": "eef1c2fd422e2221833610a4589389ae", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570267, "uuid": "b2fb3c49-deb8-477a-ae6d-284a6c734a33", "comment": "Malware payload (Heodo)", "value": "a5d1c358d4155f217a3144f7a9ad5832af2bc87b2283ca75ef56b1b30b9fddaf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570267, "uuid": "73999e47-082d-46b9-bb4b-57b7a2969f70", "comment": "Malware payload (Heodo)", "value": "988ec29790c640758b92a77173970da1abdb37e4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570267, "uuid": "d7f21d0a-562b-4bf6-ab37-5bafb1b7b66b", "comment": "Malware payload (Heodo)", "value": "b73dff0a150cd17b8302fbd0d6c923e551c2236fbe8920041d2dcb9f159125fb45b3e8d9a5d11011e8dc1c2d08f39461", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570267, "uuid": "8b8cffa9-f743-4c5a-8991-4e9301850dec", "value": "T1EAC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570267, "uuid": "021b9f43-a655-4fce-8890-e906727606f7", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648570267, "uuid": "d01639ca-e938-4ff5-99df-151535269315", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648570267, "uuid": "d1276954-3cc3-4424-9647-405020bb023d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570267, "uuid": "be958d3b-8561-439a-9ea4-274d978ca0ac", "value": "Dokumente 2022.29.03_1708.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e2e41e-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648529521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529521, "uuid": "99dbaccc-aed3-4e50-9540-1241fb4e9c0f", "comment": "Malware payload (Heodo)", "value": "a0859e9bb113eac49441689af4aafde7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529521, "uuid": "1a5e2775-47d1-469d-a487-0bd4cb240968", "comment": "Malware payload (Heodo)", "value": "a62f0965eae5ead7403cbd0c7b186501997909957c8a15966a34d108e36775b3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529521, "uuid": "e8820cb1-9fce-4741-93fc-4372d4926bc8", "comment": "Malware payload (Heodo)", "value": "f5cc6d9e23a1fb06b987f65a6217df8398b34230", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529521, "uuid": "079f3104-280c-467f-a245-378ca9479319", "comment": "Malware payload (Heodo)", "value": "115cc56a3a852d8b7d7dd224ea5c2a5ce84b0809b58e33106a9f9c93437b9abd3b86b136b4a9f5d7201d793427427998", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529521, "uuid": "1c9f8e01-ba0e-452b-95e5-93a5e2041644", "value": "T192F49D1173C390B1C657617C840EF711ACBEB47C6B18857EA14B62EF4BE78909A346BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529521, "uuid": "3d0c23c5-a2c2-4d55-b254-aa4f8708359b", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529521, "uuid": "dc7099e7-ed28-4b20-96e8-e21932caa1e9", "value": "12288:S54yM33d3q3Z7BogQreNmF+U/9JckIAGfUebNYawsoei4:SKh3831BoyN6+ADckbebN7oei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529521, "uuid": "8178484b-1f8f-42da-832b-f15d79555b02", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529521, "uuid": "5e9e809a-263a-46c8-b3be-a68af0e71f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529521, "uuid": "495c0389-e3a1-438e-82e8-dec077bd724b", "value": "emotet_exe_e5_d48345f3cec6106ac408f742aed66453d46390a86c0a003eaacdeb774efcf350_2022-03-29__045155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbd841b-af31-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648538606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538606, "uuid": "a362db08-685e-482c-9caa-e28cae993c08", "comment": "Malware payload (RedLineStealer)", "value": "ed046893d70db91d9758ca81c6f1e507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538606, "uuid": "b254eb09-61ed-4c49-b9ca-551ebf11ad58", "comment": "Malware payload (RedLineStealer)", "value": "a63806a04c7dc23ef99da422feb1192d69b6b627aa39ccc989362ae508af899e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538606, "uuid": "13109c6b-1abe-4e99-9858-b10afe91d720", "comment": "Malware payload (RedLineStealer)", "value": "dc7e1f1239a86aa959d8dbecff4918a6cf3578ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538606, "uuid": "8c26441c-6687-4d44-9a06-e88f5397fd18", "comment": "Malware payload (RedLineStealer)", "value": "0b57090f936356bcec0aa616db2f554e054d669222d50dba18349335643463a7240e932775b27aef8eeb33476cbf9307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538606, "uuid": "2ce986f3-ad7f-42a6-b01f-beac6f4e3a22", "value": "T1A2E40121B185F431D1211E779816CBB0992EBE3C58240A837B9C3FDE6A7E3926B5534F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538606, "uuid": "d0bd66c9-3a28-4214-bd3b-d7fb31de5584", "value": "e5c179e1f9502263973e4310e0826274", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538606, "uuid": "c99d4758-d6e3-4f4d-8ce8-b8a52b56c9a2", "value": "12288:6Jlvyb1eZP7Y4mJNZcdsdRd/Pf4gGtf0JeGAqcvGM424e9QOGN:+qb1e+ZJNm6zFPwgBeG3eX4gGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538606, "uuid": "e4ced4f9-ab45-4be9-9fd1-897ce9d80d3a", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538606, "uuid": "0a509d4e-7f72-492d-a2f2-33dcf0e14453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538606, "uuid": "e23c5380-85c2-415a-aec7-636e2dabf058", "value": "ed046893d70db91d9758ca81c6f1e507.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7ea7f9-af85-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648574970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574970, "uuid": "769d0981-afe1-409d-9b55-254d3bda251f", "comment": "Malware payload", "value": "ffea1266b09abbf0ceb59119746d8630", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FoxBlade", "colour": "#F367D3", "exportable": true, "hide_tag": false }, { "name": "Hermetic", "colour": "#0A4711", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574970, "uuid": "18a3e33a-43fb-4d77-a937-0c23e327bfa3", "comment": "Malware payload", "value": "a64c3e0522fad787b95bfb6a30c3aed1b5786e69e88e023c062ec7e5cebf4d3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FoxBlade", "colour": "#F367D3", "exportable": true, "hide_tag": false }, { "name": "Hermetic", "colour": "#0A4711", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574970, "uuid": "39132a4e-d163-4bb5-ba7f-4a87a0896a1f", "comment": "Malware payload", "value": "5df6d407f4629b9e4765ed96f19caf9a0710c2f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FoxBlade", "colour": "#F367D3", "exportable": true, "hide_tag": false }, { "name": "Hermetic", "colour": "#0A4711", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574970, "uuid": "57a6f1dd-9753-4f74-bccd-8a53780688fd", "comment": "Malware payload", "value": "50725dff5883cf34d3e6e1da22a451b7604516a87a521bacf93a3f8e24b57e3bce8af6af31ef1db0fe269eb9dc5d8d33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FoxBlade", "colour": "#F367D3", "exportable": true, "hide_tag": false }, { "name": "Hermetic", "colour": "#0A4711", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648574970, "uuid": "cb2a3038-b2e6-4ed8-ad79-c434b36ea55b", "value": "T188B349139ADC7CC6E47417B13BBFA7E0D36EECA66A80C49E91D01281D07C9A335627E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648574970, "uuid": "6eef9511-97f3-433b-845b-cfd18ac17902", "value": "1536:sBOoa7NO7QS7Q7d7QS7Q8urM7QS7QYgjKu1sPPxaSLyqC:sBOoa7MkSk7dkSk89kSkVV1qPkSuqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648574970, "uuid": "9b8a7ce3-b48b-42d8-b9ed-e1a47274e478", "value": 117000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648574970, "uuid": "1b73d723-b8f9-44bd-918e-a5dca6f12f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648574970, "uuid": "2dc614fe-8ff7-4eab-afd7-3bfb73834d66", "value": "a64c3e0522fad787b95bfb6a30c3aed1b5786e69e88e023c062ec7e5cebf4d3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee449ce-af72-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648566548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566548, "uuid": "be7f18a1-b64c-47d2-a019-3e6dbf33b00a", "comment": "Malware payload (njrat)", "value": "03de9368f4d60a144a0ef616819683e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566548, "uuid": "36894304-9c3d-4c32-be8c-c82754ce36ec", "comment": "Malware payload (njrat)", "value": "a6a135c2b4d2e961071a0291c88f3690fe0734ba8f8b54b41ef339d643325fb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566548, "uuid": "7a62e1a5-101e-4819-ab97-910db1afcff8", "comment": "Malware payload (njrat)", "value": "46099f49dbf7ab6ef6a9a886a9ad579b96cea0cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566548, "uuid": "5a3c5c83-8659-4af2-808a-a8242cf12a6b", "comment": "Malware payload (njrat)", "value": "44ae299cca0f32001fb218f833eb1b053fc33e2efd9225ef6a015d9157d95edd23b8929a852db487dc1ec051eb3f309d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566548, "uuid": "3fe4a7ef-9d99-4436-b913-effa62146c07", "value": "T10593E74937E150A9E2FE8AF3A971B2404FBAF0471742934D49E178761A33AD84F44DBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566548, "uuid": "4dc6027b-f60c-45ee-9dcc-4b78788a24b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566548, "uuid": "36a6d25e-0843-42ac-9502-0b761e74d69d", "value": "1536:qVTbkWWWipj69MME0n2ZXkaEkqVR1Up5v:KTnqj69MICZJqVRe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648566548, "uuid": "105dbe6b-1db2-469c-a863-b3fa228c4f31", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648566548, "uuid": "667fede8-bc7d-4a53-b8dd-285711e293b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566548, "uuid": "97d9bb7a-2ab7-4d9f-8910-603eafd74117", "value": "03de9368f4d60a144a0ef616819683e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a1aff8-af25-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648533519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533519, "uuid": "5c9f56e0-8b35-48c2-a463-fa58c65a9f5e", "comment": "Malware payload (AgentTesla)", "value": "fe30a320b140c66230ba9a5a5c133221", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533519, "uuid": "2cb7ca07-6c49-4b7b-8781-2b415442992e", "comment": "Malware payload (AgentTesla)", "value": "a6d00f12e26274804c03c929cbbf33d45fb265c86863e9960fc161f25cc82745", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533519, "uuid": "b60553c8-25e1-47d8-9737-ed596fb15c20", "comment": "Malware payload (AgentTesla)", "value": "00efa987502e035e564e8106bb068c0b9fce542d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533519, "uuid": "6ebbfe61-0085-493e-81b4-4d406c1501af", "comment": "Malware payload (AgentTesla)", "value": "669e532cae8d32afd6f34f33188240da7149ba84c2ad27c3acb1acd9748e9bd8dcc1f6f70e7c321d184c7d369b838133", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533519, "uuid": "9d64f9f9-2b4f-4815-b83d-b1349455d0f6", "value": "T175D4233DD8009204F686003BEA57BD18EE7CBC92956E865B26D7329C357B6DECE71450", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533519, "uuid": "3f5eb08e-a025-472e-ba77-e9096e38448b", "value": "12288:0rdMU/Z0Z35t8a2ByoDzhmLW++y6Dtr+AqdrFzx/:0J7/Z82rhmL78h+brhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533519, "uuid": "97ab8641-f159-4801-a436-2e8f4232c6b6", "value": 634996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533519, "uuid": "f8ba5a93-ae76-465a-a5b1-0451e062d4f8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533519, "uuid": "fdffc225-587f-48d7-b05b-b42a784b95b8", "value": "022_confirmaci\u00f3n de la direcci\u00f3n de entrega.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73190f23-af63-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648560220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560220, "uuid": "ea04612c-d8df-4265-87b6-8e6f42aa670a", "comment": "Malware payload (Formbook)", "value": "56295c335f1b5b2983f484628a69e7bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560220, "uuid": "5b4bb88a-c809-4dd4-bacf-1d0a6c5f8346", "comment": "Malware payload (Formbook)", "value": "a6fc3999962566c6c0e0631aab8db2f7bba921604287bdb185b913aa3c3446f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560220, "uuid": "cfee78e0-4834-4b11-b791-49668116c403", "comment": "Malware payload (Formbook)", "value": "2e08e5781d66843477bd35cf7f9c3279ae06ce5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560220, "uuid": "d7cc9707-25a5-4684-b591-2c4ee59b658b", "comment": "Malware payload (Formbook)", "value": "ff282bcbc859fe6c942ceb891f0a83418459b466106379a17d88f1f2ec757e22e0e009a03b5b2c74a4a3bcec5c34258d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560220, "uuid": "75aaebf1-fa78-43aa-b277-8ff89890e246", "value": "T15B620A51ABA4C6F4C4690ABA1DF366430B69B61ADC95DF1E3DC9B30B5D232025072F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560220, "uuid": "eb801fb7-7da3-4a26-9667-6ea70eeedc2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560220, "uuid": "deb80ddf-d485-47a5-8f2c-7a4bfb82ce6c", "value": "384:MJ3zWcHbor9bskuDHvEiiay9ycyrsR2vZstGA:MJ3SwbaYDHqycyrsR2vZstGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560220, "uuid": "c9b9ef1e-1009-4b53-8277-c69cbde0dd67", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560220, "uuid": "426e4c96-40db-4e42-a756-76ec4f2e4348", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560220, "uuid": "9eb7933f-05ed-4447-8464-e56c404f92e1", "value": "09876543000000000000000000000009876543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac80416-af26-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648534034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534034, "uuid": "1fd411fd-791e-41e8-a926-11a37d8eda38", "comment": "Malware payload (Heodo)", "value": "c085e05bce51ca31b4cf7bb77415692d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534034, "uuid": "3c849a9d-7c1e-409a-9a00-87eba0a6c559", "comment": "Malware payload (Heodo)", "value": "a6fcdf0ef621f76e2259fae9fc09f2201fd7f10f95209cee3f529152366d5884", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534034, "uuid": "43a315f8-12c1-46f1-b308-17fa3ea2646d", "comment": "Malware payload (Heodo)", "value": "aaf9faf231007989eccbfe81867ea66883bc07ed", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534034, "uuid": "45030909-d8c9-4773-9bf7-08c0ad6f69c0", "comment": "Malware payload (Heodo)", "value": "c69dc5f72a06620e9696feca63109ce8a7caecbab7c9156b8ae430399bcc8ddc7c0cea8061bdc1cc9c9aba38cdfd724d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534034, "uuid": "b7b44959-9989-4b7b-91ed-360600f86e9d", "value": "T167649EE173F08A77E26715333EE597AAB2B9B560DE32C6836394CA4CEC320558532719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534034, "uuid": "824ca726-b39f-490f-8c89-d65fd9835be1", "value": "1ae872d29ae3f3837d6c8d15813e59d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534034, "uuid": "18802c1e-2760-444c-a65d-a315f7ea3eb7", "value": "6144:gIuOkoX33WyZEwtWNRByDlPdOT6ncZe9y:gXOkoXnLETNnypWYcZeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534034, "uuid": "a1b12b26-3c0e-4a2f-88f4-f7e411bef240", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534034, "uuid": "5febe1e2-0e2d-426d-aa47-2909e3ee8b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534034, "uuid": "ab95aaec-043b-45df-88aa-cc22269049a2", "value": "jaiv134o.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054a0354-af28-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648534696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534696, "uuid": "f372a83c-f0aa-45f8-8315-a46dc4cac8a2", "comment": "Malware payload (Formbook)", "value": "51e6433d29e013d59f0a1907edcdd8d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534696, "uuid": "9a152ba9-c129-47d2-822a-e71c91ac9816", "comment": "Malware payload (Formbook)", "value": "a871695c7312b67a4d3e5c3a41094a5c3824fcfa9f02ee67b2e0d21a0ba061d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534696, "uuid": "1c598f41-a0c5-4666-83f2-9fae525853e6", "comment": "Malware payload (Formbook)", "value": "9d8aa6ae4b6003961529e1ff8029e48db1d0d1c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534696, "uuid": "17965fb0-ad13-4295-8696-635aced978c3", "comment": "Malware payload (Formbook)", "value": "2bb6479038304817c9cbfd22482e751d8c6a9dbe211092f40f510ef16b4ab0c52c27fbaf7ea362c3ab8bad97ba732be1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534696, "uuid": "b20f0242-592e-4ea3-bf94-f24c0cef71f1", "value": "T105441250AF10C8A7E6710D74A875A769EFFF913837712E036B613E1E7DA2290C81EB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534696, "uuid": "5630b7bb-3625-48ba-b514-d66a65c0ee68", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534696, "uuid": "09a80275-2427-4e49-9c93-a9a04632702d", "value": "6144:mbE/HUbRklv/JMYZHVXQHZXwRbmZvErayFLD6:mb/RkF/+Y7YZXDFErFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534696, "uuid": "f1b47aa4-fbb5-406f-afc4-3b2720e774cb", "value": 255414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534696, "uuid": "aebce034-67a5-416a-b9b1-218583b22fcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534696, "uuid": "53e77e7c-029a-4577-8413-4aae40b01143", "value": "BANK DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd91b4c-afa9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648590521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590521, "uuid": "89210f1e-c389-47db-b1f3-5e4ea3c8d69f", "comment": "Malware payload (SilentBuilder)", "value": "3456e00452889c06f99509bfde0bc709", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590521, "uuid": "d824cf23-0c8a-4a8c-82e3-5235a821aa80", "comment": "Malware payload (SilentBuilder)", "value": "a8f23c56a399460b343da3455440d72e3dcea2813ccbfff49f70439a719685ae", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590521, "uuid": "78ca16a8-d07b-4f47-94e8-1b6b989ba804", "comment": "Malware payload (SilentBuilder)", "value": "4cca0f9957c400cab8d1870c09ebb0cd0d4fb40a", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590521, "uuid": "f2ec0110-fac9-4c19-a2f4-4d9446bac326", "comment": "Malware payload (SilentBuilder)", "value": "e86d0fdbc8db18e4e8f59f132c521cb9d192af3b013809076bd566ee987defe068551b66ef5326eaa387887d8e599bc7", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590521, "uuid": "1600047c-b2db-4280-9333-1772cfdb8ea0", "value": "T107B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590521, "uuid": "17101fea-10d5-4a96-8d0c-5be71ae30cdf", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMO:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648590521, "uuid": "4e7b12e0-01b5-4ae4-b9f8-451951a5662d", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648590521, "uuid": "664104c3-8640-47ea-82f8-2ed6587c0819", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590521, "uuid": "cd2b4fae-16ca-4fbe-96d8-372d0bec6df0", "value": "3456e00452889c06f99509bfde0bc709", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974368a6-af87-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648575743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575743, "uuid": "870df706-ca0f-480b-a5ad-52a4bd4770ab", "comment": "Malware payload (SilentBuilder)", "value": "34ec8b5d910f4bbf57d8f30f61700aff", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575743, "uuid": "47868cc6-cd71-4ac9-b774-89c7e3b23be3", "comment": "Malware payload (SilentBuilder)", "value": "a992de09d3b782f740227147fad8e04e5242328bd98b5053cb4e79915c46e7c8", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575743, "uuid": "646c6425-f400-4f78-8248-a89084f57f06", "comment": "Malware payload (SilentBuilder)", "value": "20219edd14d3c24380449f6db31f32e999d8ca4f", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648575743, "uuid": "aa25e7eb-8649-47b5-866d-bd4987f4d814", "comment": "Malware payload (SilentBuilder)", "value": "69c97d5f0a9f744046a5994494bf014b8d377954e63f5bde1cdcc742f9f77d58db843024d7d7e1a2332296536ba750c2", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575743, "uuid": "037093c0-8c59-45f2-9cc2-b97e3c976ed5", "value": "T144B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575743, "uuid": "25ca6b47-b33d-42aa-b25e-690f4d33cc1a", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMh:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648575743, "uuid": "c0943c30-957e-4fac-8c43-24087a24993c", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648575743, "uuid": "2b53f366-1409-4628-b79b-fe2fa2792de4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648575743, "uuid": "e300448f-3cde-4dcf-a4e3-91d9b3aa2b28", "value": "34ec8b5d910f4bbf57d8f30f61700aff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13fbe168-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648536868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536868, "uuid": "f080556a-1f61-42b5-a807-854ba6e66d1d", "comment": "Malware payload (Formbook)", "value": "44c14471d6d538e2a5a837a383a2f6ae", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536868, "uuid": "7a57dfa5-1b8b-4792-aec4-f288ca62822a", "comment": "Malware payload (Formbook)", "value": "aa28d74bed21047edd40167dcbb267219e8ce22f60ae919635b2c3240ffc1f95", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536868, "uuid": "8d324a96-d284-4092-865b-7db5b195f03e", "comment": "Malware payload (Formbook)", "value": "75f71702e839853e0ac68d1f9ece435f39e6ab7b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536868, "uuid": "e1ba7272-b974-4811-bd99-00dc25e74591", "comment": "Malware payload (Formbook)", "value": "236d5f49e4b89c92b8ff02cbacfaba6f97b63d9a993060b3bc01e73cce4180c9ed33d9efedfc6870f57a13f4aaf724d4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536868, "uuid": "289370e6-bebc-44aa-b666-6cb97295418d", "value": "T1F41402DDF5198125F2BB27FF112448C6A6698F262D05F928AE987F2F17784CD41B8433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536868, "uuid": "9deea6bd-835a-407a-a4d9-116348127479", "value": "3072:3+qQb2FeCl/iLZkNU0j+8rzQE0avxKOUAzxGoQFIpyknPM745wQee86xhu:tQbHCl6eC0j+57a5KHAzYtipyN4B58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536868, "uuid": "f9fb96f6-f6e3-4a21-a718-4788d92f1707", "value": 192264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536868, "uuid": "ee1cd4bb-2dc2-4de0-8f17-21f4df9acce9", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536868, "uuid": "c5020ec4-062c-45a8-ab5e-61a02697da61", "value": "283SC510PL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5dd765-af5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648558058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558058, "uuid": "dfece878-58e1-4513-80ce-a705233e9296", "comment": "Malware payload (Heodo)", "value": "23b720754da8e96968b0fb9d94733bec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558058, "uuid": "2ebf391e-0b32-42b6-aa9c-39e52724b8c3", "comment": "Malware payload (Heodo)", "value": "aa2c9cd64d2d506e675fa864f8f76010bc6dfd1594e8d454b94bff59862cbccc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558058, "uuid": "3fe18641-495e-4339-a312-dce21dec2b98", "comment": "Malware payload (Heodo)", "value": "0cd32c55053f750737050728110ef03601646504", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558058, "uuid": "31b1d556-aa40-48d0-9efa-63e71e35a7cb", "comment": "Malware payload (Heodo)", "value": "13f37c558f362b1e99426fbd970ed821188f9dd7a2c762dc76a988a8dcdfa450f1bef00a7cd03dbfde582d5f53e20e56", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558058, "uuid": "962e8346-ea11-4656-8d02-eb3f50f3311a", "value": "T105D45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558058, "uuid": "fd4debfb-866f-4689-aae6-b9887a396814", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558058, "uuid": "200226b9-64bb-483b-ab63-f0f8557c5ced", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDznipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wQooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648558058, "uuid": "2d697740-c644-437e-920e-88f4bf239c0c", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648558058, "uuid": "fd5d8bca-7c2f-48a4-84ea-c5616a775b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558058, "uuid": "c1cda3af-c43e-4e6c-8542-91d3109639b6", "value": "xuvSckbPV2c1Z88PvPguO.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4108d008-af33-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648539521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539521, "uuid": "b9ca5529-b6fa-4694-a691-8a3595720d36", "comment": "Malware payload", "value": "7254cd8b0045dd84a5d484e167886fc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539521, "uuid": "97fb66e3-34c2-43aa-b348-c893f09c4eee", "comment": "Malware payload", "value": "aa2d310bf44acf203cccd07a1c5bf4ed70b9b57e33453ad355b7c50dc687a37d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539521, "uuid": "e3edf1c5-09af-4117-a2f2-3cfb9006d9a2", "comment": "Malware payload", "value": "b527d1e726ccdb553e88673152305a4f3935dde6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539521, "uuid": "039a2ce4-ba5e-4fe1-b53d-1cea7e1a647a", "comment": "Malware payload", "value": "c26f2ec88423235a32aca3c943e2111fe82f06f5242c0c21c1c142c21e06cab4d9a38d3f70f7d1f0cf904f6ad1d360ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539521, "uuid": "2ec13011-0f24-4760-b000-9fbc6c75ef1f", "value": "T11416AD12BBD58F2BC5564B388AE783647379DC904B43575BA38A712D3DB23E02B871D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539521, "uuid": "5061e5a5-cf7e-4a54-ad5e-4db01c8977d6", "value": "49152:LNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3q:JzP88fBsnZTgOtqB3m1RC3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648539521, "uuid": "777e592b-872d-4102-bd74-8094b099a976", "value": 4097071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648539521, "uuid": "65f15bdf-f0b1-47e2-a780-0553443ed6b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539521, "uuid": "611437a9-4114-4b4f-8db5-d1698a796332", "value": "7254cd8b0045dd84a5d484e167886fc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98f98ea-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648573250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573250, "uuid": "eb13aac2-7eb7-4635-9471-a464f5c53069", "comment": "Malware payload (Heodo)", "value": "50accc3516790000d314d7b06b40c6ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573250, "uuid": "857eba0f-a72e-4a6c-9c37-9d9b0aab415b", "comment": "Malware payload (Heodo)", "value": "aa83bcfead22bdd0310f41073c49f497a689c04c59c51e61e626c6d8f1f13a13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573250, "uuid": "66893177-5ac0-4c41-9033-3934ec40f6e0", "comment": "Malware payload (Heodo)", "value": "a451b2d2547e5a06313070f0cfb8f49a77b79794", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573250, "uuid": "bfaf4b89-fd63-4a81-a6de-2769bdd86b55", "comment": "Malware payload (Heodo)", "value": "6777f60cb6383b6a93661d7dc8d7e11489fb100a505d4c49d7c335b865337d5e731e79babbf3c9234093455cbee34ba5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573250, "uuid": "05057684-0096-4046-9b9c-be63f893ba47", "value": "T18ED45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573250, "uuid": "814bb951-7e8b-43c8-a98c-9fc85823cf95", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573250, "uuid": "8ef45696-2abb-494e-8820-4fb9bc178505", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzhipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wSooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573250, "uuid": "bc4c3133-ccd8-4bf2-aa0d-371eeb9cef22", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573250, "uuid": "1bb3d1bd-c535-47aa-8805-c689e4b22a39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573250, "uuid": "d3f52e1b-08e7-41a8-af18-8ecbabea68e3", "value": "50accc3516790000d314d7b06b40c6ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e06559c-af3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648543918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543918, "uuid": "485e7765-e9cd-4f58-b7bd-928ac8c24431", "comment": "Malware payload (AgentTesla)", "value": "c23d5f17cf2a374a9150eb34db08137b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543918, "uuid": "651226d9-cbaf-40cd-a033-bbeeff952a12", "comment": "Malware payload (AgentTesla)", "value": "ab2bcfce75b747b1c1703b7e1b3928481a50e2eaa1d0464371b45b16ff7f50e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543918, "uuid": "f3cb4004-04d7-4f8b-844d-b64593f3e9c5", "comment": "Malware payload (AgentTesla)", "value": "d4055e8234be9c78f81c96fe2c2837f03094e827", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543918, "uuid": "80048700-c49c-4da8-99e5-3ca3ee47d561", "comment": "Malware payload (AgentTesla)", "value": "903f5dc26a9151845606435fdea98929f827b3ce4353509b9fd4dc773ddb725743874070979d0afe844e90628c6ae34b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543918, "uuid": "c600c890-adb7-4222-8d4b-e7a778b84609", "value": "T19A15124AB3E41F82E87BDBFA8A25164043B6F169014DF2485DD770DB1AEBF4013A4B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543918, "uuid": "50a33b27-1e49-436b-b942-5d63e4da515d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543918, "uuid": "6e7866d5-86f7-475e-a2c5-0ba0d5528bb9", "value": "24576:BmIwOueTjP99GWe/IzHTTZ7PsQnqNIgNnGGan:BFf1TjiWBTZ7E+qNxNGnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543918, "uuid": "fde777d9-e078-410f-801e-e5bad8b313dd", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543918, "uuid": "6a96089a-11f6-42da-b192-1ae01cc275f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543918, "uuid": "1b7f334c-bfde-4aab-8585-075921bb2cdc", "value": "Maersk Billings.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf70c74b-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648573260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573260, "uuid": "bb4c8041-5434-46fb-be69-479e0b80cf2d", "comment": "Malware payload (SilentBuilder)", "value": "969b7d5071f7314a4c70eaa1b32e61a2", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573260, "uuid": "b7b62f8d-3f2c-47e8-aba8-87510839306a", "comment": "Malware payload (SilentBuilder)", "value": "ab90a7b01c9ba10220d0e4580ea94626113703315367924976ce657402eb598a", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573260, "uuid": "54ed88e7-8726-4467-aecb-c6790c5d606a", "comment": "Malware payload (SilentBuilder)", "value": "5f924d44a7a3257033b6abb8a1434dc67761f30a", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573260, "uuid": "883e6e80-5c7c-4ccd-9112-d94400b6f33f", "comment": "Malware payload (SilentBuilder)", "value": "ee2714a1b42e38f52942876b966261861ca4920e186746420b8a51a2de9a9f2f725f9799a9f40116de854177c9cf2cb5", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573260, "uuid": "f09bcc3d-f36d-47a1-ac9a-7cff0e7c54f8", "value": "T1BAB39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573260, "uuid": "f129f484-4e5e-4514-bf07-b627634b929d", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMN:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573260, "uuid": "ec7fe57f-15b1-40b7-b06e-0722bd405a29", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573260, "uuid": "3d0d9e78-1e31-4fee-8beb-e8b474e5c295", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573260, "uuid": "0fa5a6d4-92c4-456c-bd10-8fe440f05c62", "value": "969b7d5071f7314a4c70eaa1b32e61a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20a8539-af35-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648540650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540650, "uuid": "2fcc1b30-1799-4d8f-9a14-c03faf961b26", "comment": "Malware payload (SilentBuilder)", "value": "02b87f6df6560ddf2b6dc195bfacb536", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540650, "uuid": "af3d0883-49f7-4b1e-86e0-e0b7624df4e0", "comment": "Malware payload (SilentBuilder)", "value": "abc7900b46031415eb99354b9e2e265e051ad1c631b5c13f29ddef46fefb4f05", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540650, "uuid": "f393a708-fd94-459c-b185-8387fb1a79e8", "comment": "Malware payload (SilentBuilder)", "value": "553581946f918aeab4d7ca9100fb76a55ff318f0", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540650, "uuid": "c308ac2f-13c3-472e-afcb-d8c3173c8e6e", "comment": "Malware payload (SilentBuilder)", "value": "edf5ae82e364fb6c1009ff29ca3987ac9380b4d2da95ab39450417ff919ffa0e5978a85e96a9068a58b22b88ba0fecc9", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540650, "uuid": "8a61399f-2ce4-4efc-8486-15e15ef0ba06", "value": "T177C3AE8BB659486CE921877489DB879A7363FC354FAB47473214F3366FB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540650, "uuid": "03c0d00b-b712-42f3-b58d-acb1f50860d7", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgj3Siz+3z4Icu6hlCU:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648540650, "uuid": "c3bb2c58-e07b-423f-ba23-83cc6b4ef0d3", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648540650, "uuid": "fbdd5537-17fe-4f8e-bd70-a530432e5b62", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540650, "uuid": "5b29e461-809f-45a6-9e38-a5bd4e236f10", "value": "ACH Payment Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454c8aae-af3b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648542964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542964, "uuid": "8238d597-87e4-4183-97f3-b8478ad29a6c", "comment": "Malware payload (AgentTesla)", "value": "eb99ecc9d7b191948bb453bfb2b5fee6", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542964, "uuid": "789644c9-7359-4ac7-9bb8-58113377c0b2", "comment": "Malware payload (AgentTesla)", "value": "abde0693b576756177ce9f58cf2cd936a6eb2f161846d6174675eccc3fc361eb", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542964, "uuid": "c176b957-1bb9-4ed6-be03-4201647b0c3a", "comment": "Malware payload (AgentTesla)", "value": "4e3bb286bacb628ae722205f7776dd80597c64e7", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542964, "uuid": "1ab21aa4-a42f-4cc5-b5b1-9947df9d87a6", "comment": "Malware payload (AgentTesla)", "value": "8c991ca21efd48d67cbb991db9a7b2f667bde759fc0a6423ba125eb567b4b0cb5fbd18069429797375afdd31f0e76ed1", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542964, "uuid": "18601958-973f-4703-8bf3-01f9be0182dd", "value": "T13225334D6699E2574DE874319B6BBCF9CC33EF408A2DC9AF86C318175128043BD6671E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542964, "uuid": "59303e99-d156-4665-8e5c-bfa864b869b3", "value": "24576:vp2gyfUcJcVFAn5GqqNPu3PVd2S43UfDleoydSzW:vIgOU0cF9u3PH2Sy2heo6SzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648542964, "uuid": "de78c369-c8f8-4f5c-b667-6d87e4247caa", "value": 1029095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648542964, "uuid": "f8f96f7d-d993-4512-965f-38ee071488e3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542964, "uuid": "a2ef8ba6-b176-47c2-a9bf-b481c2318f28", "value": "dhl express.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a20513a-af29-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648535375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535375, "uuid": "980d2e25-cce2-4596-af28-b16781c08b72", "comment": "Malware payload (Mirai)", "value": "ce84a66991e05ca979aa894d8f0dec1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535375, "uuid": "35cb3ffb-d16e-445b-9d70-ee23087fdc7d", "comment": "Malware payload (Mirai)", "value": "abe71d3d429680719c5186865ee20c9c3b74a3c544637cb5135310110d03253c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535375, "uuid": "519bc389-7ef7-46e1-9313-eebc62f543da", "comment": "Malware payload (Mirai)", "value": "32b2779172cfe767d4593b5407e7dfdb9e518d87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535375, "uuid": "bb8c39a9-63db-44d5-88b2-bbe684607aa7", "comment": "Malware payload (Mirai)", "value": "224643d5fdb9869c39e04fc129e54284908aaf8c50337570dbbb3dbc2dd1851478c4f7b7bc9469a09cd98bd35e7f5b1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535375, "uuid": "425b48f0-bd77-4ade-8ea5-7c823998acbe", "value": "T1AF839E25F0255CA0CB602EB8B6EDCD784313BD6450762CB16FCD4FA8419BAEC718E7A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535375, "uuid": "3f7432e5-528f-4961-893a-aad243d74e77", "value": "1536:G/xNSIPgKYXOt/AoOCsDG+RUYajrHex+ou:G/vSIPge/AEsD7RKLw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648535375, "uuid": "ba5bbd02-1b7d-46aa-85e2-fae8916782ec", "value": 82608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648535375, "uuid": "313a72ff-189d-4f0a-8783-358e61960aee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535375, "uuid": "c47ef6c6-1ede-4531-ad43-d1705d621078", "value": "ce84a66991e05ca979aa894d8f0dec1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7aaa96-af5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648558037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558037, "uuid": "0f8182ce-e676-4102-8286-d16660326f60", "comment": "Malware payload (Heodo)", "value": "699b9a9e3971cde44f7555e577063136", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558037, "uuid": "6283d432-ff9c-4791-b4b9-e77154fa063c", "comment": "Malware payload (Heodo)", "value": "aca091d06d3bccef5a695a4522de6012a3c1dd9040a550238c010af9acd41fbb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558037, "uuid": "aeb37b09-fa9b-4720-a9f3-41e3b66ab2e1", "comment": "Malware payload (Heodo)", "value": "a10a900cab5fb3a00dc5fbb448ff8efb18aa7e02", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558037, "uuid": "eed934f8-fdc0-46e0-8353-aafa49052ce2", "comment": "Malware payload (Heodo)", "value": "f5e78a5f4ad19bdf6c4cf04c87ce0de45b231ee9953d30173fba58d11faa0b07fc4ca00978da2f9c149f49c10181e7cc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558037, "uuid": "e1f8be3e-8b84-4184-bff1-0eff37b7a03c", "value": "T1CBD45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558037, "uuid": "558440e1-4ad9-4272-89da-f233875324f5", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558037, "uuid": "ab98c2e7-a0eb-439d-bbdf-879b8f958056", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzjipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+w0ooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648558037, "uuid": "9d426a0b-2894-4185-a3d2-028c201501e8", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648558037, "uuid": "810bd4f5-2643-41c4-94c8-35e92c7988e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558037, "uuid": "e3461e6d-3bd9-4dd8-84e8-949d85f45d30", "value": "ydh75Iq.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07eaa07-af6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648563813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563813, "uuid": "05467374-7503-44c3-95fc-4ddc15247078", "comment": "Malware payload (Heodo)", "value": "312ead815127c4678c18fea6ceeff8ce", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563813, "uuid": "0fb6dce4-f50d-4172-af42-0dc89568d345", "comment": "Malware payload (Heodo)", "value": "ade8be9f42310d7208c19f38eedbbdd38a925237d349718844a036d2ebaa7af3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563813, "uuid": "ff547280-3161-416a-9e47-bde53591e37b", "comment": "Malware payload (Heodo)", "value": "7aded3ad9c67d380a1c01a72b4abd7362c1847bd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563813, "uuid": "0361dcc5-604a-44d9-8e47-568ed165c3b5", "comment": "Malware payload (Heodo)", "value": "24e33c57bfa4ba6f3a390f19ed924e3e6f1ff4c22081a09b2ed3e693ada4734e03c569ac3864dbcc52591a7c65cff73f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563813, "uuid": "666ed19a-0aa3-4706-bec8-4d7b8149b2d8", "value": "T114C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563813, "uuid": "8981059e-c6a9-450c-80fd-5d5968a68752", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCs:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648563813, "uuid": "6758235f-a206-4666-8062-d4ecf76460f3", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648563813, "uuid": "b65f0b5f-4b4e-4b51-adda-46363fd7c7d7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563813, "uuid": "4b4ef20d-67c0-43b5-9075-fbb8092e0d27", "value": "312ead815127c4678c18fea6ceeff8ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c0eaf2-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648562124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562124, "uuid": "124080b6-663e-4777-84b9-89be6f96b030", "comment": "Malware payload (Heodo)", "value": "bc46b4f8899be28ea5938d3ac6a7d695", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562124, "uuid": "497daeb5-954b-438e-a188-a41809d05113", "comment": "Malware payload (Heodo)", "value": "adf8701ff333b61f21d23c502373e3d4fdccb3da054b3fe6d0760de47bb300d8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562124, "uuid": "c94ce335-1e38-4f86-84d3-8d8d6f69a02d", "comment": "Malware payload (Heodo)", "value": "5d588a4d09eca0a3b410b7a5fd61872b65be39b8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562124, "uuid": "87b737ca-2593-45ac-9370-b7868e3e1a73", "comment": "Malware payload (Heodo)", "value": "e3aa59f20e38edc581e2ff49701c4e3598e3122ed295942fddbf1ae931bb4ae609b900930bfbaa751ed834fda180e98a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562124, "uuid": "28be8a9a-d938-454b-bf4d-412fb7e6798a", "value": "T17AC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562124, "uuid": "50d577b8-dc64-4788-af14-c43615db6142", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCs:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562124, "uuid": "f841961a-1b5d-4dd6-bc2d-f8fad925b426", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562124, "uuid": "b0a5d456-6670-4771-94e4-868848bfd343", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562124, "uuid": "24fa474c-7ce9-4a93-86e2-628581c25bff", "value": "2022RJ000051250.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54713c84-af28-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648534829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534829, "uuid": "04c39f42-9b07-4488-bb86-1f3fff18bc41", "comment": "Malware payload (AveMariaRAT)", "value": "28d02f186604eb5c6668ec3ff6684cd2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534829, "uuid": "6c5bb9f2-77bc-4f2d-883b-b00486f944f6", "comment": "Malware payload (AveMariaRAT)", "value": "ae535f9fb4d5e8df737d72b7c66854063519c629ec5cdf7224ab1a688b729757", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534829, "uuid": "f01144d2-ef2f-4718-9786-c2e8e9d6d966", "comment": "Malware payload (AveMariaRAT)", "value": "2551dceeb235c40621d985567ca709a78667f6b5", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534829, "uuid": "02655695-fe08-4cf7-bf4f-1764bb6833c4", "comment": "Malware payload (AveMariaRAT)", "value": "22eff454ee748c3a0b31b40c17e70494be793af85e0e6fd0b4dc45d5a4dc24636108795e5136aeca2a19980c0dac19da", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534829, "uuid": "549ade0d-829b-4342-934c-c13ceea35f25", "value": "T15C7423883654F167EDF104F16F87878E1B7C869328C22A38341A487E9CD3E51AD79B5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534829, "uuid": "c258a896-40ef-4a55-b06a-ac8d3548be6a", "value": "6144:y+oOt9NV/mZ/8xH45WHQeFHllIOdBqRBMoE2xDQcqT8b:yG9NhA8iIjHllIOdBsc2xDQ/T8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534829, "uuid": "7c3b17f0-d37a-4267-b54c-7a569e97ebe8", "value": 367535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534829, "uuid": "1e3517e0-3515-4b2b-b787-9a72792620bc", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534829, "uuid": "7fafbf47-4ba2-4d9f-9a95-b5c3107caa90", "value": "PO-BE0083.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7278e9f4-af63-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648560219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560219, "uuid": "c4e38226-2fa3-4487-8c14-c754aa950a87", "comment": "Malware payload (AgentTesla)", "value": "bd68049e59f9c5ec7a3db5f12321bc82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560219, "uuid": "1e7b50cc-62e7-4db3-82be-76263a9dcc72", "comment": "Malware payload (AgentTesla)", "value": "af2a20d0d23b377eb67ebe769bf8309ee9af5a153ecf1f4d86323842013cd666", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560219, "uuid": "cbd3cdd7-0514-4332-9c09-f13c64e11a8f", "comment": "Malware payload (AgentTesla)", "value": "47619947e1aa41d3cb12e63fdf7be8a529ce7a93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560219, "uuid": "e5a715ef-b362-4cd7-92ba-4e542c0c4e57", "comment": "Malware payload (AgentTesla)", "value": "faff3740e51ad966dec47881d2a76565ed6eb1b5291f246de2fb9135d595fe2159f451083272cecc2495d64689422b6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560219, "uuid": "abf4d5d8-eaa4-448b-a91a-c3e9827301e1", "value": "T1BC157BA3E7C4A257DA6B0E7DC9E964D3C733653BBE129E0A9508638C1E71643CC15B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560219, "uuid": "ab5c8b31-f81a-46b7-ad8f-148b28927cc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560219, "uuid": "aa23a74f-4999-4d9e-b746-e2a5721180a4", "value": "12288:6YMaxg3Nm2msgwGUE31Zv8H9eSnfdbFeC/7iWeBhkbcEFMLfHUyZA9:PML9msU1keC/7iZvoR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560219, "uuid": "c6e564e3-718c-4354-b3f1-eff7c8018424", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560219, "uuid": "eff73957-be99-4351-9241-2c5bca2b43e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560219, "uuid": "92515b51-83e6-48c7-962b-3c2aab8bd635", "value": "04958765748-4958757489588.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80626d8b-af18-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648528030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528030, "uuid": "14d3d0d7-4e03-4fdf-98ae-0aca0f807079", "comment": "Malware payload (AveMariaRAT)", "value": "6c0d87f501ff12f4a500769f46f852f6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528030, "uuid": "d98afdee-37b0-4d42-949e-e2257d9a9eea", "comment": "Malware payload (AveMariaRAT)", "value": "af76a6f7dd8cdb56461666edd2179ee0aefd6c773bbbbd2b7f55d03326cc6510", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528030, "uuid": "d8bd4722-8149-4313-8515-c7afe3c1d961", "comment": "Malware payload (AveMariaRAT)", "value": "0519c8a6705f455d5d7d0bbe0d469f53843a3060", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648528030, "uuid": "633fb7c5-df5f-4955-8f2f-0a86d9cad45f", "comment": "Malware payload (AveMariaRAT)", "value": "7a67d7ca906a7469b4c2ff94f119122304ff354582f3c2790738dda79b15d42c99aa0166854ee01672b0ac2265eafec8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648528030, "uuid": "d13de02c-e1cf-49e1-ad09-9f142b729abb", "value": "T174C4E01B6BC51B51C4BCB77E43A491A813F0E1CF1621EB2F2DC261E4DF527862B22697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648528030, "uuid": "586bbbd1-b7d7-46d2-9613-5b4fa7896549", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648528030, "uuid": "6d3ffe2f-739a-4e6c-b4fe-b271b7c1570c", "value": "6144:GyXE9ciPA0YXs3UoiYx8HHQXWP+ou+3fkPL55Pl+0d8IsuvC2HHShuTTb/Mr:CqhXs3UoibzWouP55B8IsCC2HHShuLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648528030, "uuid": "bd46513f-fa9c-4dce-903e-effdfa3be4a0", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648528030, "uuid": "76e05216-1487-446b-aa69-dfa20b82033e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648528030, "uuid": "e4e470bf-ab43-4a79-8ad9-09fc2009535e", "value": "PO-BE0083.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0a215b-af37-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648541309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "ef25dfc0-09ac-4c43-ac97-91bb1beff57d", "comment": "Malware payload (Heodo)", "value": "8bfcd833484f4a420c34d7d60d5b0e7f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "81c731f2-d26a-4710-ab76-319d70134c73", "comment": "Malware payload (Heodo)", "value": "af9efd3d3249cec5df8bc6564651be12775b4e5047941efbf8c6f130107776bb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "235dcfd7-c124-4dc1-a293-f5ded9d1b5c7", "comment": "Malware payload (Heodo)", "value": "faf7dd6271c6242cbe988670bef19709fc3d9610", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "9ceadc87-8c3d-4198-beaa-9b6b9dba00e3", "comment": "Malware payload (Heodo)", "value": "c45bfbd7cbf6a1aea76131f310178b0bdfd87f4ce1359194b94ad8e5dadd942733e4879fc2e5cf8c5a188343e15e26ef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "72a84fb8-2810-46f6-8950-db23b65ec562", "value": "T14EC48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "1ecce4f5-1032-42d4-8d76-46f180de4e2a", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "54b564e3-6d65-4550-878c-a0157648cbc2", "value": "12288:iUV7ciwHX3ew9aYU3pWc9inFijaQeL+nZBb:UiMX9IIky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648541309, "uuid": "6c89dde7-bd38-4d60-870f-ff88da25a785", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648541309, "uuid": "213056bf-2042-44c2-a80a-70bacd1fc813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "384e3206-7441-4f9a-bbd0-1fde8fa40190", "value": "emotet_exe_e4_af9efd3d3249cec5df8bc6564651be12775b4e5047941efbf8c6f130107776bb_2022-03-29__080824.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59f2a7e-af7a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648570237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570237, "uuid": "7ec92609-0540-4b8e-99f7-cbedb0ead524", "comment": "Malware payload (Heodo)", "value": "1fbef4bf0fb278163c4a2ae2107d852a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570237, "uuid": "7df2d7d7-d154-40a6-ab4e-8416993a2bbb", "comment": "Malware payload (Heodo)", "value": "b0ab95f144e67491fbba09b159731804385ba3425c6745ea95c39df702dd388f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570237, "uuid": "647525a5-a8b8-4da1-ac0e-31c89ab7ff03", "comment": "Malware payload (Heodo)", "value": "4f553b6e66bb10822b665965d5b27c047c4b6746", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570237, "uuid": "75731bda-ce44-43f3-9f4a-14c02826dab1", "comment": "Malware payload (Heodo)", "value": "50a09e9231708a3f0204de4d804f49aa8aece3c6fb6d19165a26e3fcb1017aef7b7238998d75e96e75e0d80de3ade9a0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570237, "uuid": "9ce55ce5-07c8-4c9e-bdb8-d23595ab63c4", "value": "T168C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570237, "uuid": "c154424a-dba2-4368-927a-c4a1401cf9a8", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCY:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648570237, "uuid": "70d0a354-cc2b-48b5-b1fe-b4aa47137dea", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648570237, "uuid": "48b84aea-08e5-4fec-ba61-c9b4926b6c1f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570237, "uuid": "a4902541-4933-4863-837a-8e23c1cab35b", "value": "Rechnungsnummer-ANPQ208.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b6ca1b-af51-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648552673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552673, "uuid": "8ac279a5-80b6-427e-987e-c85c13379746", "comment": "Malware payload (AgentTesla)", "value": "1f3ee0d61d9e9d1ac63b76bfecb1b1f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552673, "uuid": "1f61366a-c23a-4914-859f-9ecb930e0a69", "comment": "Malware payload (AgentTesla)", "value": "b11124b80e93b2feac01a9c46ed4e515859f006dd2cf44baea25b3d716cdc727", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552673, "uuid": "c776996b-ffb0-411f-a289-d7dd9049e7c5", "comment": "Malware payload (AgentTesla)", "value": "ffec61b8ab5dbaf6c8af079240bfc4cecb74eb16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648552673, "uuid": "99558ed1-6bf0-4be4-9b6c-3b01a5609471", "comment": "Malware payload (AgentTesla)", "value": "2c74e9a05041aaed6c4ee8ffe26008159ae1f7d42c533b0b999b7efa1df0ad4e495896a672a693302504c56549ce0756", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552673, "uuid": "e0888784-f007-402d-9aa8-aa7404986901", "value": "T120B22C159A95C626E9E6CA7DADF231FC067BBE03CC32A65FD9C0FF0D79712440A50A24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552673, "uuid": "453bd533-b4ab-4ba2-9f01-c3f16a66ed2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552673, "uuid": "1356087a-cc88-463a-be34-4c63fb65c968", "value": "96:n8A9b/6xpP3R8untD32zm/FlZUCMqRQIjSZS2FAMwSzx92WK5oFnU:p/WT32zm/lUC3QNBx92LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648552673, "uuid": "53181b37-a7ef-481d-9ab2-81c45287611d", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648552673, "uuid": "bc40fd6f-b074-4aeb-b9ea-85c66c42124f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648552673, "uuid": "c25f6e83-0faf-4fc9-b6f4-043fffde55a6", "value": "ENQ7001377012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd1a72f-af1d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648530070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648530070, "uuid": "f0f41c24-9724-4e3f-957b-ed3ac00780d4", "comment": "Malware payload (Heodo)", "value": "5cc3609a5271a7616c46cddc50d55ae0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648530070, "uuid": "58ce3010-5b81-4132-92d7-85bbbe02b991", "comment": "Malware payload (Heodo)", "value": "b126721fdc42dabc4db3568b25eb35b8f7bc8164d03b6ea5d94cdbe0bcffbd15", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648530070, "uuid": "a87f01f1-22ac-4049-ba9b-543fd6438568", "comment": "Malware payload (Heodo)", "value": "966ef56cde38b8b4958feb662a37e7979f5e8f5a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648530070, "uuid": "b0d8be7b-0c3c-4f0e-9a2e-62ee73081c1e", "comment": "Malware payload (Heodo)", "value": "17ad6ed6fd79c1b1c3f8b3885202e104f6fb629df2ad127763cf9621dc27e51bfe4be4945c56ece6bab7cf91a71dfb73", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648530070, "uuid": "b721436b-af39-4a6c-9d67-347136f149d2", "value": "T1DB84290173C390F0C657A574840FD525ACB7B83C6B18857EB28BA26F4BE79D09A346F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648530070, "uuid": "aa974c8f-e024-4187-966c-e06ce21e0ae0", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648530070, "uuid": "8973061c-4e16-44ea-a7a9-2aa7e24601cf", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7B1yarhA7ArkqBoEimFmF:S54yM33d3q3Z7BogxreNmFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648530070, "uuid": "37b7a4d1-9402-4caa-b72f-131a9d87521a", "value": 407784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648530070, "uuid": "19914378-eee9-4663-bcb2-6429adebd82b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648530070, "uuid": "2d45f648-c297-458d-8cf8-a2804b4d74a7", "value": "emotet_exe_e5_b126721fdc42dabc4db3568b25eb35b8f7bc8164d03b6ea5d94cdbe0bcffbd15_2022-03-29__050105.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7455074f-afb4-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648595012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595012, "uuid": "a3ad8523-e7a5-49e6-a7e7-abdb473ad5ea", "comment": "Malware payload (SilentBuilder)", "value": "bde07d3fda7e807df3385da13f4f8f99", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595012, "uuid": "423ebded-e907-43aa-9999-15cd5762fa1f", "comment": "Malware payload (SilentBuilder)", "value": "b1508583a1d90eee517cfa05a70bd0af91a019d4013d8787a56c9b4587dea218", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595012, "uuid": "af461af0-f9f1-488d-a9db-ddb99a06fcd0", "comment": "Malware payload (SilentBuilder)", "value": "6cf67edb157619300c6bf3502598958e227b0e36", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648595012, "uuid": "b99daadc-e583-40ae-9b7b-8cfcf4967fef", "comment": "Malware payload (SilentBuilder)", "value": "890c90ea74a68811769a105b96cc5c2211b51acb48a5165d58ce399b82d2b3569e1e91d480716f247854083c4650f8c9", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648595012, "uuid": "b9339c38-f068-4255-a3d2-c9e6c6aa4124", "value": "T1C6B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648595012, "uuid": "701508a1-6c46-44dd-b79e-33cccb962230", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMu:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648595012, "uuid": "955ca303-fbf0-4c00-a6d7-13cac9a45e95", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648595012, "uuid": "6c613a86-6a27-4e0f-ad68-5247d6ba91be", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648595012, "uuid": "ce938d8f-0d8d-4fa0-8638-6c5b44590a12", "value": "bde07d3fda7e807df3385da13f4f8f99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd57153-af37-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648541317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541317, "uuid": "83a6a444-2013-4359-bd9a-74906591dc4f", "comment": "Malware payload (Loki)", "value": "3af13a30bd5683778f41a8955c9226e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541317, "uuid": "d8a4a04f-6222-47fe-b87b-55a409875808", "comment": "Malware payload (Loki)", "value": "b175691f3ae7cf1c2f79c8de0fdb0fa798da53a5220892ff65956bc43b01b883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541317, "uuid": "9468a95c-bce1-44d5-b2e6-a64cd6ddefc5", "comment": "Malware payload (Loki)", "value": "81ce8389659aa973cee2f8b5c44056dbff4b8aca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541317, "uuid": "40658889-3850-4591-b5a7-db150c774cf4", "comment": "Malware payload (Loki)", "value": "20bb532743a7d3944e7ceade5408495db235f75df6818ead9f4767da04baad42605260417d31c7bc896eb939314397df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541317, "uuid": "37d743cf-5b1c-48cd-9bc3-841a1d6db9f3", "value": "T1DA25026527E84141EBBD57FEA0B050444B31782B163BE71EC68228FE1F723C19A9B797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541317, "uuid": "335f9a33-2686-406f-9d20-3fc37726bb2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541317, "uuid": "2c9fe8fe-0348-48e7-ad95-2977fae9b282", "value": "24576:wgeSro2G2zaKGSCa8795ZrjSPur4f4/UvvXe+:wgeS0oVnCa29rrjSmrS48vvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648541317, "uuid": "d5d2a5e9-e5e0-4909-9792-ab63ad5ee411", "value": 975360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648541317, "uuid": "d86ba465-8fdc-4e13-960c-e04ec477a3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541317, "uuid": "b87b9e75-ded0-43bc-be2f-a54fad145922", "value": "3af13a30bd5683778f41a8955c9226e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e802fce9-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648562135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562135, "uuid": "677f6653-0f05-4b3f-ab21-a8fe84c75150", "comment": "Malware payload (Heodo)", "value": "5c4014e7ea92e30039b28976c20d2fd1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562135, "uuid": "61e26d84-a5cb-4378-ac5f-bb7bd58fa4fa", "comment": "Malware payload (Heodo)", "value": "b188a45a1f05994b9091d02de0543cf0988a8ef67e2e74c1541dc7e7d5821ab5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562135, "uuid": "1584aac2-5b3b-43e8-80ea-fa3839a0ceaa", "comment": "Malware payload (Heodo)", "value": "fc98f28a3cd02f045ab1a40816271b6b8922de8e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562135, "uuid": "7e426ce0-cd11-4ab6-9024-6b50cbedd9c6", "comment": "Malware payload (Heodo)", "value": "036a3c19fb0275d2e08962672710ea9fd8f831f1d494606f1f4f7908ab5f366acf5d9e46a01b42b8784e1681f84b16a7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562135, "uuid": "e23059c7-bcb4-4913-9d31-cd5574060067", "value": "T162C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562135, "uuid": "57e95c1e-bd62-438e-abb5-c7df0e2940ee", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC8:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562135, "uuid": "4755d357-4abb-48fe-a9bb-21b602820c3d", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562135, "uuid": "e15566b8-fce4-4326-b912-473fe7ee178e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562135, "uuid": "3ea21585-1b53-4128-ac3c-403368b1b732", "value": "Fattura N 0000334-19 NOU 29-03-2022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9d9bef-af89-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648576722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648576722, "uuid": "b9975e17-9b30-4231-8fe0-f88dacf497a2", "comment": "Malware payload", "value": "40ee6ac8f8691ac1da04e2f42cbdfa0a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648576722, "uuid": "2dc09629-c7bd-4ad7-8d08-43f355f89722", "comment": "Malware payload", "value": "b26278bcaa1ed1f8b7f31e7deabb19505b3c193803d98be23d5dcb6405b1ab0d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648576722, "uuid": "abaa5a7e-dd68-43cc-bc06-ee387c3f50c7", "comment": "Malware payload", "value": "dc6135e7087f42cad652092452f8a2644e91a073", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648576722, "uuid": "8ff5de64-f9ee-48d8-b7ed-991365e4895e", "comment": "Malware payload", "value": "d00a2580f2165447cbcd49440df682b17f1ba573f139efe3e5b8492c30edbc881c8ca0b57601d4fd4bf12af915289c57", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648576722, "uuid": "8b08210a-750d-4594-8f92-d226cba48ba0", "value": "T1FCB423294856C455FFEC1EC8B8F8496D085C241D22332B0A267BA94BEACCD77D95C39F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648576722, "uuid": "92a075a5-1f7d-4ea0-a9ab-defec5dce3e3", "value": "12288:0ib9FVistqBH1tdvpFJiGBpQq77hD1u2MiyYrh4Ssuhov6a+4+S+BuN5C:9xFwDBH1rpFpR1SZYt4SLcP9JA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648576722, "uuid": "5efed2e6-1ef4-4b84-8c2f-bd581c365100", "value": 542617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648576722, "uuid": "62fc29c2-e327-4ce7-9475-f0a1c4b1f86b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648576722, "uuid": "c57e8531-bd04-4a5c-bebd-62156c00792e", "value": "request.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d114e03-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648536910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536910, "uuid": "89a23f02-f2e7-4fb1-9394-1288e2bfd021", "comment": "Malware payload", "value": "6f404751820f14dc2a63da5fb6452e20", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536910, "uuid": "8b4edde6-a7c0-49b9-853d-aca557fdcfe2", "comment": "Malware payload", "value": "b2756cd316bc5cb3e9e3a5c22fac41ca319709bea2a8bb3a6fcc8ed29a77b0b4", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536910, "uuid": "63f1a168-c589-4423-8484-155ee1280dda", "comment": "Malware payload", "value": "c5b3c7ec6850290b1fb66ceeb5030c5040ec9e4b", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536910, "uuid": "03edfa06-aa70-4ab8-95b7-a529452ee568", "comment": "Malware payload", "value": "f08b7ed5d59b384863f71087e23e1c84297bab2a6e5d60fa5485aa3d60f99177fe16eba3bba782265ce915acf8a3f208", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536910, "uuid": "fe18f59a-c806-4eb6-8c87-37e249fa9c8e", "value": "T1F692C2352E37B6D8D7B63ABD4B47CE738429AD4C592048962CAD377B03705E988CC636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536910, "uuid": "8420a734-d9a7-4ab9-acab-7dbdfa528803", "value": "192:89TfX9adfWh4Z6lIpK6vIScLyodpEj15ssXH39loQbainmfgZWSBle08xxvPCoHi:ETodfWhoFjcLA3H9laiE1qI7xxZTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536910, "uuid": "9c9a4684-b81c-49fa-93c6-734f67b3b696", "value": 20008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536910, "uuid": "cfee0001-379b-4578-b527-516c093a2cd3", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536910, "uuid": "6d70abf2-7b7c-4c59-ae41-7de0a3416534", "value": "PROFORMA INVOICE 50006.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ffde31-afa6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648588814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588814, "uuid": "19064e11-7acb-4f0c-bdf6-fca1b73a09ca", "comment": "Malware payload (Heodo)", "value": "c6736e73d8bf3ced4a312337f6cd9b63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588814, "uuid": "434955f1-f7b0-48a5-8874-600c72bf05b9", "comment": "Malware payload (Heodo)", "value": "b29d22c4cb2b7637968755a093ee97525bfbf3f021078c13feeed73de44b4d66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588814, "uuid": "0575b6f4-b716-4fd6-b129-e032ca264935", "comment": "Malware payload (Heodo)", "value": "d14cf8e7842a977b938acfbfb5f20d7e56177822", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648588814, "uuid": "7283827c-1ced-4167-a48e-1f46acea9532", "comment": "Malware payload (Heodo)", "value": "587baa283f69cd7503eb2c91a64bb290475a27d154900d2162ac323c4c7b44d2908273a4d3b85f21ec4036356af26470", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588814, "uuid": "0987b500-fee1-49ce-83da-cc3f3c027586", "value": "T1B9A49DC87582C132DE7B4B75C552CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588814, "uuid": "d6eb57ed-63b6-467f-b458-fbc82140746d", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588814, "uuid": "c192fcf6-526f-49a3-8e55-a040decf233f", "value": "12288:myXvaWo3sPddfrkGEpBLsORdPDpFlrh5W:F/as1dDkRHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648588814, "uuid": "6fc3f881-9175-4470-8ed7-c553f959ada0", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648588814, "uuid": "fc35df6a-cd50-4a45-9cb3-0509b4be29b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648588814, "uuid": "39f6d8b4-f65a-49b1-b2af-a327a1760ebe", "value": "c6736e73d8bf3ced4a312337f6cd9b63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b0e78d-aef3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648512088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648512088, "uuid": "699aefbb-9453-4a88-ac03-78c50ffc3d85", "comment": "Malware payload (Heodo)", "value": "a2976c71e3a3628833e3f4372d0706af", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648512088, "uuid": "88a8e770-f3ba-4c20-80b9-8d65d1783078", "comment": "Malware payload (Heodo)", "value": "b39e1bff8fb78c61175fb99a3557fe44b28882d8159b4a8a1f41b1790efeb675", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648512088, "uuid": "25ed3e0b-0aa5-40bf-94e4-ca45761edf72", "comment": "Malware payload (Heodo)", "value": "e95c9d2a343560624730b9f387b40fbbd037d9d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648512088, "uuid": "89094edb-0658-4b41-a9ee-56fb5145b23a", "comment": "Malware payload (Heodo)", "value": "6d820bbcda3e086e5b41ee1e3a93d052f770e398974e4e2b7486911201f4a8a858d213ebf11f8a5331f37a69481667af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648512088, "uuid": "77cf9ba2-fb34-4f13-813d-ab631ab76831", "value": "T1ECE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648512088, "uuid": "3fc2f73c-e8a4-4ca7-83cd-da772b463cf1", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648512088, "uuid": "5211006b-e949-4f33-9cab-34851b2f4f26", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7lvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zrCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648512088, "uuid": "4dc60f62-e8c3-4d22-b8b5-c02c5ddde461", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648512088, "uuid": "c341ac24-51b6-4b49-93ef-dfb5fb754a7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648512088, "uuid": "14c6c207-bb87-4d75-9ac8-3fa9d09f62c0", "value": "emotet_exe_e4_b39e1bff8fb78c61175fb99a3557fe44b28882d8159b4a8a1f41b1790efeb675_2022-03-29__000122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04777bce-af57-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648554881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554881, "uuid": "875f0261-2cbc-467d-a75e-1eb81008fe8e", "comment": "Malware payload (SilentBuilder)", "value": "7ded15db83db5d23dbc2a9b25d3dd11a", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554881, "uuid": "38f18fa1-257f-4700-8dcd-67d57100a3c0", "comment": "Malware payload (SilentBuilder)", "value": "b3a1620126b0a15d9ca719b96d85b12337778826fb67f77ff92f8edbb0a04957", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554881, "uuid": "c03aa54e-d33a-4916-b669-41b699443e42", "comment": "Malware payload (SilentBuilder)", "value": "5633471f65212d4ced3ff9963f64d8d33a4f48d2", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554881, "uuid": "bd5c53f4-b86e-432f-9d8b-3c2baf1afa39", "comment": "Malware payload (SilentBuilder)", "value": "4489d08dfded1b25277e3b218ff94d70a133a5c99bf8d624dc4606d6573a233a6d5962416808346750016b0685a7b71b", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554881, "uuid": "293153ca-5a3d-404c-98a5-008032e41f71", "value": "T116C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554881, "uuid": "61f056d1-a901-47b8-91ec-a9247ba50903", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCs:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554881, "uuid": "13eb581d-a052-425f-8e4e-8760c812ec25", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554881, "uuid": "941b3cbf-00d0-4557-945b-faeb71364636", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554881, "uuid": "5d740241-372e-4d18-acf7-7c9f35a14232", "value": "OMICS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b63b27e-af37-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648541310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541310, "uuid": "98c5df8f-6356-4014-8e38-279909245621", "comment": "Malware payload (Heodo)", "value": "34f7aed998768c0c7e79b9cb297b5fb8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541310, "uuid": "c9a81a6d-e4cc-4158-9cfd-6ca664b2ac9b", "comment": "Malware payload (Heodo)", "value": "b47dc38b925e7da33666145cf681ec60c98261866596ce24b2de5aa5e79d15e7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541310, "uuid": "e3cd94df-68ef-40ed-b5d3-e373ec023790", "comment": "Malware payload (Heodo)", "value": "05fd97c489cf69e7f696c7103bb63bfdd7e703a9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541310, "uuid": "1ebe445b-b222-4787-93ae-89380f372378", "comment": "Malware payload (Heodo)", "value": "47ae5d8e2991b84067c3b994037a577a5db8b7b310c04a12f62c96bdc80f8aaa688b8ec4daa91c8f64518fb33aec5c21", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541310, "uuid": "f15a461e-b698-4618-9fb2-e5bcbeba9292", "value": "T1C5C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541310, "uuid": "4fea250f-d8be-4eeb-ab95-465107c8db01", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541310, "uuid": "95bc2f10-22df-47c3-b2fe-8666d24183fe", "value": "12288:iUV7ciwHX3ew9aYU3p6c9inFijaQeL+nZBb:UiMX9Ikky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648541310, "uuid": "4ba1fb86-baf9-4743-b356-0718181d3cc2", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648541310, "uuid": "5f008a10-a7b1-4fa5-b569-40121fe01082", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541310, "uuid": "8041b93e-0111-4ddd-a009-b3955cbedbd9", "value": "emotet_exe_e4_b47dc38b925e7da33666145cf681ec60c98261866596ce24b2de5aa5e79d15e7_2022-03-29__080823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba45ecee-af52-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648553038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553038, "uuid": "5b2e37f2-653c-4715-8026-5ef53b185ef4", "comment": "Malware payload (RedLineStealer)", "value": "fa0208eea5a956811422a8b25a1efaec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553038, "uuid": "9493225b-4b29-45d8-a039-b15997ea3e1a", "comment": "Malware payload (RedLineStealer)", "value": "b4d62bd664fe913ac17ba94f4f8378d98653f5f9b2873f242d0940704edc1058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553038, "uuid": "060d775c-d78a-4b61-a3e2-7a840131c69b", "comment": "Malware payload (RedLineStealer)", "value": "446572538d0071082de9d8a9c0833aa687e8aa24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553038, "uuid": "eabaa527-4588-43fd-9c99-c7e627e40177", "comment": "Malware payload (RedLineStealer)", "value": "5bf1d04eff796a804a1dacaa2918e131f60584164be2d13c92bf7966c93d545d625fded1cad75b31764964658aa24004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553038, "uuid": "5aa1a826-f32e-43d2-b624-ebbe6c1bd4b3", "value": "T1B8F401413EB46A08E0EA0534D4A2F2747B32BDACEAB0722672FB3E177D330D55952756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553038, "uuid": "9289ebfa-5051-4099-aa4e-c7dc1c459d8f", "value": "b623ee296feb00f0e0865400619e9e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553038, "uuid": "5ae77e0e-8704-4c79-98a0-9739712ea20f", "value": "24576:KgmW0AgU7DNA8JkTUbAuAcGkwcJoD+Eq6V4:KgmRKzSAUgo6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648553038, "uuid": "51b3d4d8-07e6-485e-a818-e9ead29ec8e8", "value": 791776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648553038, "uuid": "a07d8d5e-9af6-49b1-b179-b8cbfafcaf97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553038, "uuid": "a4af65a4-62f6-4942-b538-286285ea341a", "value": "b4d62bd664fe913ac17ba94f4f8378d98653f5f9b2873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb97a94-af73-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648567243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567243, "uuid": "22a450b2-57a6-4898-8e17-f833b3cf990c", "comment": "Malware payload", "value": "5693d1043203033ed77f32b95839426a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567243, "uuid": "e065b747-15e6-48d7-b82a-f68eaa704363", "comment": "Malware payload", "value": "b4ec047f3f903dc0b392011101cdfb299b3b99377cb639b8b5d5a247f3917fee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567243, "uuid": "46d341a7-23ad-44c2-b88f-6241741c95f5", "comment": "Malware payload", "value": "4e18647611a0af3d26561b708f0c2394704911e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567243, "uuid": "ce9fc131-53c4-4c10-b4b2-96ede0ba5c47", "comment": "Malware payload", "value": "538607d1e29a04dc037464428600ab67af9a292a40793003e962d8502c04f100bea76bd8403f27ce679437079dc8cf00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567243, "uuid": "020dfd19-bde4-464b-970a-6aec40eac8b2", "value": "T1FB351260F2A80EBBC62657F9583291506372F72F011DD74E29BA345E1973BC36126F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567243, "uuid": "c13865d4-a27b-489a-b372-bbbfa98c14bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567243, "uuid": "09340be5-708a-41ea-a627-359799289ad0", "value": "24576:pgjjO6AJAR4/4SPeDQvQTkc0Rn0EMCFu8fBeT9np:wa+W/4xLKnFMC48fBu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648567243, "uuid": "4dffc274-cae8-4f3f-88e4-a2cb64f400cd", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648567243, "uuid": "58f0969a-a03e-4b7e-b0d3-a628b3435e17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567243, "uuid": "19ada63d-9ac8-415d-ba44-0ec7ad04cef0", "value": "Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecbc16a-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648573179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573179, "uuid": "20617cec-20d1-4521-936f-4f9ade6c4595", "comment": "Malware payload (Heodo)", "value": "8ea3758285fbd3b16f3d8eaebe860f28", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573179, "uuid": "54dfe99d-19cd-432b-9cac-1fbeef014eed", "comment": "Malware payload (Heodo)", "value": "b5a50efeb7675c5ab63aade3fdd004f85c38846a5c4e74b976b5a89a2f3ca029", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573179, "uuid": "41d48175-4f9d-40ac-835d-a571343b2b9a", "comment": "Malware payload (Heodo)", "value": "cb901f6041e9bb0a2d6529b5449bab748b1692fa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573179, "uuid": "9754162f-4056-4cba-b9e8-7a3bd6282111", "comment": "Malware payload (Heodo)", "value": "5b4981f5fdbd9f59539272c4b652e26507bd5a88d8b60a14b941f620571ad0c90197b87b26c5cb561f9023592a8e1353", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573179, "uuid": "7d5fc4ca-4220-46e7-b1bf-d2e2224d74d9", "value": "T147B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573179, "uuid": "3a4d8e34-2d58-4f39-ac05-22a896bc3691", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMV:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573179, "uuid": "0eac76c5-2fb6-43df-9596-4d127e20edde", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573179, "uuid": "50752263-bdb1-4310-b57e-2df65576d84b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573179, "uuid": "6e39b94d-d0a6-4db4-95c0-c177d93cc634", "value": "8ea3758285fbd3b16f3d8eaebe860f28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fff60b5-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648536217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536217, "uuid": "bbcb6935-dc09-4279-9781-32c00f714020", "comment": "Malware payload (Mirai)", "value": "16eac166ef23041b928bdfb4fec5b8b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536217, "uuid": "fb625eed-111c-4dfd-961b-43888d20fbbb", "comment": "Malware payload (Mirai)", "value": "b5e2d57ae0704ec72f8b0ea0e8eade4eaa426c1cd4b13cff3bb5f83b046a6458", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536217, "uuid": "7bb6ef1a-c066-42e9-8259-51aa1a276bc5", "comment": "Malware payload (Mirai)", "value": "c4d0f2340859f9becec1d9ce1e7971657658c19b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536217, "uuid": "82221738-1058-4226-9d90-8d867bd9ea4e", "comment": "Malware payload (Mirai)", "value": "63ba376bdb5ca9c4839016d5cefd9334671350cb8c4b713df68c8641885f4abd725f3afe33a3d814da5a16bfdecfad5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536217, "uuid": "f3c181ee-9bb1-4c28-8bce-e4d6f3608a14", "value": "T19DF2E07171D34BA0C29CC3328CDF750640149A4ED9E55AF6BBE831BBE872F387928661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536217, "uuid": "3e20f816-4e4f-4c5e-89dc-70e84c6673b8", "value": "768:OI+ZXTqBk9hPBQy2IFDsTvobvwW8t/goS5sQBnbcuyD7Uiyq1:OI+lVBQy2Jt4oSNBnouy8Zq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536217, "uuid": "0500de76-ab28-4e80-b6e0-13dfede43baa", "value": 35000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536217, "uuid": "e9931a41-37be-446b-9730-4765285b3afd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536217, "uuid": "f47801c8-8fa6-43c4-a975-1c07e3875813", "value": "16eac166ef23041b928bdfb4fec5b8b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860baff9-af29-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648535341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535341, "uuid": "3ba8bf00-84dc-4ae9-99f1-eebbaa05f133", "comment": "Malware payload (Mirai)", "value": "04a861e8fb1f43c2ac755cdca5a3b835", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535341, "uuid": "222dad51-0380-4349-8669-dc850f3d956a", "comment": "Malware payload (Mirai)", "value": "b66b2451bff0ad3e72405599cf64d8b8445bd6d35fe7900a8a60940128e32e64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535341, "uuid": "034b48aa-a38c-4343-b57b-a941cd7909e2", "comment": "Malware payload (Mirai)", "value": "4d947118ca9c555182c0fc5b01da0bae7f02e97c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648535341, "uuid": "ab9276ca-3cd5-4413-90a6-54a1548e8d0b", "comment": "Malware payload (Mirai)", "value": "6e4a9460236b90dbc2006a80b1c1dcb8e2f5c714e0912f98ae59be2bbeb514d150eb7b61aaf07564a1d70bbac6875009", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535341, "uuid": "c86ad6c3-376b-4a7b-b63f-389a76b4c53f", "value": "T15F346B227E791B27C1E0A43E11E38756B2EA578D3870C60F7E660D8DBF59A7031132B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535341, "uuid": "4e0002a7-a725-45f8-96d7-2905dcce35c2", "value": "1536:uZGsbmwRtuQZeMylZQBomoYw0tTiTwdUQE+dlBB/eh5FKqRRauEpub/5:uZGDy2m1dUKdl7WzFcuEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648535341, "uuid": "c784d00b-3326-4c5c-8c6c-508564491ffa", "value": 238204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648535341, "uuid": "7bfc959a-a7e1-4af8-89a2-43bc0d77c477", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648535341, "uuid": "fd231d5a-e4db-40eb-9cb3-d9de4d874d0d", "value": "04a861e8fb1f43c2ac755cdca5a3b835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1615f69a-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648536872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536872, "uuid": "ac9f6398-0705-4741-8418-36d5701f89fe", "comment": "Malware payload (Loki)", "value": "17859ce3fd245957c06874fa62257b57", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536872, "uuid": "59d4b042-21b5-479c-81f6-ec0ef7d979cb", "comment": "Malware payload (Loki)", "value": "b6ed7108e7312136935b5f4c9cc2378339f1c2fdcfe3eec6da98ebf12e8c77a1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536872, "uuid": "94076f69-b1ed-45e8-a920-8aea2d936531", "comment": "Malware payload (Loki)", "value": "18df51b4cf10a0d5df757f71c5447e334959ac3a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536872, "uuid": "5640d7ba-ed44-406c-9662-dac9d8990b9b", "comment": "Malware payload (Loki)", "value": "d6d950fd553a2872c8195ff882725541282f78ece3545d940ceee65982b8288b414970f546b5f0c7d4e4ac0cbd5c8d7f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536872, "uuid": "422b3aae-8b02-41e5-a4b2-e7ba101ac84f", "value": "T12B1412582E66994DF13550308EFAD5009533CE6C98024E8A4F1BF318BD73F8B569EAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536872, "uuid": "f424fb12-a62c-46de-80b3-18b2c72e687f", "value": "3072:ywW6ro+CmUJp++xDOwGaS4CLQLRrc3JZWXg1cstsZlQOtcB0D5h0HNv+VfbjK0v6:O6rJUKGD06e0CsZSQw0D521+VfbjK6s9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536872, "uuid": "285c5b83-fbd7-4895-9d96-0cc72ea4b172", "value": 193848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536872, "uuid": "3c689df8-3f7b-4275-a62a-66494066428a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536872, "uuid": "db5bc689-698a-406a-b049-cd23a72970cd", "value": "MMIST PO 4500613481.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67d30c5-af79-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648569863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569863, "uuid": "91d4f906-7ee7-4311-ba3a-5cabfe7c53b7", "comment": "Malware payload", "value": "3a9dceb5ddf6679ebaae360a08be4396", "object_relation": "md5", "Tag": [ { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569863, "uuid": "fd951921-eba7-4603-8139-fc4774325ccc", "comment": "Malware payload", "value": "b79c9b08f8a01e10b930bd7775a2b185049a910255ec0ebf437cea3fce4c2909", "object_relation": "sha256", "Tag": [ { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569863, "uuid": "7d87069e-2d80-4ca3-baeb-22a529e65f7f", "comment": "Malware payload", "value": "23b45b4f9f385550d07b4f8c860ffc5300a6ad11", "object_relation": "sha1", "Tag": [ { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569863, "uuid": "9409a8ec-360e-4b24-8511-ec5c98c42b5d", "comment": "Malware payload", "value": "7c40ee8ff99c270d2b3f0ad250e2600323e1f18a045fb042383304495076b1d76f26f7b1e82e3b57d56e8d473f19f268", "object_relation": "sha3-384", "Tag": [ { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569863, "uuid": "28ecc78d-9d0d-4dfb-830f-0e7f32258f50", "value": "T11E451267D6D2B052C9E4823C43052883691799D650A8FE9848F1FAE72FFF1AE1C5C1BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569863, "uuid": "602b810e-896a-4b50-8846-5a423568f41c", "value": "24576:edM3J1a4NL1SkQDjTC2JCQDjTC2JsQDjTC2JqQDjTC2JzQDjTC2J9:CM5Z+kQDhoQDh2QDhAQDhFQDhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648569863, "uuid": "a59e1fb5-e7ef-4018-a180-5c80b82c1705", "value": 1218913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648569863, "uuid": "14294f34-2961-4963-b04a-9bacee6a9c07", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569863, "uuid": "48941652-d873-4eab-81a6-84a49657c552", "value": "etsieomn.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26dc620d-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529169, "uuid": "f86a35f7-4fd0-45ea-a82b-537ba2b9e9ab", "comment": "Malware payload (Stop)", "value": "58fb4f7bd6ec9a1e2cd0002122101ffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529169, "uuid": "7727e28c-b76b-4683-be26-180140efbd85", "comment": "Malware payload (Stop)", "value": "b878b121123a08d96b205e2883f04cd75f6acd88d7e52a77e5bac139dbd067b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529169, "uuid": "a4d834ae-271b-4e8a-8d36-31f6624fc2e5", "comment": "Malware payload (Stop)", "value": "a49a0bdb90893d6015c4fa2d5c33bed03de31eb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529169, "uuid": "aa02849e-b982-43c7-9646-b2b3dd386890", "comment": "Malware payload (Stop)", "value": "0e495a42d2ddfa0f0cd07f2d0654136c657a8c836f5e7b2e3f3a994e66381e6a5cba71dfe98bddb9e216cccea118f4c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529169, "uuid": "69e4f4f0-81c3-451e-8038-bb1c0414a2d8", "value": "T11A050100B7A0D038F1B311F47876D3E9692E39A19B3459CB62C66ADF66346D0ECB531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529169, "uuid": "a3695df4-7eea-4383-8220-1cb1b636827a", "value": "5761b9d43ffb6d646c886cb4b6f3b2d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529169, "uuid": "a6ca68f1-c778-4f8a-aef7-d0fb98392c0c", "value": "24576:8310ki8zPYVppNMjZgbzTZSfifsvdxcy4uFZG:v8zOnNeibz0fkGbnFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529169, "uuid": "2320a9a0-1683-4532-9cca-520d582e1653", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529169, "uuid": "b1e9a416-9dc0-4ba4-910e-11437144db5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529169, "uuid": "da9217a3-47ec-4d4c-bd91-c88309a38489", "value": "b878b121123a08d96b205e2883f04cd75f6acd88d7e52a77e5bac139dbd067b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6590ee-afb4-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648594997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648594997, "uuid": "2c160b41-b56f-411b-a87e-9b3df74086cc", "comment": "Malware payload (SilentBuilder)", "value": "b8685a0dc551a23a35ba8adc0ac7c4d5", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648594997, "uuid": "2d6c33f0-7af1-4c95-a6f1-8e01ca508ec2", "comment": "Malware payload (SilentBuilder)", "value": "b8c49a9df5c1a3bc0537ffe1119107d04df77d72c06ed2e3fa7ebd2c7ca0b584", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648594997, "uuid": "05610ab1-5f4a-4ce7-b5b8-3e8875cd3db2", "comment": "Malware payload (SilentBuilder)", "value": "5d83051c349fcf69ecaf512d008c9a56349821b8", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648594997, "uuid": "e2423146-cdc8-47a3-8245-5ca0239b2031", "comment": "Malware payload (SilentBuilder)", "value": "c0ee882f6df6905ce82f91fb94a32fba24dd34a3e2415398cebdff0eb170ceb7fa18735c5913b9081b68f82c19f02153", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648594997, "uuid": "04b2be7c-556b-4f53-ad88-59077389a577", "value": "T18BB39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648594997, "uuid": "497b9a23-3aec-4208-a1e4-1ba9add72018", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMO:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648594997, "uuid": "2b92a0ee-e8f7-464b-9f22-479615c0798f", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648594997, "uuid": "a354d973-6489-43a9-bddc-2709c4b8ad42", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648594997, "uuid": "06c84142-7b65-4037-aa84-ecae12a65025", "value": "b8685a0dc551a23a35ba8adc0ac7c4d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd60f658-af5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648557016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557016, "uuid": "e683b29d-eea3-4ba4-98b0-708c94f66138", "comment": "Malware payload (SilentBuilder)", "value": "b0dd04d6e57f9a895e385702f7838322", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557016, "uuid": "6465fde8-2b7b-4374-bbb7-20cfbc2ea79c", "comment": "Malware payload (SilentBuilder)", "value": "b8d8780847175c208d32b84ca23b9ac444abfb3c233f40479172cc36b708191d", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557016, "uuid": "e5a23765-374d-4e69-bbf0-09d0b79d0f2c", "comment": "Malware payload (SilentBuilder)", "value": "7246047db4a8ca351f9743958ffaa45ff453f90a", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557016, "uuid": "f833ab85-3bb6-416c-83e6-dcf51df52002", "comment": "Malware payload (SilentBuilder)", "value": "d9a1d85c536d8ca78ed0476a1a866c564200593ac51f655d31f58f6ef13244ac86cf7a983dfe522f68ad9c242f65d93c", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557016, "uuid": "68bf78b8-b3ba-4ddc-ac80-01f08fefa84c", "value": "T1F4C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557016, "uuid": "2b5178f1-976e-49f2-87cf-64741b044a5a", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648557016, "uuid": "4bf5547e-aafa-434a-b70d-16acf3561ab3", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648557016, "uuid": "86bcaf9f-c2db-4f19-9f32-b10fab584bcf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557016, "uuid": "8d4dea28-6fcf-483a-9d22-b9fbd1748c8b", "value": "SCAN4469_00016.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a04fdcb-af2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648536234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536234, "uuid": "76d7e188-d5b3-429e-87dd-cd1742095660", "comment": "Malware payload (Mirai)", "value": "22c159b78bead2631ae3a9e650ba502f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536234, "uuid": "af38ab15-5444-4a62-abd2-6b25045553c1", "comment": "Malware payload (Mirai)", "value": "b953d8cd7cb97b8266bec6cdbd450d79ce2cb3c4f0cb13e005e11328e14fe8e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536234, "uuid": "fc107a19-0c4c-4a0b-b2f4-c2e8da0a4ab7", "comment": "Malware payload (Mirai)", "value": "0c802fb27d668d629c130ad309ced01f86a409e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536234, "uuid": "cc26b04f-b86c-46f7-b693-3af655cdcf93", "comment": "Malware payload (Mirai)", "value": "d4ac42f1488c5631fdadd07230ff15872d681144289149765c65691ba56d694c1d2d90a4d9c6e31579444e16f06b52d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536234, "uuid": "b53da43d-603f-404b-ba5b-c021961ea146", "value": "T17C03011A030761F2C2E6927683E1933B4E326DF760C3594EA5667BE2AEDF4B545C40E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536234, "uuid": "df20a026-1a9b-40ad-9f3b-711006741691", "value": "768:2HBOxt5hwZJcUyyFGLRfZlabuNLjwRMaDIhJ+NXDeKBXQJgGlzDpUYsvj:2Hwxt5+ZJcUTwLNHaGBaDIEXiKBXQVq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536234, "uuid": "11d8a8f9-e771-4e6a-9661-94627c39d79b", "value": 41008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536234, "uuid": "125cbb42-f6ec-41dd-a520-3d78505c2775", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536234, "uuid": "130fd366-6a21-44b3-88ca-f8e6068a3770", "value": "22c159b78bead2631ae3a9e650ba502f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946fcc09-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648537084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537084, "uuid": "9f4b8455-8fa2-48b5-bc02-9e0152f1a5a4", "comment": "Malware payload", "value": "42eaaaee46e8a50e93f6618aebc3d03d", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537084, "uuid": "bc71bdfd-15ca-45b3-b0a6-004cdd6413af", "comment": "Malware payload", "value": "b994b4743d542e807804f8a707b9395f7ede2731c61e0b3eb5dc8f2e00db6e49", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537084, "uuid": "cbee9743-3c2d-46de-9a79-e432882fa401", "comment": "Malware payload", "value": "9c4c65d8e07b16a1fde75d3cbf4a523e8f8efc0d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537084, "uuid": "cb16f17f-1770-4605-af99-ce23c01b4465", "comment": "Malware payload", "value": "aa39987ebbe8ebdcb1e285d664ae78568b7cd38639290f8cf62f0cc97b2a7dc0b77b3901ecfc861d8ac8754dc4729644", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537084, "uuid": "e7e8d9b1-6636-465c-9625-7c2a7e411301", "value": "T14A14127FFFE07691FAAB8F346BECD6802B95DE80552EA2A30B053949403C796F255407", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537084, "uuid": "2eb43d44-3953-4120-99ec-de73cd69eab3", "value": "3072:3/Ye9zOYy8ZJuoUYYQ0Exrzpiuf9eRoPnfG7WFFYKDMEa4cgxJmxXyBTzCFJu:vpzny2fogXLFCKRanyBvGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537084, "uuid": "74685490-e185-439d-9847-e805abae1620", "value": 192312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537084, "uuid": "fb02789e-4050-41e4-9c9a-02b8debae5ce", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537084, "uuid": "9c9fb129-6c4a-42f0-bb3e-294aa264d03a", "value": "Rev_270322.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b679de4-af6e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648564825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564825, "uuid": "87468b59-c1a7-4c81-8e98-9a77895b4e40", "comment": "Malware payload", "value": "3351b2116ce0ea86086b6a8206023d3f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564825, "uuid": "29e07dbb-c321-4f28-97fc-50ef78490308", "comment": "Malware payload", "value": "b99ab3614725188126b3ed6acda847295264903c71ca6e41a15231093babfc31", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564825, "uuid": "2710c9fa-8e60-4e95-84d3-d0ecdf92f2ea", "comment": "Malware payload", "value": "d9985f2d48bfe8129da74afc4dfa2faf65c38794", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648564825, "uuid": "c682e547-8ba3-4270-bc9f-c379cd1c30e9", "comment": "Malware payload", "value": "83644155fde42ca7ae38771bf8dc1202c83b0de49adc3f1f6302eac029a6b423ff886b0a7201f61c42a17c28dcbc6fda", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564825, "uuid": "70203feb-bc9a-4062-bd8d-482765d9d663", "value": "T17AD4BE417B81C0B6C25E31B14557D27962E9A9709F3897C3BBC46B3F6FB81C1993832A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564825, "uuid": "b9abd743-f01a-4227-acf4-5aaac6452a36", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564825, "uuid": "6d28e50d-7142-453a-9a65-0e3fbd47a7b4", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKYKDYjX3rU/:ygHpbVy97v0YjX3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648564825, "uuid": "47b6d49c-3112-4f6e-9da3-7ce92c2b9ac8", "value": 602506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648564825, "uuid": "2df87046-51c8-4317-b7da-3bdee50eccf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648564825, "uuid": "358b41fe-9aa9-4e39-bacd-8a9c194d318b", "value": "emotet_exe_e4_b99ab3614725188126b3ed6acda847295264903c71ca6e41a15231093babfc31_2022-03-29__144020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd57087-af42-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648546010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546010, "uuid": "a7014e95-f0da-401f-a909-c4c6d4e8f5dc", "comment": "Malware payload (Heodo)", "value": "0458147a142efe9feb16ae33b8f2b7a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546010, "uuid": "2292fc0c-be8b-414b-81cc-f30ba9bf024d", "comment": "Malware payload (Heodo)", "value": "b9c82269738da95b8d9779d80600850db60047355763240bde5ab96547f671ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546010, "uuid": "f226506a-4db1-485d-88a7-441fc54c4514", "comment": "Malware payload (Heodo)", "value": "5ce7706c2e1482600e748fa2cdafaf4e39e35c30", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546010, "uuid": "35d42baa-dd89-4796-9bf6-72ad2065b699", "comment": "Malware payload (Heodo)", "value": "ca4d3c49946b551e00853252cf4f9e7436dc8f5894dacc662eac850a7edc8806ed06f8506d8d24d52ca946328933b078", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546010, "uuid": "cafc8da1-9cb5-4371-a283-a85a99f83b18", "value": "T1E5E46A22AF5740F4D89F0C3945513288AD95FF46EBA8B77ADA39728D35B20534E3884F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546010, "uuid": "2b19f9e2-84d4-48a9-a9a8-d00cd37b082f", "value": "b39d2fd2d18c2cfe493a1e089561b46e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546010, "uuid": "191bcdaa-abd6-4ef7-aaae-38b9c5cb2da7", "value": "12288:aX5mvP53RTqtl79F7Unrymfxbm1nB0hoxxUI/:Ac53RTk5Sxi1B0hGxUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648546010, "uuid": "c691c61b-f564-4199-9a13-3edaec8065a4", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648546010, "uuid": "99ef66c4-cda0-46b5-849e-87e5f5cef467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546010, "uuid": "23cb4aad-d944-4c19-9e2d-940d5f0b7458", "value": "emotet_exe_e4_b9c82269738da95b8d9779d80600850db60047355763240bde5ab96547f671ab_2022-03-29__092645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02090b1-af2e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648537667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537667, "uuid": "e1ff18a5-6742-460d-86d2-6e05fbae45ed", "comment": "Malware payload (Loki)", "value": "819b4c7c0922d5b882f74fab0ead1e4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537667, "uuid": "1a5e5dab-e234-4d9b-a2e7-71b9d0bc268b", "comment": "Malware payload (Loki)", "value": "b9d518ec7f1282ba657fe75fa1f9ffae78998050044296a35bda4f038cad61a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537667, "uuid": "fab6a074-bff9-4233-8cc3-5de0afbe1f45", "comment": "Malware payload (Loki)", "value": "b7010f70028bb47dd611b755d08aba44100e21cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537667, "uuid": "dcefee77-6d2e-4374-9b7b-29c98cbf00f7", "comment": "Malware payload (Loki)", "value": "a6650db32dd74d97b321e3f3732082cefb74e0cb1b8fae6d959a1ede62baaec36af430087d9071ba046a858bf17032d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537667, "uuid": "e41f73d0-76f4-4391-bf84-e9abf86ee705", "value": "T10E54BF227985CB32D55512709816CFB51AEEBCB05C248A8737D83B0EAF373D29A6534F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537667, "uuid": "a46ceadb-56ee-4ec1-b3e5-fc7ca56566e7", "value": "8ee4f2cace7854793aad420556d77bc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537667, "uuid": "e26eb436-e621-4495-a8c7-d226b077313f", "value": "3072:xhUwfdEaSeui/s9LOYnNw260TQz0yxMpxjBmTJ29fF5iH+o30K4M/h332l:jUe/Zui/s9LOuNhmYVpOVuI30Rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537667, "uuid": "97ba38c4-761b-4d00-a4cc-585ec11a9ca5", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537667, "uuid": "5b613590-af44-4270-9117-f870ea05d851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537667, "uuid": "ff442645-ce27-40ef-b7a2-28a873f6f707", "value": "819b4c7c0922d5b882f74fab0ead1e4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72b3083-af33-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648539692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539692, "uuid": "189b7a63-1f15-46c2-8748-43a8b66236a8", "comment": "Malware payload (Formbook)", "value": "2a65dce1dcd3f231220e06847a523596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539692, "uuid": "8ad2fc01-7f8c-4019-842a-e3c9b051ab52", "comment": "Malware payload (Formbook)", "value": "ba347c1008ade9d22ce86ffc99ad1b8d8bb3fe4d392d911e8c4c2f2a11c98f13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539692, "uuid": "0794647e-b0fa-4175-9fec-1eafe1c97173", "comment": "Malware payload (Formbook)", "value": "fac6b1dafa81038397699ac36baab5ea94a8ff30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539692, "uuid": "c750fec3-4f57-42be-8fc4-8dac8b3c722b", "comment": "Malware payload (Formbook)", "value": "502980c0aa6860833eb1fa5f631b72b5403264b432109d66e6ad2540a09d2ebcca09f5a472166eaa9c4202e23afc7386", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539692, "uuid": "c8790df3-58fe-4d24-a384-7c976ca661bf", "value": "T14735F06277DEC402DA7D57BB84DB80004B75BD1B8533E70E79C833ED0A22782695A76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539692, "uuid": "5ba5c7c7-11fd-4866-99c0-9c80806d4154", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539692, "uuid": "592b80a2-050a-4f96-ae2b-27a4adc44643", "value": "24576:NL1aqFf+59o/mFzxiu2IZjJy8ek6IIuuqWwxBd/7Kd:RFf+TFzxn2+j0m6IV1xBJud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648539692, "uuid": "3faecf2d-7cb9-43c9-97d1-ca7957263ba7", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648539692, "uuid": "6811a3bd-a984-49ab-9c2d-5b28ae00a357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539692, "uuid": "754bb6ab-bde2-4236-b7d8-b1943aec9095", "value": "2a65dce1dcd3f231220e06847a523596.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cbc517-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529174, "uuid": "ce0eca59-3752-412b-97b8-d5cf47b9d971", "comment": "Malware payload (Stop)", "value": "98af8141160486e85f067ed1605296de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529174, "uuid": "9106c794-2aa5-4be4-89fc-38095d70c109", "comment": "Malware payload (Stop)", "value": "ba63e0c94bf44bff7df015864e9e30257018b4a59a1ec6f42741e1a00d4043a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529174, "uuid": "6127bbe6-416f-4fc1-a136-d03118ae3739", "comment": "Malware payload (Stop)", "value": "4dd6b126576839a64f40154297e9af4793e081bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529174, "uuid": "d39b937e-d6b1-4731-b827-e57be6fd5538", "comment": "Malware payload (Stop)", "value": "e2552e605e6daf79c327527c2dadc03dc9fe55ea611cb992309386faac3df760b4db9af55d67a67cd26c7be7c3fd334b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529174, "uuid": "b39037b7-1684-4740-9a21-443941085c61", "value": "T1B0050110B791D035F6B366F44ABA83A8743ABDF19B2454CB22D97ADE56346E0EC30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529174, "uuid": "0864f549-1969-4d58-b1c2-c52a4c2e5f6d", "value": "62cc0f071500a34baf4b74c917ef3797", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529174, "uuid": "8375d15c-5869-40d7-b4bc-29345a02147c", "value": "24576:JHN5toRiRMKoJOItHAePF520yozBW6vo/YxUYH:JrSYItfFkAzBzvgYlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529174, "uuid": "1d76e95d-90a8-436f-8f06-bbef64469155", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529174, "uuid": "020bbd97-ebb8-440d-8e17-b026d5ee5a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529174, "uuid": "20b5ee8e-d083-4c2e-a9fe-ef427e2a1439", "value": "ba63e0c94bf44bff7df015864e9e30257018b4a59a1ec6f42741e1a00d4043a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca9ca01-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529178, "uuid": "cc5f18db-98c3-46d7-834e-aa9534e5713e", "comment": "Malware payload (Stop)", "value": "6bc1224ed22ecf2caacba371c7dbac55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529178, "uuid": "086cb31b-2f00-4012-9810-7e386ded71bb", "comment": "Malware payload (Stop)", "value": "baa36a93088b6dc0c08ff2c877f92ecd7a84314c5f9515b1108f13bc116ef1ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529178, "uuid": "4c45ebb4-923c-4091-bebc-96bcc4eaf28d", "comment": "Malware payload (Stop)", "value": "e2734f5030b294a6fa538bbb117e564ff11fce59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529178, "uuid": "0a503e05-63dd-490c-a872-2a9a209321e8", "comment": "Malware payload (Stop)", "value": "f8132cf2832dbf6fe3295d4386514f70840463df331981e3a015fee120afb839a3f206e2fa29d992de17cb649564c809", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529178, "uuid": "b954c55b-2191-4515-8d17-a2d1aaed67fb", "value": "T1E7050200BB90D035E5B701F44ABA93AC653E7AB15B6194CB72C61BDB1A357E0EC3139B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529178, "uuid": "9d07863c-cadd-46f0-a93d-a0cf680dc718", "value": "5b781a7e94da324fe985d05bb125d645", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529178, "uuid": "99daca65-7660-4d7e-ba85-f46812137bbd", "value": "12288:jjosbJHLOxDij9S8WABHLXOf0zab5Hwo1NERWD+vidz3p4v0FGkTX:LFCw9SIJi0zab5dbERdmp46v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529178, "uuid": "7000f619-5244-40b3-8945-68b8fa64f767", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529178, "uuid": "06309309-6f4e-410d-ab06-600b19f0d948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529178, "uuid": "5038d6c9-d6e7-4c4c-9c8e-cc377641fb5f", "value": "baa36a93088b6dc0c08ff2c877f92ecd7a84314c5f9515b1108f13bc116ef1ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c6093c-af5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648558047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558047, "uuid": "9c60f9f8-fe82-44c5-8bcc-2605dcc875c8", "comment": "Malware payload (Heodo)", "value": "3b11a40e721dc4d5ed7b931b6f707001", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558047, "uuid": "fde99007-399f-428a-a930-8571be98f07f", "comment": "Malware payload (Heodo)", "value": "bb01a42f1b01a2d94a33b0cc9d192a2b5b447289133e12d92b619903e87c7086", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558047, "uuid": "e3dae6aa-3c1d-485f-8f94-9df46b70570c", "comment": "Malware payload (Heodo)", "value": "57ca7ad538b26c8830a3d1a9c14108029dcbab17", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648558047, "uuid": "92707879-32bb-4b4d-9293-7a97f1f4ed51", "comment": "Malware payload (Heodo)", "value": "7e5ca99c559465f1ec74acea38de52ee0722233e3fc651866b00b2499d9030942b05ec5a3231de4dedcb30c24246fffa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558047, "uuid": "1c2e16f5-ca04-4b58-ab29-26c100cf15e0", "value": "T1C4C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558047, "uuid": "8d0e9573-c217-4466-a960-aca48d8be448", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558047, "uuid": "9f9c64f3-fa72-4a60-9576-9a43fe5a9988", "value": "12288:iUV7ciwHX3ew9aYU3pxc9inFijaQeL+nZBb:UiMX9Ivky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648558047, "uuid": "b7ea1b94-fab3-4f08-a4ca-40987cab5221", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648558047, "uuid": "8e3807a9-a562-405f-bf1b-3f69b671ae9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648558047, "uuid": "d7b0eac1-4dbb-48b9-af59-60333087e0d1", "value": "JxZvEZ.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6abf25-af28-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648534953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534953, "uuid": "1cb9ef82-2a6a-422c-bd55-3bd8395c0713", "comment": "Malware payload (NanoCore)", "value": "4b4a0e6f2a53c780ab4c4bca1eac8f8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534953, "uuid": "56659eea-3e50-4adf-a52a-35b2df6f78f0", "comment": "Malware payload (NanoCore)", "value": "bbb315c1891ba28751b63b3de7d5a0a3767ca1170820c9804613840ca5e5d200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534953, "uuid": "8adc9c86-7f11-4418-b548-08185ff6c319", "comment": "Malware payload (NanoCore)", "value": "5e2c06fc4b3395b858f47f260970655e361f2c34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534953, "uuid": "4ac6c26f-735f-4045-ace3-631a999f742b", "comment": "Malware payload (NanoCore)", "value": "69ef47fa01739c0f4bdb1b9ceb15515ea0b957458362a10bedeb88ec0ea5befff4abaa94b6f42b626a1109a237e3553e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534953, "uuid": "aa7ae343-76b9-403e-afdb-026efd477880", "value": "T17135021527A84251EABE6BBEF1B084204F71B9275167F30EDA8124DE0EB73C19A5B347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534953, "uuid": "03e80f44-c1a8-4fb1-939e-2396beab367b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534953, "uuid": "e6f765ab-7520-42b7-8910-6363d0a687c8", "value": "24576:cdeL78ZjTfKQfZf8PHqp4vlksEGqNe1iKJ8r0+65KBCUjBTnW:cdeH8ZnGPqp4vl3qCiKur2OQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534953, "uuid": "a6261db1-16c7-4eba-86ab-e1b6ebee1ea5", "value": 1076224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534953, "uuid": "61ffe959-2fbd-406d-a5fd-a2bc27606704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534953, "uuid": "a53767cf-03ed-406c-ae7e-3eac588817a2", "value": "Order ConfirmationPDF...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e04ca6e-afa2-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648587243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587243, "uuid": "7af6abc3-074d-4205-bab7-15e2ddaf20ca", "comment": "Malware payload (SilentBuilder)", "value": "7e5e2fe65022f5a37aff86ab9249c5a1", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587243, "uuid": "c875407a-252a-48b3-b42e-e8f468cdf79f", "comment": "Malware payload (SilentBuilder)", "value": "bbc1337630f46853905e7fa804eb8bf2b3644f3a16a1911ea1fbd7fe1811c1ec", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587243, "uuid": "2b0d3436-1fbe-4996-990d-51bc12cc7c07", "comment": "Malware payload (SilentBuilder)", "value": "93e0fa9f4da7fb488fb0474af6c06433de5c2e1a", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587243, "uuid": "c280765a-b43a-431c-89f7-0c8102696117", "comment": "Malware payload (SilentBuilder)", "value": "dc95ed28dbecc238d8c73402c7fc988d2dbe9d7e2001402ff943d05ec0395a8290ae44483e599e31c7e71ef048707a91", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587243, "uuid": "8ae0aee4-0775-4272-a22d-eddcf7686005", "value": "T19AB39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587243, "uuid": "006a1df2-c046-4389-81ce-7888e3e0d175", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMi:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648587243, "uuid": "9a3655dd-bc99-403d-ac36-f0959f347e55", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648587243, "uuid": "f4847043-d70c-4568-8b56-e9af6cd9f37e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587243, "uuid": "6e1bc7a7-7e07-4307-b739-7f75aab16b61", "value": "7e5e2fe65022f5a37aff86ab9249c5a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3d186e-af08-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648521123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648521123, "uuid": "69851881-077f-47c3-ade8-64ca01ae82a8", "comment": "Malware payload (AgentTesla)", "value": "1f8caeb897c51852728ed27622654ac8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648521123, "uuid": "11dca45a-8af2-4d50-9727-f53b2e97324b", "comment": "Malware payload (AgentTesla)", "value": "bbd568d64ddafd7cdcf62bb8ac92292680d8028f44461d84235db8f8e357b12c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648521123, "uuid": "93f2de5f-9d68-40ec-8b5f-bd4e0e70556b", "comment": "Malware payload (AgentTesla)", "value": "bfbd3603376bad8685bdfdad36ab0eaa3dae684b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648521123, "uuid": "65000854-6cd3-45e6-ae86-1fffce876c09", "comment": "Malware payload (AgentTesla)", "value": "4c467c0cc903a927254cbad14640818cc231074f6f322cd367519ac12eea8a705b91d089069445a6c690933f0539e746", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648521123, "uuid": "5b177aca-bf08-4ec2-a748-eedd5bf4a2c1", "value": "T1C1F4C4ADF2F076EFC857C0729AA85C68BA5175BB531F4103A02715ADDA1C887CF14AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648521123, "uuid": "6ba4b6e3-1852-4bc7-b43e-e846991f4eb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648521123, "uuid": "23a424de-86b2-421d-aed1-fe312990d677", "value": "12288:FwFWz/PKigvElERlg8J75fj/tJexGooyynZZmOPVRX9sd/xgjjgkkKqQI/vgCY+Y:Ie7/xgjjgkkV3/vg55xHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648521123, "uuid": "c9756e45-4d39-438f-832e-591f32ac42d3", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648521123, "uuid": "18e064d7-41be-4375-8cc1-ae538649d1bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648521123, "uuid": "bef12d53-0f75-400d-8f0d-aa542a8f4269", "value": "Payment slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924f6ce6-af26-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648534073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534073, "uuid": "fc71438a-88a0-4f58-a71a-95a1b2014567", "comment": "Malware payload (Heodo)", "value": "3a8710c08541d1a58664085e8c9f7739", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534073, "uuid": "a3f7ed68-cf3d-4370-adc8-a5abf744e26e", "comment": "Malware payload (Heodo)", "value": "bcb0d792612c55fdced7b0e1123673a75f3be7f266d7cefbed8506ef392684cd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534073, "uuid": "2fa9b7b0-f39c-448d-9592-ea03fea9b0da", "comment": "Malware payload (Heodo)", "value": "81149db7aecefa5cd9f62778170301a315e8ae34", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534073, "uuid": "0c065459-bf76-4501-9de4-83af937103e5", "comment": "Malware payload (Heodo)", "value": "65d43fb5d0dd03588fa7a5a034d7422c45d1495641fc959e477b74383401aa608711847abcafc0f38b1c51f406d52d58", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534073, "uuid": "19164a26-4da4-4f21-9b75-85787699989e", "value": "T1FB746CC237E180F7DA6255313EE386466769BC644E328A937354BB8DEA31AC3E536740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534073, "uuid": "f6ae2d81-f259-4f42-aff8-a691764ff91a", "value": "72b3528e45595fafbd5f24ce92204592", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534073, "uuid": "6ee58006-38c6-46ef-a3e0-0be1e57fabcb", "value": "6144:1PHIFvHxVBxWrhtOjMcD+t14e13gvXr7fa+CYS0uWy:1PoFPxVB0r/OjMciV1yja+3rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534073, "uuid": "8b3f3d10-b5af-450a-b000-6ed1ddd9eea9", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534073, "uuid": "67603117-6bbd-45b1-a764-dfea2526c463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534073, "uuid": "160900c9-81f0-466b-9be5-87fbb713e92d", "value": "nvicozx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c7c42a-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648537039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537039, "uuid": "96d59b5f-0c29-4907-9db1-c3d7bc7fa864", "comment": "Malware payload (Formbook)", "value": "b5c9ce891f1fe34cb5f13d51e071a4cd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537039, "uuid": "4c0a0e02-a90f-47dd-ac22-bc3cb8bcd837", "comment": "Malware payload (Formbook)", "value": "bd9c0b236ef6fed513c5d7bde31e17d1da5f1ab105a4ef11fd8a040d4cccb6ca", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537039, "uuid": "bb0c9404-2ab3-40c7-a321-45486a28210b", "comment": "Malware payload (Formbook)", "value": "2b2b78efb0179c5c2972c0fe2345f2dba4b2f658", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537039, "uuid": "5c299979-db6b-470f-ab53-86040637b20a", "comment": "Malware payload (Formbook)", "value": "1a14e26aff5922f4736aa5133284bf3ea176868bdd5355ae805092e2db31e37af55708202e3b2ea61f989fbfeb7d32c3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537039, "uuid": "677eddd6-86e3-40fd-b8b7-2e38103f37df", "value": "T14C1412D43A98A048F75D8B7709D9EC719570FE496B442B19D923728E9B32B850CCFE23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537039, "uuid": "f8395f96-86b9-4b51-8eb5-962335fedeeb", "value": "3072:YkVJXj0YJrKUiGoHlOokHkam/NSRjXoZT5sVzrrGvutvWRHUWZcEtMWr7qzlxTta:RvoY5DVQlOokH8FKYZT5ssutvqVZPP7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537039, "uuid": "d8907b8f-8591-4dd3-9942-e4e8a2ed1d02", "value": 193832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537039, "uuid": "bce51049-ff99-4d30-8213-189d41f6aaa3", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537039, "uuid": "3d1630f2-28b7-4fec-bda8-6cfabec8e01d", "value": "XINHAN PAYMENT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b894481-af1f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648531082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648531082, "uuid": "cd886656-a3fb-42eb-8e71-5747e83b73a2", "comment": "Malware payload (Formbook)", "value": "5c03972f42ba745b65d1d200aa5a8f45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648531082, "uuid": "9437497f-9d3a-4348-bbab-71697c91db60", "comment": "Malware payload (Formbook)", "value": "bdfe2908b1cc8e3956a0bfa91570cda9ee128dd9baa74d019f2a8f969e92a9a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648531082, "uuid": "ed7a7ba6-296d-4354-b079-3ca3d5bf577d", "comment": "Malware payload (Formbook)", "value": "c76dcf1d1650a34b92a3bca0125c20e0d6033f84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648531082, "uuid": "e6fb3848-561b-4bad-9ebf-1f51012b2e7b", "comment": "Malware payload (Formbook)", "value": "acb320ef01107eeabf5233c1c240f61b71791338d51e9f32ce6cb718f3b346a81f66a0b9e964f8588e2f03045a45ad00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648531082, "uuid": "62877aae-fc31-461d-934c-78a5ecfc0fa9", "value": "T137F4B3ADF2F075EFC857D0729EA85C68BA5076BB531F4103A02715ADDA1C887CF14AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648531082, "uuid": "df0b8794-b9cf-404f-a15a-5856b503469f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648531082, "uuid": "65dbb68a-baa8-42e2-b7bc-d4f60b782191", "value": "12288:hIioZw4X7KgL41wK/5/ehIO6vVnWjMu1jXVKlKIW7876ibXIXkS0DGctPnloBhXv:hnoZwUGT7gjjdKiiNh0JhfPpc9CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648531082, "uuid": "56461a44-4386-4843-8793-f94d37718105", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648531082, "uuid": "feffa0cc-37d9-4426-b729-9eeb29b80b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648531082, "uuid": "4f3dacce-86a2-4011-b7fa-bac1200ec843", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f81cf90-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529183, "uuid": "39635a56-ca12-4faa-b354-5c050fca6cd1", "comment": "Malware payload (Stop)", "value": "0dccc0f0db9892ba6a66d1a66af5781e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529183, "uuid": "dc6b5290-cf3c-4735-af9c-5585d5435a25", "comment": "Malware payload (Stop)", "value": "be4a4943231d5aa88e6be315fc823b755c0a818eebbd3380d8165d0a6527eca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529183, "uuid": "6ddce1f6-c0cc-47a9-83ba-44fc3ea3fe79", "comment": "Malware payload (Stop)", "value": "39839143c5ef0d2a336da3e9bc6dbe7a4c0cb727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529183, "uuid": "1069dbc3-0aab-4b58-b656-5ffe152ad5c9", "comment": "Malware payload (Stop)", "value": "cd9ea60572f97515398138e487dab438d31c459eedcd14a27cd5abdd18c5a9e48785d4d84684cc2895f89998aa7a68ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529183, "uuid": "415e0ed4-b972-49d6-af89-fabee14408be", "value": "T1C6E423665812A8F3DB40B834120FF4C75982BE536A6A36A31DD2F10C95B29D6FF4DB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529183, "uuid": "94cb6849-4ff9-4be0-bdef-37df3192fe72", "value": "2d938f904be70712f2bcb4786f4ec8d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529183, "uuid": "fa6196d8-8574-4083-a3dc-2b09a6ebcff5", "value": "12288:Pjx7Efo6jhVHMpQ7BRzTc4abE+suPN0QCZa0EA1jhT9iBXnr4F:PjVEfom2QlRTtnuyNBniVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529183, "uuid": "15518cec-c151-4198-9f7a-9ab9a4b494b2", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529183, "uuid": "6611b22d-6a90-4d3f-90c2-880204ac34d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529183, "uuid": "7da16361-2b58-4f8b-ab4c-28433a72d544", "value": "be4a4943231d5aa88e6be315fc823b755c0a818eebbd3380d8165d0a6527eca8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07be8c2d-afaa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648590535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590535, "uuid": "15d934b6-2327-4856-9fc3-78eac52286f8", "comment": "Malware payload (Heodo)", "value": "de6796f0a8849c2e09bd6543997f0a3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590535, "uuid": "6211efa3-8a2c-43ec-a646-05d8c15a7839", "comment": "Malware payload (Heodo)", "value": "be4fa8c7227c01dc3a6be3b427b22c4fb1dd381012d7e9df30af3f57c3416897", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590535, "uuid": "1e0d7357-113d-4d52-8705-c7ea5185ab98", "comment": "Malware payload (Heodo)", "value": "92d12f1462f2592adeb2a8dadabe8a6d7122b2bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590535, "uuid": "4297f08d-218f-4a54-a75c-4b76274005e9", "comment": "Malware payload (Heodo)", "value": "e3e57244ad98804a8c7c827b78e40b5a5521fce927384ab76259e8c150f0e651e50153e1ebd102998c66379f20088b63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590535, "uuid": "bf84f5ba-73d6-4ca9-a093-ed57a8fafb22", "value": "T147A49DC87182C132DE7B4B75C642CAA05EBD7CC16BE1CF4B6F89294C7A31D48C52AAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590535, "uuid": "cb0a0e5f-2b0f-46c1-8034-0ee5eac9e6ac", "value": "4483453326f5042ea7316a102b3b720c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590535, "uuid": "30afc52a-78fc-42bc-be9e-241172ed0895", "value": "12288:myXvaWo3sPddfrkpEpBLsORdPDpFlrh5W:F/as1dDkgHRhDpF1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648590535, "uuid": "c3a1a231-465b-46e9-83fc-1d671f13be59", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648590535, "uuid": "e190edf5-6d14-4321-9115-7e02bb835097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590535, "uuid": "c8fe81f0-ed27-4ab1-b7da-788ca312505b", "value": "de6796f0a8849c2e09bd6543997f0a3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c01b2d-af3b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648543266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543266, "uuid": "1d447ad1-b069-4d9a-9d94-958e7fc99f7d", "comment": "Malware payload (SnakeKeylogger)", "value": "e7054a13910b427ad6a5187a0ae7fe86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543266, "uuid": "80943dfb-ca9d-4d9d-b57e-680ccb8e0b0c", "comment": "Malware payload (SnakeKeylogger)", "value": "be67149051cd685b5aa56bdbee718412157f65ff953ae7261dfa9fedfdd3e08c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543266, "uuid": "6038d12b-1791-4418-90a3-46876b83594a", "comment": "Malware payload (SnakeKeylogger)", "value": "c64dcc3b1ddbd75a5db63c6d64f700c17e87fbd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543266, "uuid": "6c659ea4-5d83-4ee2-aaf9-e1c3b1922acc", "comment": "Malware payload (SnakeKeylogger)", "value": "93d202f07b4dded6cc70731ae846d53c02f6f2e8a7c48cd95be0e0c2cff10ede7172c706c6e4146c15042368896409d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543266, "uuid": "d64a04d2-fb12-445c-8efb-39bc6a16d92c", "value": "T183C4231F92E12CFBF3164AF50AB737B0E7FE85CE95898B5327362F66761094290404A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543266, "uuid": "f15640b2-592a-4263-a918-6c2a8312b6e9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543266, "uuid": "3f9d89d9-aa0d-4413-97f0-dde2b1068d1f", "value": "12288:7i1niKeUvW9BhmGrPEQEl0FMmxFL9+bDS6Uyit:qinUvWhjEQEeMmxFL9+bDS7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543266, "uuid": "73be99f3-e8a2-4442-9f28-fd10cfe227e1", "value": 573893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543266, "uuid": "d7f53173-2ad4-4239-b3f2-063c33d6e2c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543266, "uuid": "1ae420bd-f30a-4c13-9a95-49c7d0038689", "value": "e7054a13910b427ad6a5187a0ae7fe86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05cebcb0-af5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648557460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557460, "uuid": "bfa43a73-2f11-48d7-b007-143a42cdf3f3", "comment": "Malware payload (SilentBuilder)", "value": "123ae0275322397192a5726ef34d4acd", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557460, "uuid": "12ab1f74-6b97-498b-94eb-471fe6424651", "comment": "Malware payload (SilentBuilder)", "value": "beabad0e6d589c43126a4acb498757c21bc9a45facb126336243e228557790b6", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557460, "uuid": "7fe63183-0a06-40d7-ac09-f164639771b7", "comment": "Malware payload (SilentBuilder)", "value": "22af1f078c94fbe11098af808e18824e9eb235f7", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557460, "uuid": "6c618c74-1092-45f6-9bf4-c6970a3b35de", "comment": "Malware payload (SilentBuilder)", "value": "a90dd6e9635508b982fff7bbac384d67f3b6774d422ceb1100ef5da8ec655b6facb012d52d4ff6752ae4256b20d8e380", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557460, "uuid": "031f4c8f-6420-481c-9af3-084e7fefc0a2", "value": "T1F2C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557460, "uuid": "5b70626b-0541-48ad-ae6f-6a0cc07842e9", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCY:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648557460, "uuid": "2e035bc8-f0db-4d8b-b594-db4149b09a06", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648557460, "uuid": "2f1bb078-31a4-48fa-8cab-cb4e0db60298", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557460, "uuid": "b56a8e76-53ef-468c-94b9-ce356a4899a0", "value": "check.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee788a4-af66-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648561717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561717, "uuid": "161e0125-e63f-4e2e-b3a9-11840d5a2d36", "comment": "Malware payload (Mirai)", "value": "7b32a5cd45e2cf87d28d39c44914a290", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561717, "uuid": "d582ba30-bee8-4427-a74e-f681de1bbb76", "comment": "Malware payload (Mirai)", "value": "bedefda14572ec212ae22c20eddd64e2ae631d331415d01b58d44c9c02b535dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561717, "uuid": "1eb5609e-9af0-4b88-b660-9b0533856b00", "comment": "Malware payload (Mirai)", "value": "418b24974f4279915e832b94f59b75022a4efa8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561717, "uuid": "9973b3fd-6fa1-4e7f-ab56-b094d6367760", "comment": "Malware payload (Mirai)", "value": "bd3a874a229b231fcdb58a2360ae01e8473c7c3949d809b724967d6445392b2bc1ec65619558a942d1bd2bd3c77a9291", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561717, "uuid": "c5313985-25bc-41a4-b008-bcf9852f4073", "value": "T15DF2F17BB9451802EF16E0B1D13F26D62EEDBF619EE20BD6C86619075C236C27113A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561717, "uuid": "1817b2bb-4d00-43af-875b-3bc29cb9784a", "value": "768:5riAO0qqbI20efpU6JA6ddOYVdh7BQFqLsfxohgv9dvOC8oAYGx/hpfG73:5rpOnodlfdJA6LBVdh72YLsfpVZOBoVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561717, "uuid": "2d1c60f5-63a5-4bb6-b8ad-aea6b5735c23", "value": 35484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561717, "uuid": "2f4786fb-f3d4-45dc-a778-39e31f9697d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561717, "uuid": "c97453b2-e830-4374-a4c0-02bd6372de8b", "value": "7b32a5cd45e2cf87d28d39c44914a290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f819035-af28-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648534767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534767, "uuid": "833b8272-fad3-4d9a-8952-7c715d5426cb", "comment": "Malware payload", "value": "546e3319cfb508ace94e05e61269feed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534767, "uuid": "8224b849-d7c8-4654-bbfa-67ca9073a7fc", "comment": "Malware payload", "value": "bef1be03ee126d4d7c15901f0666685f060088d1323dd79a07abaf14d508ac95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534767, "uuid": "553aa26d-2762-40aa-a7ba-142d9ec6c8fe", "comment": "Malware payload", "value": "38cc514785277ea3386e5f146f73e095a7a19be9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534767, "uuid": "4090e311-7a8e-4db0-a94a-b8fc3a9b8456", "comment": "Malware payload", "value": "283914bd35415c3f7b4428e90fff68ca45d820b577ff6591bcd286ea6e189163ea2d683e681a570c059dd28681bbc67c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534767, "uuid": "885bec4c-5ccd-4812-8f19-1cd460ad4b0e", "value": "T193A51309A187E27BFCEC08B3445490D4C29C7FAA7B128DCDE97AD58A141F442F7B6D86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534767, "uuid": "6f9e696a-9818-4134-9f3a-0733c607401e", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534767, "uuid": "477443b4-7e44-48d4-a630-4250360ba0e7", "value": "24576:pLlgAi5b3BJVZ84JCmrijoKn9QgpFHe2deMJuNawyHUkSUV4WfgtMO:pyJJVZ4mrijpn9pd6zE7TYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534767, "uuid": "3bfcec49-58cb-431a-93d4-b3c29d978b4f", "value": 2088181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534767, "uuid": "59e628b2-a5d0-4482-957f-9c856ce7c1c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534767, "uuid": "57e63cd7-1417-4af0-8bc9-b622101f7168", "value": "546e3319cfb508ace94e05e61269feed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0ad345-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648562138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562138, "uuid": "bfbe20b7-87b3-4f6e-8bfd-f80d6247fcd2", "comment": "Malware payload (SilentBuilder)", "value": "138cd21774225783a44f9d2f0eef07ef", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562138, "uuid": "655e5bb7-4c83-455b-b35f-4af65bb3585b", "comment": "Malware payload (SilentBuilder)", "value": "bf8ff55710ac13838b15060e846fc2f4a2976ce7aba244551a4368d77bdf6b08", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562138, "uuid": "1d942b51-c163-40e8-967d-731114b251f3", "comment": "Malware payload (SilentBuilder)", "value": "41969189da26991d77bcd793332610abfda5d9bb", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562138, "uuid": "134aba1b-6985-46fe-b12d-1d4aaff52947", "comment": "Malware payload (SilentBuilder)", "value": "13608392432763f61a9f091213090c5f371ec32fb89fbbebc37e280f29567ca502271068cb33ab16766c1641e24449d5", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562138, "uuid": "f7815fb1-2feb-412b-91ea-3113a32361db", "value": "T128C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562138, "uuid": "5ca8d5a8-552d-49ed-bf61-a3557932fa44", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCc:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562138, "uuid": "7bce4b91-91b0-47ce-8578-b086ca0b6f07", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562138, "uuid": "c58bbf03-83bf-4f66-9bc9-7e403bf0444c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562138, "uuid": "ea839d80-149b-4faa-9fb1-ea249334b68e", "value": "N.561 XDE 29.03.2022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1bfe049-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648573210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573210, "uuid": "9138a6a3-3f98-4feb-83f2-79209fea8c53", "comment": "Malware payload (SilentBuilder)", "value": "75a882c3719012409003d94aa7a15a45", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573210, "uuid": "4b1b4c03-b835-4f13-86b9-a0125f3cbeed", "comment": "Malware payload (SilentBuilder)", "value": "bfb0ed7f55c0463c6869ad11056b23284385787e1ff06aeb23c9e26e1be55567", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573210, "uuid": "6f589dcc-83de-450c-8755-8e6f91185234", "comment": "Malware payload (SilentBuilder)", "value": "0fcf303d2d7a490f4050395e601881fbc4177f30", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573210, "uuid": "1285b8ec-889d-4e34-8e2a-259f0fc8969b", "comment": "Malware payload (SilentBuilder)", "value": "7a3db64180b8bd3df2a472f21ddb511457ff5530a61c0d0eb987a013073ab9ccc99c477d0c402e42c671fdb4892fa451", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573210, "uuid": "0ef55083-ef88-4abb-95e0-067a0c9a00a2", "value": "T13BB39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573210, "uuid": "9ba092e0-e458-40e9-a2b0-0c06773eb572", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMZ:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573210, "uuid": "d2e2223d-c1f8-4566-bfa9-beb34ce27af3", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573210, "uuid": "36859bc8-bad8-49ff-9781-22e1fb00b13d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573210, "uuid": "fe26759c-9e8b-4ce8-b837-2959e3dd57c7", "value": "75a882c3719012409003d94aa7a15a45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c29450b-af43-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648546519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546519, "uuid": "f3904a3f-7c3f-41f3-a3a2-976dab9dc208", "comment": "Malware payload", "value": "8e886df3cb6160188f9748f14f249063", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugx loader", "colour": "#10DB64", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546519, "uuid": "69776825-6379-4f50-90a0-4d40d98780a7", "comment": "Malware payload", "value": "c09ff32519f112674bd5f4b1687feadf18844c5423e6f28df8be50eb9503e606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugx loader", "colour": "#10DB64", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546519, "uuid": "372a2334-68c4-4eed-b890-15c9251bcf66", "comment": "Malware payload", "value": "dc40970a3c8f03866e0b700460d3b1f7afa6a433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugx loader", "colour": "#10DB64", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648546519, "uuid": "8d65e1b5-cb52-40ab-8dcb-7ed8b541fa51", "comment": "Malware payload", "value": "221d735fd48439674cb56e7d6dae2f9982186ce40c7d71e96361116f98ed41fe15941af064dd7908f7d92b2ab3199f62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugx loader", "colour": "#10DB64", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "talisman", "colour": "#170440", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546519, "uuid": "f9d2e31e-75c9-4d25-930e-67e0ace6d7f3", "value": "T17E346B32B7D490B0F9B72B7159B6C62A8A36FD140731C1CB67917A1D2D317E2A93036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546519, "uuid": "07ceb998-1b39-4473-b943-19faf0dca61c", "value": "e9bc5a0f86fdf3a469a07446b9e21381", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546519, "uuid": "2af933f6-b507-4b2c-a37b-b4321bc2ddf6", "value": "6144:gPiB7kGfWekI/75ac9nseOrRgT1bcyggSG:gPixZkI/VaTeOFgT6+SG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648546519, "uuid": "ca81ce8d-9140-44d5-a567-d8528506163b", "value": 234888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648546519, "uuid": "2a4bbce7-ba69-4033-a0f8-a35aaba5b6f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648546519, "uuid": "ab594a80-c4fc-4069-9284-f64c11938612", "value": "SNAC.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328780d7-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529188, "uuid": "2324540c-9cc3-4745-8e52-b6f416f699bc", "comment": "Malware payload (Stop)", "value": "7041e65dc178509b2d6082e7ee3d691e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529188, "uuid": "3fa221e7-68ef-48e0-b071-259caa83666d", "comment": "Malware payload (Stop)", "value": "c0bef9ba844c2d2cf99c9e7e397dcb9be6ba14bc8466603f6f2765e9213137d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529188, "uuid": "21e961de-0599-407b-b4b1-bb91d1a47b3d", "comment": "Malware payload (Stop)", "value": "4de716b6312a9ff0317a936389f612339f90aab4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529188, "uuid": "023c6c84-1189-43c6-b68a-ad14a00bed6e", "comment": "Malware payload (Stop)", "value": "e0d65d9f5b16acb821bfce340bcecfb0ddf2c5ad0805ebd3348937e03aef9ac1189225f90e51424e73be9db044c7f4b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529188, "uuid": "98922a77-b3a0-4bf4-bcd2-46356a1142c8", "value": "T1A6F4230077D2D031D446A4302425C2F3EB3EB83497E5CA8B36696E7E0EB27C7D9B9616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529188, "uuid": "3a7a5d4c-87ba-47e5-8c68-75f448a59b59", "value": "4726b2723a987e7ca1cfb498c6580a30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529188, "uuid": "eb798897-38a1-4c18-9d44-49d27fe1013d", "value": "12288:qdxVKf4+f/N01bmyju7UWy3ql89MNYC3h1iUYfh9q4KyNBaF0zn:q/1+fO9luQ5kHbvtih9q4ZND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529188, "uuid": "c5591b6d-61ac-457f-a3cf-e34d54f1557d", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529188, "uuid": "869c3c35-f40f-45a3-a817-840cd13415b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529188, "uuid": "3b72e377-a924-4299-acba-fdd5d98fe174", "value": "c0bef9ba844c2d2cf99c9e7e397dcb9be6ba14bc8466603f6f2765e9213137d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358455e3-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529193, "uuid": "a63a6d9d-824f-4c6c-a405-8c750d5b894d", "comment": "Malware payload (Stop)", "value": "8a88b47e6c5af060785996171100b7b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529193, "uuid": "7abcba52-5fa4-44c7-bd56-04769117948c", "comment": "Malware payload (Stop)", "value": "c1b91cdc775602a3dd86df646580567f3e6a018d00ff7ec32c156ae2e3110814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529193, "uuid": "473b916a-a925-4a26-bf81-22dbb22c5c2a", "comment": "Malware payload (Stop)", "value": "bc837bc1bb3482f075514120e4ac0322b72c07d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529193, "uuid": "a3041483-cb54-40c2-a7a3-6a49538151da", "comment": "Malware payload (Stop)", "value": "f2765d377e83c23ea2b48d94638f1ded34a77020c997f7a20314087f6836f4b397b0dfc0e50805fd81183322a1eba570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529193, "uuid": "78aaa123-e8ef-4a4a-9073-35037bcdb349", "value": "T1CE0512596741C033DBA22232682282702776FD7194FAC543BF65677A6E313E29F3931E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529193, "uuid": "15a0d726-d54d-48f7-b58f-90950d39690d", "value": "c0473d6b08a443ec380cb4c04207d018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529193, "uuid": "9ff544f5-380c-40b1-ba2a-8a1840c4fd72", "value": "12288:uQiFdmuLiDxctpx+iDVzA3IxA1uXFs7aylL6TN2iM+qd2OKsgi:uZXmtW5+sgkXFs7ndFicd29s/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529193, "uuid": "207a3df3-ea94-4afa-a3ce-fd29d3343240", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529193, "uuid": "f9eab054-4d00-4968-8755-0a91dd7b0e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529193, "uuid": "924daf70-3715-406f-8583-1878122a8e2a", "value": "c1b91cdc775602a3dd86df646580567f3e6a018d00ff7ec32c156ae2e3110814", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a62b5a-af4c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648550239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550239, "uuid": "2463f40b-624f-4a11-8646-c8d665a851e8", "comment": "Malware payload (AgentTesla)", "value": "7501bd564d5e5c968ea0f8e837323c5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550239, "uuid": "db1c18c7-a807-4673-b9ad-a9ccf855fc66", "comment": "Malware payload (AgentTesla)", "value": "c218b9d54c1dd72bd98226c31ef26913a26c5b6a06a6863c1848aa1a829fce61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550239, "uuid": "b6290c25-fc5f-41dd-b9b6-0a6017af4f81", "comment": "Malware payload (AgentTesla)", "value": "2ca2c1596750b9dabf24ad57dc788241613d3e31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648550239, "uuid": "d4f31543-8835-4212-91d4-bf5ea0a9ee79", "comment": "Malware payload (AgentTesla)", "value": "353a06940c66443ea97799eba25328e41099b21b832a936120a39b694e6b7bb9251290578faad9a45d0384fe49171118", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550239, "uuid": "268f0575-bc32-4895-9d5c-4ef380c28a7b", "value": "T1EA45F123B7DED902C67D5BB784EA90008BB57E4A4123DA0E79C837FC0E22782595675F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550239, "uuid": "5924739a-ad8c-4879-8d3a-82cdd0080eb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550239, "uuid": "79e038c1-4d8d-4bf1-af94-e40805a79207", "value": "24576:rUQALFU1NENCr5Y6tJ0gSBNwv3jHfwMYmNYbet0+HSHPF:4LFU1qEFIv6bemNYyHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648550239, "uuid": "f5f04a30-ae70-436d-a3df-c4a806366eb9", "value": 1167872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648550239, "uuid": "366a0871-e8c2-47c1-9f7d-ce7c3ae9ae03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648550239, "uuid": "838791a3-22d3-4b2f-b8b5-b085b3ddb354", "value": "Bank Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fe1aaf-af7a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648570312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570312, "uuid": "e6d1ea6f-9d84-421a-8203-60393079a222", "comment": "Malware payload (AgentTesla)", "value": "6055af8b9aecb51b74ef3704825360bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570312, "uuid": "fda3af31-c1f2-4a6a-875c-3913d7b14708", "comment": "Malware payload (AgentTesla)", "value": "c259b3876e29e2ca5842fd95e2b4ad71513de75dbad9a1fbcb0c7bf049267a88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570312, "uuid": "22a4d07e-07fc-452b-ae1e-e23c8376612a", "comment": "Malware payload (AgentTesla)", "value": "9eb0c465a418a7891f990f8c2ce0a3bc89307fb4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570312, "uuid": "421c7b87-2108-457c-ab46-b52b8fd5fca6", "comment": "Malware payload (AgentTesla)", "value": "17e1bc505e87338c7409684ff6d77c185d9c638e951a0308c92ea4a76e38546feb3cdea50a52e01ec1320440c4287b28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570312, "uuid": "1202e53b-0e0f-451a-8a97-9a20d06ad3de", "value": "T1B645F127739AC811D6BD57B688EF94400BB87E565523D70A78C837FC1F223836A4A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570312, "uuid": "888913d7-eae1-4ed2-a089-c9e6ccf136d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570312, "uuid": "af5c5bfb-eff9-4397-8fa8-6571f6bfcefb", "value": "24576:IUFS2kN4C0OIlg8fD1qUVRWY3ivKv2k/Qk8ZEXTgPY3h1r+:02kN4C0OIlgk5qMRP3iSrl8ETgPi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648570312, "uuid": "1383420f-c12d-4b88-bdd4-5c140b7457e0", "value": 1183744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648570312, "uuid": "65786015-5104-4dba-8146-e7528554b8d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570312, "uuid": "02dffbd3-5896-4a9e-9796-addae4a80de7", "value": "Enquiry Price.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d989c2-af6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648563827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563827, "uuid": "4b365da2-7d32-44cd-9d5d-d544f7f7cfa7", "comment": "Malware payload (SilentBuilder)", "value": "e6007885dce75ea90625333c550dff08", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563827, "uuid": "a1785a9a-4d62-4699-b95b-02ed62929587", "comment": "Malware payload (SilentBuilder)", "value": "c28b963c8ebc03cf18551688a0c512e5e27557ae0bacda77943bd6740ff3cdef", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563827, "uuid": "1502bbad-cffe-4df6-81b8-ad67a766f9d5", "comment": "Malware payload (SilentBuilder)", "value": "ece0b651832cfb5a3c6420b1eda69b943de519dc", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563827, "uuid": "f5b75bcb-a62b-4e2a-843e-84ac98b207e8", "comment": "Malware payload (SilentBuilder)", "value": "285ffda7473377289bbbe93375b4293ca34761cd1285467b7e62adba09f413f267fc822b3c753b75c7dd04ffe1bcb702", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563827, "uuid": "2a2b617c-780a-45b4-b949-95ec4dcbead0", "value": "T1F2C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563827, "uuid": "ff37366b-2caf-4b9f-bcbe-85efc5608397", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCs:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648563827, "uuid": "83eabe0a-3a52-4a93-91b2-e71768a435b6", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648563827, "uuid": "95921607-c365-48d2-bffa-84aac8d25211", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563827, "uuid": "35714abd-c4f8-411a-8fd0-2a01086b88bd", "value": "e6007885dce75ea90625333c550dff08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16055fe-af28-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648534958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534958, "uuid": "1f9192c9-af39-4587-8b24-6908bde3d78d", "comment": "Malware payload (NanoCore)", "value": "774e8b95af008ea149cc074191347b70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534958, "uuid": "9abe744c-18ce-4d11-b324-bba789992ee0", "comment": "Malware payload (NanoCore)", "value": "c29ec056b24931a1d05225313836c605be1c9643c1865c21fc8a2b7743fd2a1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534958, "uuid": "835e6c55-6568-4948-8d45-f9e90ac5ab27", "comment": "Malware payload (NanoCore)", "value": "5fd821f6ce12ce638cc8d83def7692bef34df3d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648534958, "uuid": "8cb162e4-aa88-4803-85f1-78a4a69795fd", "comment": "Malware payload (NanoCore)", "value": "d553f22fc500afd2d6d41e3d0d8d22f6854928c73eacc4ceb77fef4dfc0e29d8f52668b0baacb0dcf0d1d2c867de61fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534958, "uuid": "b0369d85-c851-4c60-a34c-c2d0fdda1fba", "value": "T12535122857E88251F67E67FBB8B400115B74752B212FE70DC58229EE0EB73C18A5B35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534958, "uuid": "61695add-52a0-48ba-a95d-4cf12421b05a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534958, "uuid": "adc32cbc-2da7-45e6-8dcf-8e61abbfb935", "value": "24576:OXeP9STKzuFx1mJpxcFtTDzwQO2ZPM9b7v2ZLyAojt+pX:OXeoTPFx1mnxc7TDDbp2uZLyAUt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648534958, "uuid": "e5e2c9ad-4a38-4f6c-8789-d6969b3bac33", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648534958, "uuid": "0097febe-331b-4bd1-9db4-b58f3fb1e324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648534958, "uuid": "3d97e930-6def-4044-bf21-e4edadb32419", "value": "00003456DFGH876DHL2022900000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dcc1b5-af56-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648554860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554860, "uuid": "38a63911-4cb0-44dd-bbc0-cfbd715d2845", "comment": "Malware payload (SilentBuilder)", "value": "62796a66ac67d5e6645bba4a8f7c20f2", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554860, "uuid": "788deaa9-efb7-478d-a9ca-05d5ade88c28", "comment": "Malware payload (SilentBuilder)", "value": "c2e038bc7a22e93ad5aa1d596f191fda17b7caf3366d25526f444a04846f9990", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554860, "uuid": "a8236145-40e8-43b6-819d-19fb051848b9", "comment": "Malware payload (SilentBuilder)", "value": "a9d4dbabfd98b433d6e4cd01b4df856473e35883", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554860, "uuid": "65886faf-c9e2-4fb3-ae2c-ccd7e13f8bbd", "comment": "Malware payload (SilentBuilder)", "value": "810b9db8c12fc7fc7c0b733277f975478185be45976aec11c65a7481a12c1b70d8c0750ef49c13016c54292b9ce67b74", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554860, "uuid": "d82a039d-23d7-4727-90db-284b8998bb21", "value": "T158C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554860, "uuid": "f3d31fe7-c2ab-444a-8e21-b0a1cffcb1fb", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCM:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554860, "uuid": "db4039e6-2943-4592-83cf-9bf95a63f0a6", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554860, "uuid": "eb6c013e-6c72-48c9-8b14-ce2591a9eef4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554860, "uuid": "8f958e7b-f958-499b-bff1-3b68e768feaa", "value": "Details to update.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3871472-af35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648540679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540679, "uuid": "8af1ef58-2afd-44a0-bac5-6b4dd941b5f1", "comment": "Malware payload (Mirai)", "value": "5fa567d4271ed9625e7c57ad05dac0a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540679, "uuid": "51aa3d33-7376-4f47-9cac-0ca8e9ae07e8", "comment": "Malware payload (Mirai)", "value": "c2e23c62bdc791f7f6fecb4d8e38f0c785b1489f32cee32b79e5b5ddfb891bab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540679, "uuid": "28dfc55a-d304-4576-a37d-71489be56a64", "comment": "Malware payload (Mirai)", "value": "2c6090575ed8f64103117de1ab5de70303f0f638", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540679, "uuid": "c2dc1088-9772-4793-96c6-775ecc1d0ebc", "comment": "Malware payload (Mirai)", "value": "f1a3995a99e29f2029a9b24055343f0ee3c5aaec9ae86630bcfe4946e1986bcd99c72247cc45ac80761c3c370def695a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540679, "uuid": "77ea5252-6446-4819-96aa-177cb1946af7", "value": "T155C2E16916C80B5BDCAE833D015A4EAC3257F8B80F2E36934F644A8723B70E549A445D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540679, "uuid": "9e8c0a31-cae8-44b3-854a-d1c1171ae30a", "value": "768:1VD2FlrXWGcyiU1G3704gOR4DC1TsrHH0su:QXAy3G3QFE4m1TsbH07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648540679, "uuid": "3ba90a90-e98b-46dc-a2fb-abf252468c39", "value": 27680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648540679, "uuid": "2b954693-20cd-4885-aa8b-3133cc2a98e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540679, "uuid": "49f5999e-8231-42d2-95d1-cb7bd328628b", "value": "lshboot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b98df7f-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648537042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537042, "uuid": "338e9ca4-562e-4000-8669-b7f98071c1e0", "comment": "Malware payload", "value": "86e179f0435db19a35d4ebac171aa792", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537042, "uuid": "7ae1e26c-ff6a-4ac8-b841-1e22e14f3b79", "comment": "Malware payload", "value": "c313c56c022443d0c20837a0eecc44860a85c18b0ce278a14ddb3bf49f91e435", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537042, "uuid": "ba26e655-4a38-489d-bb58-e17a8854a75a", "comment": "Malware payload", "value": "1f13341bb7e0b37f92d8a8f3bdfe87a8a9af1308", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537042, "uuid": "dc5ff3c1-dd0d-415f-b393-5c02cd5c5688", "comment": "Malware payload", "value": "cf69bc3afcec538e61768de7a9e2200dae4283864026b3929b58e624c1f71613cf3f08d01f051f8c49a4a30472c2ac5f", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537042, "uuid": "0bf30502-645f-4a58-9d24-ea3b798b05fa", "value": "T19E14124035E2D856DA71A6BC8438E111E8B4FED726F070E63019365E5778C8F54E6E3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537042, "uuid": "4478b9f0-bcc4-42e5-ab94-471f028e400c", "value": "3072:HB/GhCspQ8DPQsxT4oW+LxDXiDDzZ4UViop5xITjpCErBB+ksCjkQzaMT1ddZiy3:dECspQ8DPQcsQLQDDNqozWTRr38QzaUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537042, "uuid": "538fe170-963e-4eca-8bda-c212950d1af4", "value": 193752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537042, "uuid": "ee3de7eb-09c6-4a0c-9c4d-50023a435a5b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537042, "uuid": "55b66ba8-5c93-4094-8de4-4067bf3c0269", "value": "CBJ220323170082.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ddc226-af69-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648562638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562638, "uuid": "eb629b30-3f29-493f-b808-f894c60711b0", "comment": "Malware payload", "value": "422d0998c3589bba2e18fb85edbd3beb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562638, "uuid": "1b738841-9aa9-4879-ac8e-47c061871098", "comment": "Malware payload", "value": "c3303f5c5425ef9d85886da899bb27a49e38e7e0fa4aff28f9fe579b0796caa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562638, "uuid": "27d7f1f4-f259-4816-8916-b110bdda8a85", "comment": "Malware payload", "value": "6bc03783c9a9ef5a92d12f1e59f4853b25c006dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562638, "uuid": "0505aa6e-b069-4274-8f33-96185c47711d", "comment": "Malware payload", "value": "a4206a28fcd0f2002f952b8de1c1f2cd0e0a820501dce1847e87f2a86cf251e234be91ff39f5140ff377a471d5ae47f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562638, "uuid": "a0617e7f-08dd-49ef-80b4-5d5808a97cf0", "value": "T1C8235C0D339CF622C278677DC1E7255457F6F2BA2623D30E9C86126C5A53FA26906F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562638, "uuid": "138f58bf-f58d-4a9f-92ed-34d8feaf3771", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562638, "uuid": "d68cb52a-de01-49f0-96f8-5bd7a2d4d508", "value": "768:sacy+tGTvyDrHB470Lm8A8GeJPMAT5mE3SP1hyoPG14SA+DRbOSUaq1LyJdzd:sVy+GzyDV472m8A8dPMAd+PzyoPGe7qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562638, "uuid": "7dfc6d45-de07-4be4-bae8-af9dd3d9172e", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562638, "uuid": "53942171-5c96-4dc5-b98f-a3766e95c778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562638, "uuid": "078346dd-081c-4518-9778-7e48f3beacb1", "value": "PO-32323445576,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ac7264-af72-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648566781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566781, "uuid": "0b7f3318-f159-4172-94cf-4ac6931e48cc", "comment": "Malware payload (SilentBuilder)", "value": "32da10c5ece451007313e1c9dbe1e943", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566781, "uuid": "859da019-7121-40f4-99a3-8da42eee90af", "comment": "Malware payload (SilentBuilder)", "value": "c3aa622ce21dba28eaff3645ae335b4645030f415f8d9bc4bbdd1c47548c78a6", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566781, "uuid": "6750fd63-e870-4238-98ee-73cd3d27a387", "comment": "Malware payload (SilentBuilder)", "value": "f7c5662ebe0bfc7a1e175185348b47652afd5470", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648566781, "uuid": "9b286ba3-fcb8-46a6-8562-d187fe60beb0", "comment": "Malware payload (SilentBuilder)", "value": "8bd95457683490f71da8ef1b07d42de81428be909817f41a9f507f31014b2c604a6f5c6a0a24e1ec1374c472e624286a", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566781, "uuid": "f09f919f-bfe8-4cf2-a219-728f70bace23", "value": "T17EC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566781, "uuid": "a19d3134-b846-4ed9-95a6-1a69cd67da3d", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCc:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648566781, "uuid": "09ba84d1-730f-48e7-8eef-0752cac544e2", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648566781, "uuid": "afcf584a-5fe0-430d-a776-58c369503a72", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648566781, "uuid": "5938e9fd-080a-4a51-b087-a2e2c8a06ec3", "value": "ESCANEAR_5146.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3dea5b8-af99-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648583602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583602, "uuid": "5f59f6a5-74d1-48f3-9474-c81e56fcb021", "comment": "Malware payload (SilentBuilder)", "value": "b3a56fe7469cdd978681ec2e65be7830", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583602, "uuid": "b6ae25f3-7d3a-4261-aba5-7935f975bdf3", "comment": "Malware payload (SilentBuilder)", "value": "c3d26b7f053fe5f6cb1a65367e25bdb9206d0cfaf03cbaeea2133546673e5c0b", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583602, "uuid": "30e13c40-4a78-4afd-9908-8dfc659eeb13", "comment": "Malware payload (SilentBuilder)", "value": "318f3a37401c3a885b1cf1db02f694d69611a5a5", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583602, "uuid": "3bb3af39-d6cd-4313-b7d5-71a0cbbddb10", "comment": "Malware payload (SilentBuilder)", "value": "b4474b8d380ce200e8d0b67f2b91537dcdb26b1b27dd65d1c3809b45d9de1a0d91c9c303300b9ac7add037ff8a7e2021", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583602, "uuid": "b5bd7d82-f238-4f0b-998f-26c4f2829acb", "value": "T11FB39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583602, "uuid": "1d80dcb7-a7a4-4990-b726-a18ee4789882", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMF:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648583602, "uuid": "9172764d-15a1-4695-95c4-60120cf06b41", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648583602, "uuid": "276fb3b9-a9d3-470e-b13f-48785638334a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583602, "uuid": "f6f34596-9ad0-404d-a9a1-4cc3045ae62c", "value": "b3a56fe7469cdd978681ec2e65be7830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7257cc05-af2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648536597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536597, "uuid": "3379aa19-4225-4404-b65e-04eaefbdd6a5", "comment": "Malware payload (AsyncRAT)", "value": "2dd38a1276259456e7e2fe82182b852b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536597, "uuid": "bd9d6d02-d3dd-4622-af8a-4dff1fc7c8df", "comment": "Malware payload (AsyncRAT)", "value": "c453aa8564c87024d1e0efc6296ef780bea8979bdd1d961d755a54cc5a4c9cb0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536597, "uuid": "04987c14-1eac-49e9-aba7-de07680b7987", "comment": "Malware payload (AsyncRAT)", "value": "7fd7e0cdf5e1e03964d0e101ae9633531d946273", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536597, "uuid": "f2c12e93-15a4-4cb4-8869-cbc76f6bf29f", "comment": "Malware payload (AsyncRAT)", "value": "f01178c0ef1438f61424d941c8e6d512b5175b1540a1da54785bd0cafaf333de6065337823fd5a77ced540d6eb509c44", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536597, "uuid": "9ce0b480-73b1-428c-8b56-fbd7bb49fe9e", "value": "T10454E01071D0C173C47A143184E6CBB59A3A7836577A91D7BACD2BBAAF113D1A33A2CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536597, "uuid": "21a729ec-e283-450c-a9f3-56ab45bec3c5", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536597, "uuid": "810e9e2c-eed0-4897-b022-34a943880de8", "value": "6144:0DKW1Lgbdl0TBBvjc/Q8TuoErtqONwiPclcI1mRHq6C:ih1Lk70TnvjcU72lcsm86C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536597, "uuid": "38c0dc0e-d054-4a40-97c4-4600f31a842d", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536597, "uuid": "4fe7ef34-7541-4be8-be5b-09901de63673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536597, "uuid": "7b4ed797-d509-4b4a-a69d-1d8b76061016", "value": "2dd38a1276259456e7e2fe82182b852b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc07d9c-af17-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1648527435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648527435, "uuid": "2666d684-e17e-43eb-b46b-03ac38e01a58", "comment": "Malware payload (DCRat)", "value": "24a5a5bc4829d6fe2604ea90239b0abb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648527435, "uuid": "73a5cca1-7736-472d-9e45-bc0ef28a2312", "comment": "Malware payload (DCRat)", "value": "c45624a48a26b4cdf6abfd84c33beb25879092c177c24ab11c97bda175d0331e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648527435, "uuid": "f5b25a30-a89e-4912-81e8-47147ebe4bc1", "comment": "Malware payload (DCRat)", "value": "bb73af26096de0f34606142f1b7ed071048126e3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648527435, "uuid": "f8ba852c-6b2a-4127-91b2-ee367874f391", "comment": "Malware payload (DCRat)", "value": "2ffadb1231535e7644989a56a7b562e7e6dac1bd335c462e015eb11040732ef95125c3b5c4b6d8ca3b430e7d1afc97db", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648527435, "uuid": "e7fdd468-2a72-4c2a-bf00-b04484f3c6e0", "value": "T148559E127A45CD27C0661B33DADF801847A9BD02AA27DB1E7E9A375E16013B79D0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648527435, "uuid": "828fa6be-a452-4aa8-a718-b05c9d70e778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648527435, "uuid": "05eeae87-b396-4aff-b36c-9c2527d06d14", "value": "24576:XHQxd1DXodUpZ5NHrmmN62X7s2s16qSXQjE2US0vqvg1T/ByO/yF50:AxYUPPrdLsjRSXQjEnqGNrY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648527435, "uuid": "e2c1796d-a0d1-4e6d-a567-9a4deec9c6cf", "value": 1372672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648527435, "uuid": "e99c66e3-878e-4423-8b91-d87289a7c6bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648527435, "uuid": "609aaf02-e471-4e68-8188-57eb5bf1ea4b", "value": "24a5a5bc4829d6fe2604ea90239b0abb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b956fb3-af30-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648538277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538277, "uuid": "f2365a25-e04a-4a1e-ba0c-f93c53abdc09", "comment": "Malware payload (RemcosRAT)", "value": "2beb301193d712fcf58a6ba11948dab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538277, "uuid": "48b53a33-555f-4d76-be06-ad4436d0af59", "comment": "Malware payload (RemcosRAT)", "value": "c46fc3d3cd02ebc1ec0d5dad74c220467b1966df6644b2e11b00a88f4b149ad8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538277, "uuid": "839beb67-ac65-4d6f-b9c5-622fab6c8d8e", "comment": "Malware payload (RemcosRAT)", "value": "52197455c8a96ce2cf862862546487668a19ebf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538277, "uuid": "e027a84b-e14c-4d47-8896-5e10e6da3a9a", "comment": "Malware payload (RemcosRAT)", "value": "cb92ea43057955cb3f7bb4a35537577d166d81766b90373d335f162a9f739d942abc472871bb7a6fb6924fc985a9699d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538277, "uuid": "6363ec4b-6e00-420c-8870-a698d31c77c2", "value": "T116058E9EA3918837C06316784C5B57F9981ABF103F24D4876AE83D4FBF356D1352A2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538277, "uuid": "fe9aecd5-6f6d-49df-a9bb-a24283eb633f", "value": "dbf1300428baed4574f07bfbbe98b092", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538277, "uuid": "f10a62ac-4a25-4d6f-a1fa-1b5f1e3a8b24", "value": "12288:k8XoVKkPa3yFwp0ShMnn0sAIpxxfBy2oYWVwyUBPdCL9/ZHi:zYIkCyFwXhM0jIpx+h7UBPdCLHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538277, "uuid": "0cf85ab6-5553-4b76-9b84-799357706a63", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538277, "uuid": "ae2c1ba0-d8b4-4245-86da-75e197d19ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538277, "uuid": "a06149c7-cf96-4126-9270-3297b1e292ab", "value": "DHL179030 document receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30f17f5-af64-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648560757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560757, "uuid": "383c8814-8469-4953-8084-70122e742506", "comment": "Malware payload (SilentBuilder)", "value": "14273a70d762a4d52c248a016ed5fe9d", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560757, "uuid": "f01baa54-58ae-4bc0-825e-18fb45a5f304", "comment": "Malware payload (SilentBuilder)", "value": "c488f8e0b93b3f90d5d4ee983b1697126b41665b7aa4e535932620a12683dabb", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560757, "uuid": "3c6bbf08-dc34-4380-8fa3-64bf5278bca0", "comment": "Malware payload (SilentBuilder)", "value": "c32b33e69dfad0d6491d773c2fb941630b39bd19", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560757, "uuid": "445d5f68-8128-48c5-884f-3c45fa92fcfb", "comment": "Malware payload (SilentBuilder)", "value": "615ca57cfdfe980af4aa4f3c062d3a1deb40a92cc6659c2cfbe6f03a0b73ac82f8fe01415d37f239e8a04d9e455c1a64", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560757, "uuid": "4fa12efd-6aad-40b0-b009-ac99b88c51cb", "value": "T1B6C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560757, "uuid": "49cde5b4-ae9f-46eb-82a1-c18acd520005", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC8:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560757, "uuid": "f5ee6528-e401-4eca-bfd4-e13b00335b32", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560757, "uuid": "1c1de7fd-0ea7-4e44-98a4-dabc8e981edf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560757, "uuid": "83693e38-12df-49dd-8645-5f27e5801a07", "value": "14273a70d762a4d52c248a016ed5fe9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38693480-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529198, "uuid": "f49b2d5b-b7f8-40fb-8c78-eec012b0387e", "comment": "Malware payload (Stop)", "value": "82763086be304c10452163fbe8c09552", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529198, "uuid": "d0b17548-f2b3-42ae-b585-8d2a21138a09", "comment": "Malware payload (Stop)", "value": "c4af7a91c2a2306fd088d9edc3f7f2a96472f5397d62ae628653e510109a8a28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529198, "uuid": "05260742-63c3-425f-a235-0cff3147e899", "comment": "Malware payload (Stop)", "value": "8f7a058d65ad99c68796c6c5d0f6932b4d8dc5a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529198, "uuid": "7b50c370-5210-4d90-8f87-43820c5f438f", "comment": "Malware payload (Stop)", "value": "0ab2df83f62e616821dfd4d1d1a560ca7aeb2167cf33fb7f949c387a9238a790961eaf0040f595df72ab7fdbb9562217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529198, "uuid": "fcb1ed7d-5bef-4a7d-9d29-8fce92c612fb", "value": "T162051222B691D036D2150331191ADEF0A93EEC751C206A56F79B7B1E2F732928EE174F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529198, "uuid": "400382f6-854c-4f97-a45d-48fb4e822529", "value": "e5c179e1f9502263973e4310e0826274", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529198, "uuid": "dbb5a74a-02f7-4883-9ff5-cb5b0055bda6", "value": "24576:fK6BePmFKFwxVw17hSLidkC6xhYFEQ8zR:fK6BePaZI7hSMkl68z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529198, "uuid": "75540491-dc20-4e5d-a7c0-940162ddb5b5", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529198, "uuid": "dec5c3e3-727b-40b3-b0cc-bcd1d213e1ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529198, "uuid": "88af0b30-7905-48b2-a3da-8af06c49e603", "value": "c4af7a91c2a2306fd088d9edc3f7f2a96472f5397d62ae628653e510109a8a28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79a720b-af79-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648569838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569838, "uuid": "17fd19c6-48ca-48ba-9d27-d4b9e8874366", "comment": "Malware payload (njrat)", "value": "a183b3c196f056819e70f74bb213f4ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569838, "uuid": "32a97156-6739-4801-9c78-b2aa7981dc5f", "comment": "Malware payload (njrat)", "value": "c4f3bbf6853d19536468f94e91ec5ae892667e2eb89262ab45b922f19191cd41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569838, "uuid": "5fc43674-4504-442a-9e7c-470ba0a0ca03", "comment": "Malware payload (njrat)", "value": "8a767b4f2554fc650d1a0b1d83733b6d47501f42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569838, "uuid": "15612405-d8d2-4f27-86bc-265d2903abfd", "comment": "Malware payload (njrat)", "value": "a1f0a6b859f2bf051507f3a627914e7fa6fb42ab340440f229619c1522ff35975470c1c9e8b2633e2f51ead6e48789f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569838, "uuid": "3a90b5b1-7361-40a1-bb4b-c42787b04b8f", "value": "T1C3A3194B7AAEC419F07F8D728971E0A303B9DC8A7546CB0E54B33B5F97331824A63562", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569838, "uuid": "105b6a66-f25b-4529-a122-b339866e2c7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569838, "uuid": "6ec2ebda-19a7-474f-b075-23d1607743a4", "value": "768:tQNN9ZMTO1GV+xrM+rMRa8NuuQtksHdsnB+jDWUWFP2bdNkOCPJ1GktDZJZjNVhV:tUN9uq1Gwi+gRJNpv0TlWYTDCB1GI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648569838, "uuid": "30340472-a20c-42c2-8f38-ccefd5d36716", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648569838, "uuid": "cbbaa616-fb16-4c85-b415-57d3db7caf12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569838, "uuid": "e77a9b76-157c-448d-a33f-a6d16c402c80", "value": "a183b3c196f056819e70f74bb213f4ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de357055-af99-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648583593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583593, "uuid": "c93a17fc-807f-4022-b549-0766da08e20a", "comment": "Malware payload (Heodo)", "value": "0e2432b9416099c2ab1e5c1e5e71f1a2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583593, "uuid": "35c90424-c346-497e-b78b-2a9c72a162c5", "comment": "Malware payload (Heodo)", "value": "c52e93e91b5d59d300c8514569b22a800531880de8cf3da12f3bf4166ebb3781", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583593, "uuid": "26cb5940-c45c-4c0f-b61d-5d2abcdc40ff", "comment": "Malware payload (Heodo)", "value": "14c275dc717a11399fdedeb5e0b3936af6952d89", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583593, "uuid": "91973c2b-6e95-4a56-ab16-5851e6dcaf06", "comment": "Malware payload (Heodo)", "value": "4767226c6c951d0275685e82881ad2b5463b549aa280bc0229cb4121b5b1611c7fea36fe8ed5a88316a3d4c840ea3a78", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583593, "uuid": "fd28d704-b7fd-41f2-9454-b77a7a6f1573", "value": "T108B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583593, "uuid": "34a9c758-c70a-49b3-9302-1a14514600d1", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMp:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648583593, "uuid": "a2815b22-ea7d-4884-a84c-4d22287fbd30", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648583593, "uuid": "db772384-e7e4-4c5a-8856-7f5a4c8c2ac4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583593, "uuid": "656e0b6b-659b-4da9-b335-77a7e31a215a", "value": "0e2432b9416099c2ab1e5c1e5e71f1a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eced0a74-afa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648586624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586624, "uuid": "35fcb3e1-17e9-4183-bd22-4d0f2adb3c8d", "comment": "Malware payload (RedLineStealer)", "value": "2702d42b09026c0b9470e150c9acfe42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586624, "uuid": "68621bb2-f29a-4cdf-b8ab-345570d98601", "comment": "Malware payload (RedLineStealer)", "value": "c55d9e47dba11244043b2854f4be6295c02f568fc8c4ab2b22b1239d911062af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586624, "uuid": "37aa59be-28d4-4a83-86a0-ba325e081923", "comment": "Malware payload (RedLineStealer)", "value": "9432ea0ea248f07b63fac2051c2bf0b7a0e1ed7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586624, "uuid": "05e8ce04-eef4-47d2-95db-f54f0b6ddf89", "comment": "Malware payload (RedLineStealer)", "value": "df19197bccea17bbd84e8a96bacbf2edd855b97ac7abcd8c59928ca54a834b7209325f5c438f3d0398382969b2f4a5ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586624, "uuid": "d0d476ba-3a50-49e3-b8b8-f0dfce975bf2", "value": "T17994DF347689C832E01326309826CFB1773DFC61A96496473694371E2DB3A8DA6F635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586624, "uuid": "4fcc6ebb-5be3-4b6a-b6db-fa73aba9549d", "value": "4822b6a68dfa5df6456256144261d6fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586624, "uuid": "3dbe689e-2a37-4237-a03a-1442d7cb0cd4", "value": "6144:WLaJd3SQoNrfELgV1umUJbrrVy4SbKO3E+EpFB1uzbgwuO0RPnmXwVfW:WLw3SQJkUJb/Vy4PeyDunnwRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648586624, "uuid": "e409f442-38f2-42bd-ae01-88f0dcfe53b2", "value": 427008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648586624, "uuid": "8d9777c0-3492-4c79-8111-2c246cb9af90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586624, "uuid": "d74a1b61-6942-4fae-9a11-422aff27678a", "value": "2702d42b09026c0b9470e150c9acfe42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e69ed57-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648536993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536993, "uuid": "7657ebfd-6ec4-4676-bfd2-613cc0515388", "comment": "Malware payload (Loki)", "value": "179cfb300e21c52eadd56245dba16bba", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536993, "uuid": "96da9bbc-eaff-42d5-867d-08ab806b4140", "comment": "Malware payload (Loki)", "value": "c666b55e8b6192f3a374715ce78805670a5c346ac70dd98003e56441526177ca", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536993, "uuid": "884e88ba-255b-4dab-bbc4-5d4210e56760", "comment": "Malware payload (Loki)", "value": "4c2222e2d588c646af972b32e7e999fb8f0e48af", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536993, "uuid": "7dfe1c4d-7234-48c9-acd4-5a82f810ad0b", "comment": "Malware payload (Loki)", "value": "5fbe2e82fd21e515e91d9d909c4a189e1ba273ae481887bdae7f4626e5e86ae63e66f6d4a8fd3301149e21404eb774d1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536993, "uuid": "f9597c9d-d8a5-4e7d-9f4d-0fbc14aed7e0", "value": "T17D14124561B18215F68155F9AA1EDF28A2B9DF5EF809C155E3C3F1EF92B8FB30101236", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536993, "uuid": "696da10c-a6c9-4e64-ac35-31b9c5cc2ef8", "value": "3072:z8kMahcRDLfWx/d338mI+gOiftL4kYb0xnVAjykaumtHlP2AGlavlxIVSrB+JQfn:6ah2PcpDZifttYbkVAjbxmt4SBhOScnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536993, "uuid": "109acf2e-6e86-4f31-be03-71e87e37228a", "value": 193608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536993, "uuid": "70c55ce2-fce6-4100-90f1-6f82c5d8d715", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536993, "uuid": "bb36d8a7-8371-4942-9895-1211818074ba", "value": "shipping_documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0f9704-af53-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648553362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553362, "uuid": "3f582843-29f8-47d1-b499-21b96fdc281a", "comment": "Malware payload (Formbook)", "value": "39d533ec3a1ee376befbff8053e6d461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553362, "uuid": "fa473dce-d9bb-4abb-95d2-d1c84f1d5494", "comment": "Malware payload (Formbook)", "value": "c6dd676355a09f4eeec66ae24585cab8202225dd6837a431bba1d7dd25d042e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553362, "uuid": "0a812bcd-14b4-495f-9af4-4e5647b1dd6e", "comment": "Malware payload (Formbook)", "value": "e18e9ec24b23736188a3cd28ac7d7eaace75d507", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648553362, "uuid": "0f8ac966-d7d2-4358-ba37-bfe53b926212", "comment": "Malware payload (Formbook)", "value": "c17d515b12e5d46f0147fa32ea63559f8230f7bbdf30b000ffc5850abd0f96b47e37ba62c9c51cd68f22a88ec89556d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553362, "uuid": "39a59665-545a-4c7d-802d-803383b66b8d", "value": "T1E1350116B38EC812CA7E977AC4EA840083797D565527DB0D79C833FD1A323879D0A79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553362, "uuid": "cb71f9ab-b639-4629-a379-89ffaebf8982", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553362, "uuid": "6a4d2437-d3b4-4f9c-9961-9bce25b0be1c", "value": "24576:WOz/xHT6c9jo6W3HcvqZdkcTdWTNTN9TGY0EzzKXepvcGYnde5tm91BlUUq0/:/HT6c9dq7koWUEvKCtSe5I95VL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648553362, "uuid": "249e1e6b-f0c3-452b-ba4c-f37a2672467b", "value": 1145344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648553362, "uuid": "bd66869a-d201-4fc7-bb1f-ff66de673579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648553362, "uuid": "08269a40-cb5c-40df-b78b-985886a720c1", "value": "PEDIDO DE COMPRA URGENTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9759ecf-af24-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648533361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533361, "uuid": "46d098b5-d242-4633-adfc-6c206f33ba08", "comment": "Malware payload (RedLineStealer)", "value": "3c005b377389dde76c01122fb5237afb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533361, "uuid": "8b4fe69d-2951-4873-841d-f66ed00c25c6", "comment": "Malware payload (RedLineStealer)", "value": "c7b59ca8ab26858103d5245a2e26a6f3db2a4c28251ecedb3cfeeec38b8170e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533361, "uuid": "3b1a4572-2bb6-4787-9d9c-70c0a514bf06", "comment": "Malware payload (RedLineStealer)", "value": "8ca99aeaffd3e8c78b5ef22f271cf53858c59610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533361, "uuid": "5f9cd19f-72a9-4858-97bd-6d903ab26815", "comment": "Malware payload (RedLineStealer)", "value": "5e773c1e60ff00e3acad3cfe211f0ae7c8c07f50f21fb66ce110e6e234fc3514e00b304d04dbfd0413c0b7b7b5685150", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533361, "uuid": "a16bd555-16ce-49c2-b1cf-beb38de69f7c", "value": "T10AF44C9411C824B2F5E78B3386E4A932FE2E793B64F65A19345C234ED6196C0EC36F4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533361, "uuid": "b152e35a-73bc-4787-b41d-3e702139b0e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533361, "uuid": "78cb04d9-a323-4197-98d4-a6b1e45592d7", "value": "12288:zOCha6oWJkf9FgDHs8046F2DwWg8pynoUKgUg1dcKstbbSAXNz7+8:zra63GlmHs8ZUtF8Q+JwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533361, "uuid": "825645c9-63d7-4a88-80a5-85c2467f9416", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533361, "uuid": "82935abc-8692-4109-8811-56fd53ada215", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533361, "uuid": "38fe6ce4-7d01-457c-925b-53964b547ee2", "value": "MACHINE SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1b5724-af45-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648547408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648547408, "uuid": "c5c80a3e-9a7a-41cc-bbf1-d4e180a5a726", "comment": "Malware payload (AsyncRAT)", "value": "1e2d477a60ae105836fe2bb84843cd26", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648547408, "uuid": "a38450c3-9fc2-4c52-b615-9fc86de4aaec", "comment": "Malware payload (AsyncRAT)", "value": "c7bdbb500c40f13f255bcd55558dcbd3a059a6a7fb886df328a53fdc454a3327", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648547408, "uuid": "e750e6e2-972d-4eae-9081-fc0d9df63385", "comment": "Malware payload (AsyncRAT)", "value": "a00efd798b7c083a3d6b841722d2b1e25bbdb95a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648547408, "uuid": "d6a60d75-2b23-4cfc-9831-a2c45cd0a5f8", "comment": "Malware payload (AsyncRAT)", "value": "f6d74a81f7b1b1f5efdd95342138b0c150cb60e82683fe77369956bfe5a6bcd7bd5298414558b28c58deda5f73fc0191", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648547408, "uuid": "9f7ba56c-8b06-4d65-845c-394603c5b52b", "value": "T17274EA5A7A745132ED00CA3419F29E15D2EBEE6D2BE0551E24D8F66D1B322FE8F039C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648547408, "uuid": "7c0752ad-ceee-4fae-b4e8-340e7f5ad320", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648547408, "uuid": "53802c98-8dec-4a96-aef1-ee812ab73e2e", "value": "768:Ao6Qg2ZzEjss2VSg1I1cn0sspAgpq8hLyg1uMN0+dzsRs+eEr:CQ7qPpqOLy0uyL+fr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648547408, "uuid": "51fd6fbf-a7e5-4b60-bdfc-7145f71ad628", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648547408, "uuid": "b3b34cb4-2eb3-4432-bd04-8546825db34b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648547408, "uuid": "7e4aeaae-5073-494b-8623-b28dd895a953", "value": "POIN00043INBOMSpecifications Sheet^^^^^dwg.sc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc745c4d-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648573255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573255, "uuid": "38f1eed7-14e8-4fa0-9de1-785471186a7c", "comment": "Malware payload (Heodo)", "value": "a2085942445fdcc8ed01ef266f6fe0ff", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573255, "uuid": "0586b477-9d74-4da7-974f-aabbcac71d5f", "comment": "Malware payload (Heodo)", "value": "c7ca281decaf5be724eb03919f4da30b83e1092025a613d181bf844a0ad6772e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573255, "uuid": "bdc15950-380a-4a91-a5db-42a605095604", "comment": "Malware payload (Heodo)", "value": "033c31948b9dc5052f6266c64f9cec9178fb7f65", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573255, "uuid": "6d98d6c6-709e-487d-bf46-ba2dbffcc268", "comment": "Malware payload (Heodo)", "value": "a615fdd900fa18099d1bc14ed412296f552ee1be05286cb18d29ef99101b5e5a5f8229117e995a83a46087187b99beba", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573255, "uuid": "0f75c535-fbb8-4ddc-953b-d284ba2ad98b", "value": "T10CB39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573255, "uuid": "aff32fb9-8191-4985-8a13-db491b9130b6", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMV:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573255, "uuid": "b56f6700-68cc-4378-8336-4bfbb65b4446", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573255, "uuid": "b01b4cab-cd21-4542-9b52-dfb12a831339", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573255, "uuid": "87f6091d-2bda-491a-b83b-7f36cf57a0e5", "value": "a2085942445fdcc8ed01ef266f6fe0ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da05ea66-af57-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648555239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555239, "uuid": "2bc0f96d-0315-497e-8578-5a2465951d85", "comment": "Malware payload (Heodo)", "value": "71ede4a29727c28367ddb048fe3327a4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555239, "uuid": "401f0b60-7569-4960-8309-9079704f4c83", "comment": "Malware payload (Heodo)", "value": "c81f00c5bcacc87e5b4afa3eba7f2cd542a4853870fab8aaf22a754704a917bb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555239, "uuid": "7b4b54d7-e405-4f7a-a063-43b2d344588c", "comment": "Malware payload (Heodo)", "value": "2cc19bdbd8f84564f74bf81a0815d241e6045b0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648555239, "uuid": "79be55e5-7e88-4fb5-864e-c5952e4b8f7c", "comment": "Malware payload (Heodo)", "value": "d9fe0cf3306c81e132fdd74dcb0fcd8f897358e881ca16909a670d36f87ea10e49105c6712ef3ee586656fa3749c9b43", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555239, "uuid": "6f0e0c2d-7ed9-4950-8b90-a00dac87a337", "value": "T133C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555239, "uuid": "8a259267-922d-48d2-b2b8-41a390dc1f11", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555239, "uuid": "4924d48d-5e97-41f4-9dd5-ecbafd1f04c8", "value": "12288:iUV7ciwHX3ew9aYU3poc9inFijaQeL+nZBb:UiMX9I2ky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648555239, "uuid": "e9963bc1-9bf4-4901-bb05-15bb0552160d", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648555239, "uuid": "fa32b865-18af-426e-b862-ed817ddc8bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648555239, "uuid": "22a7a70c-f756-4d9d-b7e8-0dc469b019d9", "value": "AFW5IHXV5ZvJ2zYAXUnF9EoLACuu2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffddb172-af7a-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648570335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570335, "uuid": "a9989ece-ffca-44b4-a335-26797696835b", "comment": "Malware payload (SilentBuilder)", "value": "1cdcb1abdd9f3cb8dbc0aa6f15c6b7ce", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570335, "uuid": "ca984abb-b8ef-4bda-b279-0428ea8edf29", "comment": "Malware payload (SilentBuilder)", "value": "c91a2d9cb0aedca19f7bd35a82dc1ce3adcac6f041046f60286048b19c025276", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570335, "uuid": "0f8d346f-4426-454d-8772-78a49ecc6a32", "comment": "Malware payload (SilentBuilder)", "value": "e43ecc3b5a0e173ea182399b3d368ec1f5b87bef", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648570335, "uuid": "64aff05d-29fb-4c12-82c5-6183740cb295", "comment": "Malware payload (SilentBuilder)", "value": "bb89f42c13b0098cd4bca20d842479940e2a7d6ac05368bbd1e643892d1f9022cd941f633e776bd972e646ff254e1a45", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570335, "uuid": "bc03e864-8012-4f43-a725-032563c592a0", "value": "T1D9B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570335, "uuid": "7cba6d6c-e6ec-4069-a186-7265b3c822c1", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMF:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648570335, "uuid": "3e04d08b-6eb0-47ef-8b9a-8264cb8efa93", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648570335, "uuid": "f789cf0f-1f78-4aad-aa60-b83e22c13ac1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648570335, "uuid": "c9ba3195-109a-46e1-aa5e-98e32d7b0bf6", "value": "1cdcb1abdd9f3cb8dbc0aa6f15c6b7ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1077c16-af73-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648567196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567196, "uuid": "4dd96dda-fc34-4d72-a2ee-39166fd70c70", "comment": "Malware payload", "value": "6dd7822ab464b1ad9384aaeb759cc106", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567196, "uuid": "676c63ac-dc6a-4b48-a438-82de65965ebc", "comment": "Malware payload", "value": "c95b25f8ee7c2ccdc331d63a9239b4c48b06435b6a1e9dcdecf52909313639b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567196, "uuid": "1e8e2f60-0a73-4b55-b109-894c09020c0f", "comment": "Malware payload", "value": "1de847df1728ba53dca4573027b828701f9c03c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648567196, "uuid": "00375f04-2489-4d82-9e24-1e6b3c8cb242", "comment": "Malware payload", "value": "4f5296829a16b7fe0a307a6bffdf3da59918b0b0c55ebdfc79c9cfc008dc6f7afa3e4edd5bd474c13a56d2b9dcf9e558", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567196, "uuid": "ac773a9d-a6fb-4388-ab7c-940dc5fa64fa", "value": "T1A0351212F2A84EAAC57216F90D2650006377F72B511DD70E29F9328F2D77BC28166F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567196, "uuid": "94b5f901-95ea-409e-9471-891a20a3a6e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567196, "uuid": "cbca48ad-c5f6-439b-a186-24dadd0f7d2a", "value": "24576:pkgjjI8CixF3QbHlXo+tJiJaXX2HoLzWsbQ9+gsP8sowZuay:ptMLixZIHlXoSJKaH33W39+gFscD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648567196, "uuid": "f6662d8d-0d8b-4f59-a8f5-6d6f1f8084b8", "value": 1098752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648567196, "uuid": "033880bd-7d43-4267-882b-3555b4f1bfd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648567196, "uuid": "a943faed-9bbe-4390-a486-02bb450d96c6", "value": "AWB5032675620_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b1ed05-af56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648554863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554863, "uuid": "875fdae4-4628-4b17-bfe6-8db00119191a", "comment": "Malware payload (Heodo)", "value": "f654caf53af9c14adee17a7e6c614559", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554863, "uuid": "a420c4d7-dd26-413b-a98f-22f1e5aa0422", "comment": "Malware payload (Heodo)", "value": "cacc1dda15ba8a531c3c4b98db3e88869c813d9a442c9d9763c07fe5f3a0ee66", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554863, "uuid": "f04a7d09-fe1d-4bd2-aa9e-fd54adee08d3", "comment": "Malware payload (Heodo)", "value": "0644fe7526a98369148090d7bee9601fc2138032", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554863, "uuid": "a2f5c520-971b-49fc-8f21-f90e8c86754a", "comment": "Malware payload (Heodo)", "value": "307e6629a4630a3b3e2728defd95d3d54dc04688c7f6ac6dc483c3ef2d77c364dc478ae32eb26cdeebf3dcd4031fb163", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554863, "uuid": "766b9e93-7577-4c39-9a08-a9638f098798", "value": "T1DEC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554863, "uuid": "02ead318-383c-408f-805b-290c72636302", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554863, "uuid": "d600e243-2b55-4584-aeb2-a3466084be6b", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554863, "uuid": "eb624176-9837-4b3a-ad1b-ae52b804f798", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554863, "uuid": "7d7fc70a-b675-44e5-bc10-5d0a8b76a79e", "value": "imedpub.com.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9521e7a-afa9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648590510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590510, "uuid": "b8a31bfb-aced-444f-868f-9a0db52efd14", "comment": "Malware payload (SilentBuilder)", "value": "fb901de82429fd481f208b6f2f052341", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590510, "uuid": "708fa9f4-9673-4a3c-808e-25bf53c971ac", "comment": "Malware payload (SilentBuilder)", "value": "cad159477bdcc1a893cefc1b3c89fb0108c077f05f516817b1d9b1c226df132b", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590510, "uuid": "341d752e-87f5-48a4-8780-d04c205a13d2", "comment": "Malware payload (SilentBuilder)", "value": "90a717173912af3db9357c5cb47e8ac254547b16", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648590510, "uuid": "ac615c63-8e07-4b89-9f60-9924772e6cc7", "comment": "Malware payload (SilentBuilder)", "value": "8c220374ba66ae69e5090842a6bbdb59611a0073500618f52215ebd0f285f4669a102d73c268da0a4e79590398276b85", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590510, "uuid": "47386f75-6361-4aae-a55e-2f15974a09c4", "value": "T17FB39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590510, "uuid": "62e157fb-6b2b-4101-a102-7a0aade9e905", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMS:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648590510, "uuid": "a76d6cc5-3018-44cb-a484-8d00a7b3308d", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648590510, "uuid": "9b0e7635-73ce-4315-a578-b5313494609b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648590510, "uuid": "68ff23d0-13d7-4921-9039-e286b0839b5a", "value": "fb901de82429fd481f208b6f2f052341", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abf90fc-af62-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648559616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559616, "uuid": "6dc5a5df-9276-4e2c-8808-e3022464b7df", "comment": "Malware payload", "value": "685f0e2b9891015fe5020b5f9af005a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559616, "uuid": "e9b1e241-0480-44cf-a59a-261c2b56a073", "comment": "Malware payload", "value": "caded7f42e31a82d0e93b287b5909b2dcaca736709cb74e054586ced25c3f8c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559616, "uuid": "554f1e2d-1db6-41bf-891b-b6d8a4a47cb4", "comment": "Malware payload", "value": "175995d03a338ac4ce4b06ea23530bfab9c30e34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559616, "uuid": "aac80747-16b9-47a6-b421-4fed1a9eb325", "comment": "Malware payload", "value": "4fb8569658e81bb3d69e7fb012b58fa69a1cf8eb3937c3aa88072aec142cea4f13350b14e73119d065d80cc657bcd9e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559616, "uuid": "d6241316-3f8d-4819-a98b-3f6ef4400bc7", "value": "T17B346C6AA2E50A96FD7BD6B9CD53C227D7F238451B64C31F13B0CA965F47321B218342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559616, "uuid": "51dd715a-7a15-4013-a58e-e3974fda1d6a", "value": "6144:qyihnaKbEFhck6xW3SJ5gtS3z9pjFAlkkO4aOpf:qyih1EF2k6S/SD9pylkjOpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648559616, "uuid": "32529fc6-6a63-4f07-9210-70f062d63af4", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648559616, "uuid": "525b12a0-c104-43ef-b855-c944d584f0a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559616, "uuid": "98172044-9bb0-4bc0-a6a5-7ab1d4b78cdc", "value": "96c0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7075b1f3-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648537023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537023, "uuid": "db71574e-1cd4-462c-bb89-d5e4626b2dce", "comment": "Malware payload (Loki)", "value": "c09749d1c2e92c4de18cefb43bee053e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537023, "uuid": "1fbd6152-286a-4c4a-924a-a6a74b59ab4b", "comment": "Malware payload (Loki)", "value": "cb6f53e1630b71e9b876fb84ddc8991804d8bae61ed16634058d97d63cdb9597", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537023, "uuid": "25c0ae94-711c-4846-98a7-059eba5a1c3b", "comment": "Malware payload (Loki)", "value": "7fa991f7deb17b1fdc8cd76b92922d6f925864a8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537023, "uuid": "47544382-4e90-490c-a0a9-724ebbbf7145", "comment": "Malware payload (Loki)", "value": "ac864f5007118c2c4d6468277418e2929562c8b7d72c0f5fec734c3963dfb045d1c4104235ea6629285ccaa3f877c1e4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537023, "uuid": "10df58d1-1486-4920-ab72-4258a1793abc", "value": "T1431412C473A5E488D3FB113DA858864D56BF8FE4AEB96080944172D9C83D88D7FA0ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537023, "uuid": "ba047d18-ecf4-4590-869e-b5ca7a168ac6", "value": "3072:pIbXLbfHuJ1hX+F8RYLFTepu5ryF6USRKUkibbtygrOcUNt32sIHF1VP47KY5BqN:uGJo8qReK2F7SRKUk0bYgrlCANYYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537023, "uuid": "f70c3f35-435b-4dde-8a3f-879451826977", "value": 193624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537023, "uuid": "b0a3fdee-88d7-4a27-9efb-b1e391e94d6c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537023, "uuid": "94efe0bf-be9c-4065-8edc-9d02fec36c42", "value": "Bank Report.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44bb118-af35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648540653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540653, "uuid": "1a3b1fb2-6854-4c42-84f0-06f0e195d6ec", "comment": "Malware payload (Heodo)", "value": "6d30b77214d396c5f2f367198a4d022c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540653, "uuid": "7ca286f9-3408-4447-aee1-b7d0c888d3d6", "comment": "Malware payload (Heodo)", "value": "cbaca6f3e0b9d22f6ffeae8210a0749dd25c0b19ab2f56c2b66f1bede6dcad8f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540653, "uuid": "781b6142-39d2-4b55-a67f-9119288653aa", "comment": "Malware payload (Heodo)", "value": "6c7377177a8921035466dd5c1e8b7ac4e6c82d6a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648540653, "uuid": "affa9a0e-1835-42c3-a751-a4a036d215fc", "comment": "Malware payload (Heodo)", "value": "975fc487dba8d4756cddb26c03051711bb52e21238581a3dc96317148bf1b578aaa85aabdfc3259c17fba4ef76ddb225", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540653, "uuid": "fe0257e5-02ff-4d72-9d38-ac1482181d5b", "value": "T16043E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540653, "uuid": "431dddfd-a62b-4236-a6ed-43c3f12018b0", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvT:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648540653, "uuid": "e09ddf66-4299-4142-9777-15fd0cd82f03", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648540653, "uuid": "264287a2-c3de-4743-bcba-c1735662712b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648540653, "uuid": "528a664e-43a9-43f8-8364-a3325f0a7c35", "value": "Opast International.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258d5934-afb0-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648593162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593162, "uuid": "c22f2719-e149-43c5-a388-e956cfc74711", "comment": "Malware payload (SilentBuilder)", "value": "47acad1e027c3704c5eb1176ac4d36a1", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593162, "uuid": "4a8a35c3-e6a0-4e2a-82b2-80f53bad98b7", "comment": "Malware payload (SilentBuilder)", "value": "cbcd73a418e0bf221cabd2fdbdd72a9ffb59774bc3a8a94d5a5ba7c6849a8451", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593162, "uuid": "1081ad2e-5c93-422e-b4c8-723f7c8b6b6a", "comment": "Malware payload (SilentBuilder)", "value": "d94501aef299511fc266246a9f00916cb5a30b87", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648593162, "uuid": "341e26f4-5e78-4b5f-a325-c892d11af49d", "comment": "Malware payload (SilentBuilder)", "value": "f382b101379bfafac1f4ab054bbaa33cfe15d17249add7c96cd53a39fa3f9edd732b43a5b9ff2186dda97dd7502d1fab", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648593162, "uuid": "0d64a574-0590-441d-bd14-07d88559e8db", "value": "T1F0B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648593162, "uuid": "dc0c9aec-720b-4c96-8072-bf22bc2d3a44", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMi:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648593162, "uuid": "27480213-a435-4f2e-9801-e43be0099aa3", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648593162, "uuid": "2016a56d-297a-4134-ad15-99d3f23ec790", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648593162, "uuid": "53b26d3b-82b5-4edb-ba05-a38b1b05bfdd", "value": "47acad1e027c3704c5eb1176ac4d36a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b6ad71-af85-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648574888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574888, "uuid": "050e5d7b-703f-420c-8edf-3809812e0300", "comment": "Malware payload (Heodo)", "value": "239211e34e20233b2b88b5b00e26790c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574888, "uuid": "1db6e40e-2510-4e37-a2e0-aba028b69e7a", "comment": "Malware payload (Heodo)", "value": "cbcede8f11cd11a000a3cacdb2f90dad851c5bf2f044c35f39da9ce39923ca7e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574888, "uuid": "46a1d795-e9fd-4176-80f9-341c7144196c", "comment": "Malware payload (Heodo)", "value": "2707946fc7033502f241185c0c05435483d14b37", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648574888, "uuid": "4315c7a2-9a3b-4d6b-824c-04a58ca69dcd", "comment": "Malware payload (Heodo)", "value": "d79c2ddf43b9ac771471f4e2382d4b17d7e5ef7e885a80b007431c8c790c29f9ae7629d76d48b535c3170b293104e905", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648574888, "uuid": "40545f9c-475b-4c84-8a1a-430679ec1120", "value": "T108D45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648574888, "uuid": "a953f740-9ff6-4199-ab10-3eb8b6f02660", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648574888, "uuid": "d1eb4b8e-8b9f-4ed1-a599-d9b97c9bc5f9", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzMipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wnooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648574888, "uuid": "a747c55d-cb5a-4dab-bc2e-c6b65aee798e", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648574888, "uuid": "0def327c-1017-4730-9c32-3f06868a5ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648574888, "uuid": "7ea59141-8284-4c51-9dd6-eb4cd54fe004", "value": "ETfQrfyVK.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0add28b-af7d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648571544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648571544, "uuid": "24b7cb98-a133-4c7b-aba3-16da827214dc", "comment": "Malware payload (Formbook)", "value": "4899e738fbcf5935be63cdbf2bc70c28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648571544, "uuid": "3c6750a9-7548-4cb5-90ff-3cda60ed42b5", "comment": "Malware payload (Formbook)", "value": "cbf7dac8ee4dd46d48f7a0d6f0495d3d27ef5319fd05ace04aea7bfe96fe99c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648571544, "uuid": "e9914900-236b-41dc-b0c5-21e80faea74b", "comment": "Malware payload (Formbook)", "value": "44327c8e26a7c662c36799c22fb683e1151371c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648571544, "uuid": "07a9cb7d-edfc-4f13-afcc-c4d13454ea5c", "comment": "Malware payload (Formbook)", "value": "d8e6ea47eed6115bb3c7d4e3577f5074c0eff610275311cb318f3d144ef12c31da7095e69894d4ab9c0a114ff7d7eef2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648571544, "uuid": "83db5242-2c79-4a6e-9f52-363130a348f7", "value": "T151351211F2E80AA9D56B52BA693184002376FB2F420DD74D29FA718F5E767C30067F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648571544, "uuid": "55624118-7c90-49b9-9a4c-c924c6fdea45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648571544, "uuid": "99af5629-f64d-4aea-b67e-c47693da1d05", "value": "24576:4gjj045Yj+7u4phqp97cbNRElmDQWm8Goavdx6qL7XhM:59A+i4phqpFcbNRImpGogju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648571544, "uuid": "6687af1a-eb55-4e95-91e0-60fa881fe7ad", "value": 1084416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648571544, "uuid": "d901b3fb-6dba-4f92-a4ae-629732a4aa4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648571544, "uuid": "cf2fb7bd-aab7-48fb-a955-24ddf44e3061", "value": "IRQ2207799_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f6237a-afa2-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648587253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587253, "uuid": "e8d3364d-bc86-47bb-9919-e6d64b8b3cc9", "comment": "Malware payload (SilentBuilder)", "value": "b0401befafefb043525b583d1ce55a75", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587253, "uuid": "871e861e-ca63-48f1-85fd-9a151d36a930", "comment": "Malware payload (SilentBuilder)", "value": "cc266b9401d5c5d656b33d57ed8d5741a00fb44191f189b3b9d47b24a7ea537c", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587253, "uuid": "7bb3d29c-f611-48ab-ad9c-d0172fb84b81", "comment": "Malware payload (SilentBuilder)", "value": "f732dec8a16caecd6d176eb7709ca184c70272ff", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648587253, "uuid": "85b81b6a-d2ee-449c-a39e-aab70c3d0676", "comment": "Malware payload (SilentBuilder)", "value": "4db681c5ccd08f0e93ee35f64f74879da47068e8ccc625fdd2eef15ea2eab66d44416f00d6513c680600f4da9dba47e6", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587253, "uuid": "c3c71455-4394-48fd-a99b-b94adde81cab", "value": "T103B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587253, "uuid": "e26f5e23-33e0-44d8-9f10-fbb892916c5c", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMO:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648587253, "uuid": "8f726ae5-57a7-444f-8136-5d26fda31c22", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648587253, "uuid": "d306dc54-e340-437d-872c-54c50a193fb7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648587253, "uuid": "54892d5c-e2cd-4754-a25f-06ef50faab67", "value": "b0401befafefb043525b583d1ce55a75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa80f3d-af64-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648560752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560752, "uuid": "322acce8-2645-4191-8e7a-4e6e71b728c6", "comment": "Malware payload (SilentBuilder)", "value": "4b43497bedefd9b902cddece3fd8e695", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560752, "uuid": "b7ec78ba-5d61-40d1-85a6-cbe5fc91953b", "comment": "Malware payload (SilentBuilder)", "value": "cc2a902f8992bc962a998b9237d9515197bb30dc62dabcf6288f963d9935afc0", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560752, "uuid": "0caef075-50db-45bb-85dc-894a30f21fad", "comment": "Malware payload (SilentBuilder)", "value": "f72bd7eab76510b978667eea02194dc7316267f4", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560752, "uuid": "4a11fdec-c30a-4370-968d-2e2b69452ba0", "comment": "Malware payload (SilentBuilder)", "value": "4caafe7d0892576758981ae9ee4c0c14663af8c10399dbead60c03161234bef654893aad5746f76dccbacb98ab34a3bb", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560752, "uuid": "031c8a2d-1387-4a25-af13-afb11111054d", "value": "T19AC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560752, "uuid": "93bd1550-dc20-4303-95df-bda6219710ed", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCI:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560752, "uuid": "3b3d525c-5c38-4dfa-b7c6-a185e2f4c883", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560752, "uuid": "9d9c2614-01fe-44e9-bd35-0b006f6db037", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560752, "uuid": "7ab7a048-8340-4dbc-bd78-3ec9856b39fa", "value": "4b43497bedefd9b902cddece3fd8e695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5f5990-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648573284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573284, "uuid": "e68332e6-3d83-4b6f-a2a6-73ab3c655913", "comment": "Malware payload (Heodo)", "value": "5c55bbba4fef7ec322ea5fd2ca90c53b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573284, "uuid": "11bcb46a-171b-49f7-a486-08af7f32896a", "comment": "Malware payload (Heodo)", "value": "cc8c164f7cbe16f316abe9aeb5c3088ab1d435973f2578b599749a9647c0b8b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573284, "uuid": "c664d905-6751-4ef8-af63-55e3f34f6ba8", "comment": "Malware payload (Heodo)", "value": "6b4b38ee399c9091151f8faaa5c5398434fcb10e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573284, "uuid": "026a2308-4ee4-4c9d-9af7-4595ac363d4b", "comment": "Malware payload (Heodo)", "value": "cdcc812700287c34262784d597a55478e271181db32676e637e5b68b4a277bae4161743f342541e306c5e79219ed6249", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573284, "uuid": "59810504-6e40-4097-800e-ef1ce3c5c756", "value": "T156D45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573284, "uuid": "0c87a7b5-8417-4866-9a64-b2627ab4d657", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573284, "uuid": "3b10d677-b4af-4c20-89d9-0b72eaf80b7f", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzpipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wKooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573284, "uuid": "3bbdef56-a8eb-4ef0-9fed-aaaa5732a846", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573284, "uuid": "45a751fd-6c55-4dc9-8d0d-abe401ec025e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573284, "uuid": "2e9090af-b469-4451-bebf-5c52e4ec2d4b", "value": "5c55bbba4fef7ec322ea5fd2ca90c53b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45c9ec8-af6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648563793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563793, "uuid": "b0f37630-fc00-41f8-851a-331f6b6bff61", "comment": "Malware payload (SilentBuilder)", "value": "5b5f0158936771dc15b93cfeac6d4e6e", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563793, "uuid": "20bfdd59-b420-46a7-907b-444351452f50", "comment": "Malware payload (SilentBuilder)", "value": "cd32e333e92b40b50d7b61743560ab0d277e876a322aec89751f2019638137d8", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563793, "uuid": "4efa7a6c-d643-4943-8612-2e5e3a7ddd5b", "comment": "Malware payload (SilentBuilder)", "value": "7ab861b4ac427c55b333500a33ef318a9d7b82ba", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648563793, "uuid": "f33b6cd8-a763-4e7c-ac98-84741e2610cd", "comment": "Malware payload (SilentBuilder)", "value": "74fdc98af4663d8a6d41bcad3591a998057220e761c00908f6f90b17607648650e26cbafe1a1c1af0e28b1f98a99ba44", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563793, "uuid": "a88e509b-a47c-4b89-bbc2-74d2463e593b", "value": "T118C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563793, "uuid": "b7530441-d9c8-4b62-8ee5-21a47e3cbed9", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCc:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648563793, "uuid": "5bf8fefa-f3f9-4bdb-b9cf-e91c0fc6360e", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648563793, "uuid": "f871a8e2-5af5-48e6-9cf6-9cd13a0c8b92", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648563793, "uuid": "0cfc1dba-8aab-49d7-b192-9fb283050711", "value": "5b5f0158936771dc15b93cfeac6d4e6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc617c6-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648573227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573227, "uuid": "eef16ac4-9c6d-428d-b77a-ec82e35265f8", "comment": "Malware payload (Heodo)", "value": "615b0c23659c83878b43e3573bb76b28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573227, "uuid": "5bc9872e-973c-4743-9e1e-ea6ad3093b8b", "comment": "Malware payload (Heodo)", "value": "cd565bf4d6f2704de80b6499dd0b97edecf129325b9def07f69818aea05c7d63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573227, "uuid": "8f5834cf-74d3-46f7-85b7-27355093045c", "comment": "Malware payload (Heodo)", "value": "8b7f3c92dfbf6d80bb59367ad8a1ba61b3c44a93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573227, "uuid": "e4c1cfb0-e2af-429b-b3da-eb521a6a8fe8", "comment": "Malware payload (Heodo)", "value": "85dbaad494763dbf2eda61acad42da22fa6bdafddb61dc066284ec2486989b174b53dd2e60128dc76f7f4f0dc7a0eb5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573227, "uuid": "18afe6da-e1d9-4aa5-b382-13d87f20f28c", "value": "T1FDD45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573227, "uuid": "c43ca536-00a7-403b-8e46-71e378645489", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573227, "uuid": "e06c52db-fa0e-41e6-a773-7ed62acd6055", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzuipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wRooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573227, "uuid": "bb37f54c-debc-4921-9003-9cad8766f711", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573227, "uuid": "2e073a17-d49b-4514-8820-ca9c120fd3b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573227, "uuid": "236dbdf5-c84f-4bf8-a3aa-01ec076938ef", "value": "615b0c23659c83878b43e3573bb76b28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613cce1e-aef3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648512087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648512087, "uuid": "741366ad-693b-4ae7-a5fe-954727d67d76", "comment": "Malware payload (Heodo)", "value": "45cf45270b5c719f7b83c830c0ac6272", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648512087, "uuid": "63531ef5-3996-41be-a0f4-c989049288a5", "comment": "Malware payload (Heodo)", "value": "cd986dfa2589840ee4d54fbf6bf7031fcca763056dc2a06d54ae6914aad4ac86", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648512087, "uuid": "b9714a5c-4495-4d86-af11-49349de6d080", "comment": "Malware payload (Heodo)", "value": "3f3e23f281c1afd7a8a1700ffb85042fda752886", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648512087, "uuid": "714b7fc6-be33-4b09-8ce0-141d9ce4ab31", "comment": "Malware payload (Heodo)", "value": "c15faa4e9614e1e85c4f0fd1044fc52bf0f492fb43a73e23353213a5f8b810b478b2fcd05b9632f5990a5fed8f1a6ed6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648512087, "uuid": "d30c1b83-7528-4359-8a31-2f10b5dba2ec", "value": "T1AFE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93FBFCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648512087, "uuid": "04b3d1d3-7e91-403e-8e56-b3cddfb3761f", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648512087, "uuid": "00be5749-87fd-42ed-b51d-4868cc1863f0", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv75vK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zvCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648512087, "uuid": "319349b7-dfd3-45c8-8f6b-fddf451ca7f1", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648512087, "uuid": "b08e26ad-0067-4a6b-9b05-81e52208943d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648512087, "uuid": "d3ec21f8-16c5-4bcc-9f02-17a234613b5b", "value": "emotet_exe_e4_cd986dfa2589840ee4d54fbf6bf7031fcca763056dc2a06d54ae6914aad4ac86_2022-03-29__000122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c816ae4-af2e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648537419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537419, "uuid": "610bce9a-74f0-4050-badb-36acb3ceef6f", "comment": "Malware payload (Formbook)", "value": "a951b649e21ee0fb394e2ff9f7361210", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537419, "uuid": "60814619-9038-40d9-a414-ff42c70d96a3", "comment": "Malware payload (Formbook)", "value": "cdd772fd3c4299298b8e84472d0b2c20531885a77cfad41495d56337c567a88b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537419, "uuid": "0811a5ea-b038-40a6-9c19-09ec4c318334", "comment": "Malware payload (Formbook)", "value": "b1c4ac92afd7d22d1ceb28e9f697d2298bbfdd53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537419, "uuid": "618388f2-78fd-4aef-bf6c-c584aeb3e0c4", "comment": "Malware payload (Formbook)", "value": "9cbc0ff55b6478c1095c64e907c68304e90ed6dfc0578531ba61989f4aaefca8e4faa20e09c2211a2194cbfdba0c9465", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537419, "uuid": "639fc773-78a1-40d6-a368-65cbd0ff8a89", "value": "T1BE25021423E8D581EABE97FAF4B180105B74B91B2537E32D869578ED0FB27C18A1B317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537419, "uuid": "48f66191-74e4-4e6c-9cbe-e456aeeb5c78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537419, "uuid": "42c8df75-82e0-4ade-a334-cdcea15d8fa2", "value": "24576:jaUPde3PY0e9Vo8qnHzxuPsi+FfkuVJ/JIlp2gt:jaUPde3PDoVo8qnHzxQv+Ff3/JIlca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537419, "uuid": "8e5fd5fc-9da1-4d98-8d59-3c99cc2a32d0", "value": 1051648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537419, "uuid": "6efa7f45-b2f9-44f9-bcda-dc6a264448b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537419, "uuid": "85e1693f-f117-4aa1-b5e8-b9e53acbad6b", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a930ce13-af64-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648560741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560741, "uuid": "6105f7e2-be6b-4f6e-b8ef-eacf419775b4", "comment": "Malware payload (SilentBuilder)", "value": "60d663ee73ab2f2a92a65a15f58e351f", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560741, "uuid": "5e328cf5-e0e7-461c-94f3-a6bc09df1dc6", "comment": "Malware payload (SilentBuilder)", "value": "ce02e41808b365f48b114eaf5535228642153bf451052ff09882218831e176f1", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560741, "uuid": "0df0fa6e-8dd4-45e2-8421-82e414530395", "comment": "Malware payload (SilentBuilder)", "value": "a8391bff90cb118ee29192737b3fbec37bf4b23e", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560741, "uuid": "2dd42eca-2790-4eb5-a285-05ec8eaea565", "comment": "Malware payload (SilentBuilder)", "value": "b3c4608373c5a4856a7423432455a30398944c62f8400287419b25937f41dc9ca1b2938ca10c63435ac855ac18d4fbf0", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560741, "uuid": "b7020fcb-e4d9-4631-bbeb-59ffe42e2eb6", "value": "T120C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560741, "uuid": "8df9570d-9820-4b34-a870-b8e80b0d59d5", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCo:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560741, "uuid": "2ee359d7-53f0-40d7-8521-4601faae06d9", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560741, "uuid": "7f882fa5-a787-47ff-8691-9536f72236f5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560741, "uuid": "b038642d-624b-4d56-b42a-5d85db1f5c98", "value": "60d663ee73ab2f2a92a65a15f58e351f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386621a6-af26-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648533923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533923, "uuid": "7fed88e8-9035-43ef-a733-0b80bd2413c5", "comment": "Malware payload (Heodo)", "value": "12d8d37314c0bdac2b53ea5adaf00c8a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533923, "uuid": "af4cc3a1-94ff-4ef1-b5a0-cf65dde3ba3a", "comment": "Malware payload (Heodo)", "value": "ce1073b6cd899cdf82bc7a5aa2ab7dbb0725f728222accabe24bc4706fd64e4c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533923, "uuid": "f481c999-ec27-40ec-8d18-857322e53e2f", "comment": "Malware payload (Heodo)", "value": "fdea30d854a89dd68d93f24b5c5787b76e9f9264", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648533923, "uuid": "e7335584-826c-4fff-aafb-ee6a29163dd4", "comment": "Malware payload (Heodo)", "value": "3acfc3b74cb258cf3f4010daa759fe3316075a7d938b9185f181b198ee324efed153c7838ad9306af1eb0bb0eae189c2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533923, "uuid": "cb2a803f-6c38-4656-84c8-6008925494cf", "value": "T182C31911965A01A5D6A6C9700CAD72B8D37EBCBDDB34DFEB07D1ECCD5931681283222E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533923, "uuid": "3e101f13-da0a-47d8-8f1a-6f4fb98751b9", "value": "92611b2610edfbf2072755f0e925c7be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533923, "uuid": "7f27ba9e-8f77-4ce7-bf41-43289b8a4a43", "value": "1536:oRmjeDhuZGhzbuAgOcQA6uPZigPIWTyyEIPekIEfr0nd:oRmjeDsGngOcnVRI+J2krf4nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648533923, "uuid": "5deca114-ace2-469e-9e9c-dd133a4609af", "value": 122973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648533923, "uuid": "abe74cb5-18a6-463e-a7a5-8f4142839f77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648533923, "uuid": "20dec19f-4509-46ae-9e7e-526527b226e8", "value": "90adjsmk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9715df55-af21-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648531934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648531934, "uuid": "cd5bb427-5cfd-4120-a4f0-2a237a297b04", "comment": "Malware payload (AgentTesla)", "value": "edde14098f1927932ed283eac23b73c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648531934, "uuid": "29c39df0-0231-41a6-b995-ee5dd7455df3", "comment": "Malware payload (AgentTesla)", "value": "ce6df966091d0a4c305d5629d789f7ed072d01b8b4559d6356ed1643454e2427", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648531934, "uuid": "997d7511-ca9f-4a27-be3e-9c827f7999c0", "comment": "Malware payload (AgentTesla)", "value": "a324086702641e6c6bf8c9b3a3cc76d8f4068ac0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648531934, "uuid": "7b37d105-f889-4e08-9a62-4c820f1ddbcb", "comment": "Malware payload (AgentTesla)", "value": "07be7f35ae3ff53c354d2a07b49da3fc22b85681aa5d46b28b46bd507b19b33ca5fd64f0e543f9f6563ed8966f5afb14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648531934, "uuid": "8e71e965-e055-4798-a0aa-771bd8587630", "value": "T1613512681BF88550EABE97FBF4B440108F71B51B262BD71E81C168EE0F267C1961B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648531934, "uuid": "bb2ffa33-9690-4873-b260-b6d86b1807d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648531934, "uuid": "77f7ca3e-7fc4-49da-b546-eec94139ffbb", "value": "24576:SoeNPpwtkHCkfmdcKOMqD/FTgEWL5yokCeYOi58xLCF:SoeNPpwtkHhfWGMczQl3Oi5SL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648531934, "uuid": "f514df87-04d7-4154-a14b-1e1807096419", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648531934, "uuid": "dbdab7d9-1412-4afc-a838-acd97d6fcc54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648531934, "uuid": "a96530c1-5769-4b93-ba2e-447c007e8305", "value": "53209812.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111016eb-af31-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648538581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538581, "uuid": "0b51ad99-b1a1-413f-ab40-789102f9515d", "comment": "Malware payload (RedLineStealer)", "value": "1735d663fa62a2b4ff481c783404ab07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538581, "uuid": "64f87ec6-43e7-4ed3-b450-e4ede68b1e65", "comment": "Malware payload (RedLineStealer)", "value": "cf0f1aa6daa5e46b0a8a0ab76ed31b54a96c6125617ad0d0d508d08df6ec6b9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538581, "uuid": "fe35e527-96d6-45e2-9e52-058948b0948b", "comment": "Malware payload (RedLineStealer)", "value": "a73984e402bbd16deb149176c88af760fd4becea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648538581, "uuid": "194867cb-41e1-4d02-8daa-42cdf065c8bf", "comment": "Malware payload (RedLineStealer)", "value": "784b497cff49f6f488f950109242b35cce678206da39c80255a1c14008aa41e27a4efe4f5b4c1bece188200621d9ba8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538581, "uuid": "3ac7fa35-08f2-4935-9c42-e946410d70ce", "value": "T16AE402E27D95C832E122C2309852CFB4D96EAC31D851168777B83B095E77292AF2D74F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538581, "uuid": "dac9aab7-dbf2-42c8-88c4-cacfa3903a26", "value": "e5c179e1f9502263973e4310e0826274", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538581, "uuid": "70a95865-98b7-4768-9d81-95533d6e26ed", "value": "12288:LJaQVbOhHbLH/Z4VRlbL/vy0aFo8gOt5x8UiOtvY08Hjk4dGN:kSbOh3ZUbr9xORr7YDxGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648538581, "uuid": "6f31449d-a929-464c-803f-490db394f0f1", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648538581, "uuid": "17c7fb49-2387-46ec-b8d6-84eca0c20d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648538581, "uuid": "87d7cb7a-2e1e-4470-8729-82027c81606e", "value": "1735d663fa62a2b4ff481c783404ab07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b649445-af1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648529203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529203, "uuid": "10dbf66d-bce2-431a-afdd-92ae396aea1c", "comment": "Malware payload (Stop)", "value": "74ebdc15fff302ab4eb9f4f80dff61ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529203, "uuid": "acc6d4e9-4e68-4862-b44c-0e358da5e5c1", "comment": "Malware payload (Stop)", "value": "cf768a979f38ed8a623cfea619e3d86dbd52244a80c075f4ccb8a4f3e69867d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529203, "uuid": "5151abde-1cbe-4caa-98d9-280d5551ad8d", "comment": "Malware payload (Stop)", "value": "3d576666acfa6ba5978afcd03be0fb5bb64140d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648529203, "uuid": "b61b5162-1c12-40ba-ade1-30988b1aceeb", "comment": "Malware payload (Stop)", "value": "6857e65082012612af9e9bb297e3da368d8d4b8c730688a2e74e3a553a8ef4fecbd3d85598b5b7dce6630469b0ad1b0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529203, "uuid": "3ab45911-dae3-4f06-9739-bf6a85ae01d2", "value": "T161F40211B7A0C031E4BB16F58A7AD369B42E7AB09B2080CB56D92AFF17346D4DD3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529203, "uuid": "23b1fb56-bbfa-4415-9b3e-9d843295ba3b", "value": "112f301b72f7079fdf51b59676b2b142", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529203, "uuid": "1a507e32-5c4c-41c1-9eaf-748bfd86c58f", "value": "12288:CK6UOzrNXFneGv42i95MVLk+iFbBSD9Vo4SZ+kyk6khdWlWNrAYM:xHOVVphi95SLtiFlS8skyk78WNr3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648529203, "uuid": "70ada0e8-0a7f-414b-98bb-651d859926f1", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648529203, "uuid": "15d48916-48d8-4620-aba0-9b422fcb3a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648529203, "uuid": "80cfab9a-d5d2-4c4c-b72d-204724c3377a", "value": "cf768a979f38ed8a623cfea619e3d86dbd52244a80c075f4ccb8a4f3e69867d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d607e7e-af2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648536884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536884, "uuid": "82c32635-41b3-45e6-b1ee-e09628d386c5", "comment": "Malware payload (Loki)", "value": "1fd9d92bd74bf117079666361f25ff52", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536884, "uuid": "395d4efb-2c1e-463f-9259-75f655cf1935", "comment": "Malware payload (Loki)", "value": "cfabdc6407c46324a2257852864418554e6973f8c4e6268d7767d73fe464b65a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536884, "uuid": "9236340e-f529-415a-bafd-f4712637d271", "comment": "Malware payload (Loki)", "value": "f9a797670f150c64bf005f91631651981c21b8b6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648536884, "uuid": "51ef4b5f-bb02-488a-9259-b38913086f28", "comment": "Malware payload (Loki)", "value": "f33ea66b0955bd041837e5bebc6c7658767347568f34f03fee9244d563683ef001e7b185804cca3b9c236ee591832647", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536884, "uuid": "efbefcd7-164e-429f-a7c1-e02292a014ea", "value": "T1DD14121AF2BC7657F5628ABA28C683768BD7FF56C9C4D2110629BF4CD4792006E70782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536884, "uuid": "35aa8d2d-32cd-4c46-845f-44538dee3c11", "value": "3072:G9oYrjrKh4sdEuPgg+UHI1bGc6NCFuJ1J1xLiOFBmEVgKIhzGUuqlbkg/J0jG1nJ:kgasaW5H6j6MaVsOF0pKIFGULl3xrnUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648536884, "uuid": "ced57417-4691-4e4a-8ec4-0d2a49b93741", "value": 191256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648536884, "uuid": "547d4771-197c-4a6c-aec9-a9ff411eea74", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648536884, "uuid": "0c42783c-adbc-409e-a281-9d011002cfa2", "value": "PO P104634795 R013358001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343f1958-af69-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648562692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562692, "uuid": "f2e9ce82-3e67-4f66-8297-aebec8fb4f49", "comment": "Malware payload", "value": "e36a2ec87a4f03c86797c483e8a2b4b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562692, "uuid": "e1599bf6-3e04-46a2-bdeb-3f8ab08b1531", "comment": "Malware payload", "value": "cfba5dd939d2d7bfc08f500cdec99afcba91c463d70086c53dffd65dc1e965d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562692, "uuid": "35fab558-f982-4f2b-8fed-66f4169f80c9", "comment": "Malware payload", "value": "5542a7a221f430dd1c5e3d6270e7f463229a7926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562692, "uuid": "4d5a4e97-1724-4613-985c-5e57d8cd4e6a", "comment": "Malware payload", "value": "8ffddd74166ff3fba98a1d3dcb563792388fb0db2555b31e5b388173fac0689957214bd4554d9fcd5dc8c97d30627438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562692, "uuid": "addd857b-a34b-4910-aa28-c902bcac413f", "value": "T1FD35F126778EC902CA7D577798EB80004B74BD5A5963D70E79C833FC0E23796A94A70B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562692, "uuid": "5a3ca679-50c5-4690-8348-674ce1fd6d1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562692, "uuid": "3fa21270-2a1e-4bd9-a4ef-bf3737c0fd70", "value": "24576:HLFQJC+QUu1niA4GUO9QDCP6tDHZPKGY8yl9iMOty9gKqZzBv82/8:eJC+QUuLF39QDCP6NdKGY8yOtyhqDvNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562692, "uuid": "d10d0e5f-6234-438e-9fe6-f79d8088471c", "value": 1158144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562692, "uuid": "a1c899f0-2be1-49fc-b5b6-c96fb137ffed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562692, "uuid": "4ce04b8b-2ba3-425d-be50-5d84a116a5a8", "value": "viva stub (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa099550-af9f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648586217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586217, "uuid": "37a903d8-2723-4c72-97c8-064630acc027", "comment": "Malware payload", "value": "284ae60cd3306554006096e545f4e885", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586217, "uuid": "0ff0d834-d25f-47a2-af3b-929f90ebe82c", "comment": "Malware payload", "value": "d0dc83e3cb7f318fbfd3ec27ff0257950cae3f1cdb91cb08abfb926dd8a242f3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586217, "uuid": "ae38d976-0d67-4fd5-b2df-a25c50a967ef", "comment": "Malware payload", "value": "f43e9319d9d10158b9e4ad9ea75e47d3cad2db8d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648586217, "uuid": "6ade0a9b-d764-47a3-bf15-4473f62dcd5b", "comment": "Malware payload", "value": "d7885f7c91605e606d1a78c5254703e44472963104c494a16b2ed480dadfec054035bdfe6462669b28c9177b514a822a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586217, "uuid": "6080ce3e-a2df-441a-a80c-b7e59f6cde35", "value": "T12F05A200738644E2FA79E37202D0572033B488D5E291AB27CE70724E5CBE1E4EFB695E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586217, "uuid": "86eac14e-f836-411a-9bc4-29131317095c", "value": "384:neLzpeLzJC2GwXmT/cF1xVrtxblcN2GwXA:neLzpeLz5GNkF1xVricG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648586217, "uuid": "921fb10d-2cca-40ce-af5f-5bf5c523f2ba", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648586217, "uuid": "f3d92008-fce1-48ff-8e3b-d50e5d083b7f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648586217, "uuid": "95c3ac36-11e1-4c46-8739-90c98ccf2179", "value": "BILLED9810IJ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fc6c21-afa7-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648589621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589621, "uuid": "a8c1811f-00d0-4dfa-a4dc-504e0fb1053b", "comment": "Malware payload (SilentBuilder)", "value": "01e28d320d9c4e4d3c1f935ed4bfcd8e", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589621, "uuid": "92bd6edf-0199-4467-96cf-4d2d33cf82e2", "comment": "Malware payload (SilentBuilder)", "value": "d0dcb5614fc199cac0c2e01c32f8a6c20190be37070e392f783a7057427ee9ec", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589621, "uuid": "4189c495-0181-4f9b-8a5e-1ec735483c43", "comment": "Malware payload (SilentBuilder)", "value": "f80722bbf0e5dfd86dcba0e4facf04d07328cc43", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648589621, "uuid": "f021de72-9325-43af-a5f6-314ed3a20dad", "comment": "Malware payload (SilentBuilder)", "value": "30121b8fe7730d2b5aa389308dfe24c781d6e8f9dc443783c7f35dadbbc2cafde87733465f1f905bab2e2f34b075d3ac", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589621, "uuid": "2e5d3b4c-a487-4dc7-acd1-d52b5fba37bf", "value": "T1C8B39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589621, "uuid": "32b6642e-8d47-4c3c-8078-acaf1219ccc4", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsM+:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648589621, "uuid": "88f9912f-3750-4e5d-8e25-913f367b806c", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648589621, "uuid": "3c86a9af-4676-48d3-b950-2f71e4d9f541", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648589621, "uuid": "e9547046-e7d9-4329-8c30-fde5dbe2d334", "value": "01e28d320d9c4e4d3c1f935ed4bfcd8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5060cb25-af8d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648578201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578201, "uuid": "55d19b07-8e61-498e-9c36-9d6b7596cf10", "comment": "Malware payload (Heodo)", "value": "e3293892661fa090546993b15859e60c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578201, "uuid": "bbcef447-d47f-4090-a4d7-4ffcf5709248", "comment": "Malware payload (Heodo)", "value": "d1629e71b6e774907999c8b3d29114fb7891cf94f3751a4769c8bba328aee04e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578201, "uuid": "5d1a8632-da9b-40bc-9ab5-2849619c17ac", "comment": "Malware payload (Heodo)", "value": "05319d665da7284071a76354317e47db23f155b3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648578201, "uuid": "228f3492-14b5-47f0-91d7-522b90b96260", "comment": "Malware payload (Heodo)", "value": "5f3fc5012c59a3a5ced4616c98d94a572c4dd9b464de7ed6fa1154af6a28a8648af9734125d2df2fe725333335415f90", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648578201, "uuid": "ba84a045-6006-4a7d-8bf0-e4da25221a14", "value": "T149B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648578201, "uuid": "f54c347d-1ce4-4f98-b2cd-d06b60ee5527", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMx:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648578201, "uuid": "7543c51a-a46e-4230-a666-751c29702fbe", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648578201, "uuid": "5987772f-d8d5-424a-9c95-9b612876b60c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648578201, "uuid": "ef330549-c906-4331-b8a6-d3ad5663dd23", "value": "e3293892661fa090546993b15859e60c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ee0e4f-af56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648554862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554862, "uuid": "d1e21a91-1328-4ed9-8689-e2e048481f4a", "comment": "Malware payload (Heodo)", "value": "14d4b6618a0bfb12974143a51376f3b7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554862, "uuid": "110195d7-9666-4842-a6c3-bdd5e3c1218e", "comment": "Malware payload (Heodo)", "value": "d16ec6920b7db02862856cccd1c3df1595b98b257d9650237cb51bfeb77c0f68", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554862, "uuid": "8af25077-71f5-4360-9c8c-601e58307f09", "comment": "Malware payload (Heodo)", "value": "b6d9efc1b83ca1e46e1e2019de323d1cc80fc839", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554862, "uuid": "3250ff7d-bdc0-47ab-8aca-0d6552ba512f", "comment": "Malware payload (Heodo)", "value": "e4885502f8576d78a0190a7cef1759ef3fb591208bc506952d1ec2c45fb6be803f145f375ebff74e2c1c56a6297906e9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554862, "uuid": "86b63a7a-6bb6-4598-9344-cd932f5dcb1b", "value": "T1FDC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554862, "uuid": "a49561f1-250e-4ead-a8c4-8918726f4ead", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC8:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554862, "uuid": "6b9543cc-6f4a-4eeb-bcbd-3ff0777db70e", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554862, "uuid": "2e4cd55f-407d-49df-8e98-50528844ea2d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554862, "uuid": "d9e45318-89d7-42a3-b2c3-8b913b969d69", "value": "imedpub_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09692a52-af5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648557466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557466, "uuid": "c1117569-fac4-450a-aa41-94236f8b2347", "comment": "Malware payload (Heodo)", "value": "5ddc81a1d28f226c57568e1bac4686c1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557466, "uuid": "c18bcd24-0859-44b6-9bc3-866a674901f8", "comment": "Malware payload (Heodo)", "value": "d1827e6e44cea3bf521f0ceff881daba98dc463661de00dce6a6a5de72e30c36", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557466, "uuid": "d1637b2f-34ba-4c55-aae7-0d099501d080", "comment": "Malware payload (Heodo)", "value": "334db820b43e5c39ee61bc23f880368c60ab2574", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557466, "uuid": "45e23d3a-ebe8-403e-8fb1-c4ebfcba2a4b", "comment": "Malware payload (Heodo)", "value": "d4f6ef80826240c1d12005d136707069a24dabdae232acb447601fa488196994dc1cfa97febd91f3fa39a1c51dd59bcd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557466, "uuid": "9df40514-64f1-46e1-b95c-9a1729ed6e01", "value": "T142C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557466, "uuid": "b8eb8dbb-83fa-4cd3-bb7b-d54d62dd06aa", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCc:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648557466, "uuid": "81ec502b-4d26-4c53-b520-04f33eb295ee", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648557466, "uuid": "5a802b90-c62a-4089-ae69-9ef7de229014", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557466, "uuid": "888b7c63-7362-4e11-a42b-8868d212a136", "value": "iMedPub LTD_2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0802b616-af62-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648559611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559611, "uuid": "789defa8-6b86-4798-8983-a57c10981a6e", "comment": "Malware payload", "value": "261da5e3bc26f4e5ccf78faa6acaf026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559611, "uuid": "be41f390-323d-4b8e-b6f6-0d453242bd64", "comment": "Malware payload", "value": "d1a7068f78ce17a2db79d53ddb3cbf2964d4d648506d665895c47df33fa2bc57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559611, "uuid": "c94a374d-0c7f-4059-b34c-447dfb9f6425", "comment": "Malware payload", "value": "229adf658a2ee20d04a8d569d3fa2967f046f402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559611, "uuid": "6a32d90c-d578-40dd-a044-120a07a86a3d", "comment": "Malware payload", "value": "6da256df1482aab7204cfa7ae26029a73dbe13d21f628400ce2d17424b09d58159d70f21a814b216853dee325a4d8be1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559611, "uuid": "84eaa264-fe85-449a-a5a2-64e0650b5f51", "value": "T1F5346D6AA2E50A96FDBBD6B9CD53C227D7F238451B64C31F13B0CA965F47321B218342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559611, "uuid": "7d222d29-0174-47ec-9583-8d36e0963452", "value": "6144:qyihnaKbEFhck6xW3SJ5gtS3z9pjFAlkkO4aqpf:qyih1EF2k6S/SD9pylkjqpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648559611, "uuid": "f52f7310-2924-438a-8176-d2aa2edb50fd", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648559611, "uuid": "022d5be1-9edd-462b-8580-74bdfe55fce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559611, "uuid": "e8d63e42-3899-4784-8d2a-b3d3a7c8f0c0", "value": "1f6b7110000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb88ed5c-af12-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648525633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525633, "uuid": "a9b78659-7554-4149-9798-4b0555f5e1f4", "comment": "Malware payload (njrat)", "value": "0806471f46fac81bbdc710661205e8fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525633, "uuid": "83928954-bb1f-4a77-8598-a0dd12a018c2", "comment": "Malware payload (njrat)", "value": "d28b0e2636385b57d043bec56c5c5c48a15edd2228b61197e4ac2e634c682db0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525633, "uuid": "173e18b0-1fc5-4e44-adc7-356048e3904f", "comment": "Malware payload (njrat)", "value": "8f1741a44667e451674c62de6cff6c05945d290f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648525633, "uuid": "9c3377c1-6fa2-4d17-ae98-db2a58c09747", "comment": "Malware payload (njrat)", "value": "ccf3d324a1640452319510fc7b2479edcdf0cfdf5ab5d3b133e9236d3775820eda8806790fa6fae3862593cefba82406", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648525633, "uuid": "d94756c3-ee5a-4018-98b7-9a11b303aa39", "value": "T102032B4D7BE18168D5FD067B05B2D41207BAE04B6E23D90ECEF564EA37636C18B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648525633, "uuid": "45cee463-2111-44d6-b010-0c1452ce8dfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648525633, "uuid": "96fca9b0-682f-4296-b3ed-e9ec913c971c", "value": "384:J9MnyvEiTbrvpWNcZ0y8fXC3XfvkLk6k3LrAF+rMRTyN/0L+EcoinblneHQM3epk:QnyTTZ38fXC3XklkbrM+rMRa8Nu1Qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648525633, "uuid": "1dcfe316-2b2d-4b89-9eb5-3ddf7af77ea7", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648525633, "uuid": "46c0da17-ab86-4959-bf57-8f0811b790e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648525633, "uuid": "23fb3ca9-6c12-4467-92e9-38158bb68418", "value": "0806471f46fac81bbdc710661205e8fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03151519-af57-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648554879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554879, "uuid": "86af7dea-0a42-46ba-97aa-42fe03b66ae7", "comment": "Malware payload (SilentBuilder)", "value": "fa432edfa43685e42602ab23ccaa6b7e", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554879, "uuid": "45c96db0-5bfd-4b4f-9ade-986069796bc0", "comment": "Malware payload (SilentBuilder)", "value": "d3b0a7583d5d42e5abf93d85c63deef61760149573d9da863eddc63b6fe6c168", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554879, "uuid": "aee8e805-79a6-4656-b24b-1c8df0d6ea29", "comment": "Malware payload (SilentBuilder)", "value": "d7d872834f77b9e44bc6464ac69e2bac1f44ff31", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554879, "uuid": "390bd351-3301-44f0-b2c5-fd235ab50250", "comment": "Malware payload (SilentBuilder)", "value": "7ea332f676db593ade4f38681add0dee769fea2e943cc95733ef48d124afea287de38422126b390c8d0092b3ebdebf93", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554879, "uuid": "e6494818-284b-49ab-b0a9-660e177b835c", "value": "T179C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554879, "uuid": "45d89c0d-eb5b-4904-8e89-2be582db234c", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlC8:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554879, "uuid": "5adb8f54-9646-4db4-a6da-7df4369b9ae9", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554879, "uuid": "d8c4ac46-44a3-4583-beed-01885a745723", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554879, "uuid": "eb797e51-1620-47b6-8d10-8bbea0babef1", "value": "omicsonline.net.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03a7edf-af66-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648561692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561692, "uuid": "7c421ef2-7e9a-4ccd-b797-438f11043239", "comment": "Malware payload (Mirai)", "value": "b03ea667dba8bbc7ac83af3cd05555f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561692, "uuid": "4392f801-48fb-4d6a-82af-2ac9e1e1059c", "comment": "Malware payload (Mirai)", "value": "d4176b6c349569b0a325e8085879759476c9d7cecf0b22f1ec7444f078927b88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561692, "uuid": "b877bd09-ef20-49bb-83d9-feefd7ad276f", "comment": "Malware payload (Mirai)", "value": "85a35ccac80cfdf0bc93a66ce7a442b92223f737", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561692, "uuid": "de47e82d-d3ac-48a3-95d1-d53a46674bef", "comment": "Malware payload (Mirai)", "value": "b493884caa33d0bab2ac6ef33b16cb7ddd54af7d2a3c3aa38ac77f07adcea0848bcd1e3bfb3a9a6e0f5e0f8bf2d618a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561692, "uuid": "480ab4cf-1d33-4a85-848a-580140f0e369", "value": "T151639DA8C079AD9CC66486B8F54485355B23E00952B33DF7DAC387A6806BEECF5057F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561692, "uuid": "7a2c6580-bb91-41c3-b629-95367a5319f3", "value": "1536:faC/YeCq0oGRBKHrU1rFj4oTjsHmOUdofs3MCPRRPawnCwii:fLgeKp8U1rx4oCmOUuf+dzawnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561692, "uuid": "25d2083a-7bec-4172-8f3e-435774c1cc14", "value": 72756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561692, "uuid": "88d549ad-93ca-48fa-bd1b-cdb2ed1abd3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561692, "uuid": "642c0e8f-a003-41eb-8867-e55ff13a41f1", "value": "b03ea667dba8bbc7ac83af3cd05555f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aab8693-af3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648543832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543832, "uuid": "8843fd68-c9b7-4840-a1b2-fd6c9ac8ffa8", "comment": "Malware payload (Loki)", "value": "95fed5ca9d7e7b30795bbfc52024baa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543832, "uuid": "a0d6ef53-02cf-4354-b6e4-aa6a7cb1d94e", "comment": "Malware payload (Loki)", "value": "d52b7ef6c91deeb231e720f247fd730ddec4ba7bb6c501bf865eebc45ccf3e50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543832, "uuid": "9359cb78-3338-4fad-a29e-a04da1b79a8b", "comment": "Malware payload (Loki)", "value": "a6cca1450ff7f7691348ac27aa52d1076dcabc2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543832, "uuid": "7300154b-ef35-4316-866f-073b1aa518c8", "comment": "Malware payload (Loki)", "value": "687d3c5004899d63b91912e4854ea83fad4e5b3ff9de60a453748a9dceddd2d6bbd3f19d733b284e2a7ffc4230e58e1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543832, "uuid": "c1948dd1-92a1-47d3-b72a-bcf1590d13c7", "value": "T1DE341210E610C08BC9F3A273083756DB8BB9B41155A9EE5B63A07F19BBA3783D63D351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543832, "uuid": "b23d16f9-aad1-4b8e-b74f-39dcffa994a9", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543832, "uuid": "31c9c2ba-9060-4c7c-8cc2-ff6b7f120d48", "value": "6144:mbE/HUbu+e11FQK93qEbJ9B8FqRFWeUbiPC6GYo1J0IL:mb/O3FRjF4FqrNy0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543832, "uuid": "ec045ae6-abaa-4bc1-9e8d-9e9895cdc314", "value": 249361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543832, "uuid": "fa3c585f-4fa9-41ae-a60c-fc02d69934c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543832, "uuid": "6baad8c4-664e-43a4-8bf4-5889570b7425", "value": "95fed5ca9d7e7b30795bbfc52024baa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2e719e-af4b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648549953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549953, "uuid": "e651aee3-d33d-4b8f-a007-9b9adeb5fd25", "comment": "Malware payload (Heodo)", "value": "62b4e74377e877eec6144dec968e8bc6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549953, "uuid": "a0318016-6f23-48e2-90e6-9ef6adaffd55", "comment": "Malware payload (Heodo)", "value": "d5a7c687bac8e3b0f9ae4ab75ce755aadcb4f649a802f1ca7d277b53cc9c84f6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549953, "uuid": "f6b7f3c4-e706-4591-bcdf-48e62c89a092", "comment": "Malware payload (Heodo)", "value": "cfca622bd289af2a7a537eab0cab3ae3ab238e8f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648549953, "uuid": "a080c7f9-942d-42f5-b244-7fca4dbc2bc7", "comment": "Malware payload (Heodo)", "value": "2595b2d32f0ce6c582ada1b93a1834dcfdd5742697a016aa198efa1c2f44231fd04e46d7ba9d61ce5928af72221a9bc1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549953, "uuid": "6e9d4889-9e16-468f-b024-af8e6860605d", "value": "T1A5C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549953, "uuid": "a3e74da7-b0af-42f1-ad7e-92e9f307d4f9", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCs:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648549953, "uuid": "400053eb-4d51-403f-a79d-5fe7b5e9ece0", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648549953, "uuid": "0a3d5564-cf66-4e6a-9092-5918141d52fb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648549953, "uuid": "e61da06d-5422-4627-83e2-21137f66869b", "value": "2022-29-03_1212.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aecc66c-af37-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648541309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "200e98be-c33b-46ed-a49d-fb31da775e4b", "comment": "Malware payload (Heodo)", "value": "68db3b81383f8d5400d1fed404705868", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "fd45abdc-e536-4f8f-86df-3b5fc3446b1a", "comment": "Malware payload (Heodo)", "value": "d5edb7852e6352f3f5d145d983cf43af5ded22b095d20820ea79999ad3dee68d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "5eeaae29-4b66-406d-8327-86edf35f6594", "comment": "Malware payload (Heodo)", "value": "1333c6b6973e3782822a583c78c6dfa3e2940d2b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648541309, "uuid": "880aa136-1047-41a3-82b0-5346802406d3", "comment": "Malware payload (Heodo)", "value": "dd9bf2336ad06bd3ff55b7cf0f1fa11a9c3e2f8a1f5698e8842b21fcf828cdc74d8cea566b7c1c8d48cbe1c1050c732e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "dcb1f690-9405-48b1-af63-e355f7a1ac17", "value": "T152C48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "ff400747-4c70-44df-8727-3357f44da245", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "93c74d05-648b-4cb8-a972-22fdec5f256c", "value": "12288:iUV7ciwHX3ew9aYU3psc9inFijaQeL+nZBb:UiMX9Iiky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648541309, "uuid": "406a43c7-dd4b-438b-aab3-93a4c4c34d75", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648541309, "uuid": "8057ce1b-41f9-43d1-b2d9-604e142a6916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648541309, "uuid": "30efc1e1-2834-4510-8bf2-625c3caf39f8", "value": "emotet_exe_e4_d5edb7852e6352f3f5d145d983cf43af5ded22b095d20820ea79999ad3dee68d_2022-03-29__080822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d1acf9-af99-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648583579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583579, "uuid": "dd804993-ab79-4d08-b0bc-08ac86ea1555", "comment": "Malware payload (SilentBuilder)", "value": "51c8c52bd4592030440d40387ae927d3", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583579, "uuid": "1660d18d-ac61-42aa-a4a9-44d87ce8167a", "comment": "Malware payload (SilentBuilder)", "value": "d60e8b3fd175d24e2cc8ef64bb254ddfc06cb4f5fd277980549c67f64c117c33", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583579, "uuid": "7e867045-22eb-4513-bc96-ca24a54c41bf", "comment": "Malware payload (SilentBuilder)", "value": "fb578fac0e4fdfd4f1f78fd036513ee96f36f094", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648583579, "uuid": "8d44f7f3-b083-43e1-a684-8aa8a446c2e5", "comment": "Malware payload (SilentBuilder)", "value": "0d0c6f182f7e19490e0ae87d986010ab992a51f9c6f8002920c50a34307e83aaa03ad3e7b06715000178bb3d65d271da", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583579, "uuid": "bea05b0f-3367-490a-a1cb-5d30a94a723a", "value": "T1F6B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583579, "uuid": "810bae10-1117-4a5d-908d-65e2f6bc4828", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMF:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648583579, "uuid": "7c0ce3f9-c7be-44b1-b10b-807636360e9d", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648583579, "uuid": "8ae27708-fa05-4274-bea7-a541e674319a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648583579, "uuid": "bb547d68-8990-420a-b59d-c5f94d1c7198", "value": "51c8c52bd4592030440d40387ae927d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9407431-af78-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648569331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569331, "uuid": "641def08-df38-4405-801a-f5ab0131560d", "comment": "Malware payload (SilentBuilder)", "value": "158b73ce0570bf73e5fd65b601a6a845", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569331, "uuid": "708d407c-43c2-4087-8b8a-efc32d3ca0cf", "comment": "Malware payload (SilentBuilder)", "value": "d6646a94355639bf44f2e0fd0805e12c8f774cb87361d5bbc1a9f2f606c35f14", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569331, "uuid": "68219530-ff56-44ca-8db1-bf492294ad35", "comment": "Malware payload (SilentBuilder)", "value": "5cf14af55f04a91e0d5a3f208fe1f76f4744b6c2", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569331, "uuid": "b86bf668-8e9a-465c-8abc-e20ccf929306", "comment": "Malware payload (SilentBuilder)", "value": "62fc6a8d2e3ae0136e5e2521056d06934821243c0861992d50df1cd4399e3e8dd63201fbfa88f0b77abe01bfff0d8a04", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569331, "uuid": "336732c5-6abd-4b40-8813-886a4013ddec", "value": "T159C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569331, "uuid": "aec307e1-5922-41f2-90f7-d99576be4e4d", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCs:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648569331, "uuid": "ea29cd4d-7bd3-40c3-aaba-f85ef12bca14", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648569331, "uuid": "ac7d0037-ec89-4357-b545-958e44de09d7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569331, "uuid": "39e29819-4aba-4345-a587-674fe4f48b5d", "value": "158b73ce0570bf73e5fd65b601a6a845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d750e8ec-af68-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648562536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562536, "uuid": "3703958e-d31a-4824-a0d2-2764725e67dd", "comment": "Malware payload (Formbook)", "value": "25d272306b25a24a13ceeb0781e8f285", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562536, "uuid": "ad3c92e1-431d-4e6e-8555-409d4d4c7b7d", "comment": "Malware payload (Formbook)", "value": "d675408e7dcc87922c9d654a5c4f387f70d4a06ad99bad187753d90ee6381a87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562536, "uuid": "d4de6653-3a05-4458-a3b4-5c1d9bc698bc", "comment": "Malware payload (Formbook)", "value": "f6823f78831c8a88bdb90488828eab52ff23444c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648562536, "uuid": "303aaea6-3200-454f-8c1f-af9bfe8e2933", "comment": "Malware payload (Formbook)", "value": "b81a40f7678a60bd3205545727afc5035ce54f8bab58a245f9a4c6d59cf61bef83997a7b4ed4281b9f64d6d17a955244", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562536, "uuid": "53aa3082-7b61-446c-994a-2f4b418568e5", "value": "T1113412983695C0BBDC7309329D7BA7352FFAA20524B91D0B17504F6EB8322929D1F792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562536, "uuid": "aa0f0f36-ddfd-47df-b286-d09b63d33f4b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562536, "uuid": "14949cca-c198-4d2b-8c3e-f362c4da021f", "value": "6144:HNeZmZXbjGRcUu5eEsywkw20oaW1CoUKatSsxJQ:HNlU+DAHyPDn0BtSsxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648562536, "uuid": "b80736b2-482a-4e60-95db-12b5fdae402e", "value": 245588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648562536, "uuid": "e0a1518f-280d-4590-8daf-08b6baa813f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648562536, "uuid": "cd82699e-484f-480c-a124-7df8ae536c97", "value": "Odeme56670987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067c440d-af5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648557461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557461, "uuid": "d6576094-7333-4dfc-84cf-d1b858368e85", "comment": "Malware payload (SilentBuilder)", "value": "973907a2a7d2e4646e51ffe7d7c755e6", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557461, "uuid": "fd78a2b5-2c7e-416d-b949-fc870a63e6bc", "comment": "Malware payload (SilentBuilder)", "value": "d69e390e15e590143cc4f9cd1bcc1dd8179a13704e5f409b174a0476add24759", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557461, "uuid": "946dd510-b3fa-40b7-ba61-cc763a19e49b", "comment": "Malware payload (SilentBuilder)", "value": "1959275f70c2938578cef44960fc004781d37a8f", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648557461, "uuid": "354b1e62-a98c-4226-8078-d3498167e983", "comment": "Malware payload (SilentBuilder)", "value": "e8c534fa4b875bb8b78baf8873c55466a5ae57786cd3af1b7d03883a03e6906d91a8bd8fd146981327d3b34bf01b4b3c", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557461, "uuid": "67136c48-4b8a-4c22-91ed-f20231b44635", "value": "T1FBC3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557461, "uuid": "8b3b34a2-53a7-4790-9e6f-38c5ebc50649", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCM:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648557461, "uuid": "88023665-616a-414e-a232-fe9751d412ef", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648557461, "uuid": "bd51d639-2e22-40ec-b361-cd2a210b1bc7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648557461, "uuid": "33d2f659-84eb-49b6-be64-a8ac297431fb", "value": "imedpub_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a14e925-af81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648573171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573171, "uuid": "84fcb403-d801-4e5b-a171-fcaa15a98e09", "comment": "Malware payload (Heodo)", "value": "83ef14f28ba7725d27b8f06005ec21e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573171, "uuid": "dfc6423b-8b46-4bd3-87b7-76ba27d2125e", "comment": "Malware payload (Heodo)", "value": "d6db4c07cb2339ef6932854d8064dc43cd14a89eeeba66e99dbded0871f9e8ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573171, "uuid": "ddb58fa2-f625-4e1e-a7d8-d83ef83d7138", "comment": "Malware payload (Heodo)", "value": "e5e4801e50b4db6e18fa77e8f06e324d5933901a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648573171, "uuid": "c4855c2e-2e7e-48fa-b399-e9ea8d10e0fb", "comment": "Malware payload (Heodo)", "value": "b64a032514f40b330873c321c13738e3a83e1c0406fe80289e7a74ab28c7b2d92f0b304b9082ac69e8c6596f1f2eb7e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573171, "uuid": "9643b0b5-1c65-402f-95de-0503b90dec84", "value": "T112D45ACB6ECC80BAE15E22373856B775B526ED004AB4B2C73E63797DD93B5410A6C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573171, "uuid": "482afa17-1479-40ea-a52b-04cbff979723", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573171, "uuid": "7918ef4e-a225-43db-a121-0241528e9dfb", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzxipvdR4oe9PSji13ugTeoD/E+VE+VE+S:PkxeI6LQF+wyooe9aji178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648573171, "uuid": "04a3aac1-0953-493a-b146-a07b5ae3461c", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648573171, "uuid": "f1d8e1f7-bfa0-4459-80cb-70b00da997bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648573171, "uuid": "04c7e719-f0d9-4aff-99eb-30a766f49d38", "value": "83ef14f28ba7725d27b8f06005ec21e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952ae2b3-af39-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648542239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542239, "uuid": "e04ec7b8-a342-4780-b24f-02a3edf7e9ae", "comment": "Malware payload (Heodo)", "value": "79f20262617de694571a1cfbd4a25726", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542239, "uuid": "7b0babe6-261c-4d6e-bf71-789948380f98", "comment": "Malware payload (Heodo)", "value": "d7945ecc061b60cdc64d729b78219456e9cd8061bf0ee3a098bd44f3532f1229", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542239, "uuid": "6fd2c011-762e-4f7f-99ae-dc6b7c3c9cab", "comment": "Malware payload (Heodo)", "value": "8c458903c092b9c020f1964703cb35bad633b9a3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648542239, "uuid": "8d6c37e9-b028-4f50-be16-5791843c1a9d", "comment": "Malware payload (Heodo)", "value": "d766120ee7e29c451fa810b72e8dccc218ed73fbf7c18ec5ea79f55c8490cb0188eab4d70ea6a06b68d645db75450a95", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542239, "uuid": "f0afec0d-35c8-4171-9374-2f280ec3c0ad", "value": "T17DC48C1DBED28077C36A033525D5D35867ADBF01BBE5B6773FA03A4D1A331C186262A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542239, "uuid": "82e41fb0-2af9-4539-8db1-1be71cb1f75f", "value": "58f3725daae21f0d8f5fcbb61948a126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542239, "uuid": "818d7cb1-232d-4954-9de7-2e05afd5c0bd", "value": "12288:iUV7ciwHX3ew9aYU3pMc9inFijaQeL+nZBb:UiMX9IOky8j1eynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648542239, "uuid": "cb881740-48b8-4a5e-9c2d-41f875dbe48a", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648542239, "uuid": "112268d3-a5d3-4a87-a011-e3e8db83e5d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648542239, "uuid": "a8953919-a532-4f4d-9a12-1911e37c0221", "value": "Lh9T1MeqjD.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844962f5-af63-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648560249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560249, "uuid": "56a496f9-5be6-41b8-b8c9-74143624b428", "comment": "Malware payload (AgentTesla)", "value": "eef557738326b3cb1363f270932446ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560249, "uuid": "99236f30-e4e9-4db4-94ae-2ae6c2c76a58", "comment": "Malware payload (AgentTesla)", "value": "d7b5bead80b0ed81498d4f4e6b295175e44c6c56f630b6dbd1224e086440ac71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560249, "uuid": "1eb9e1b9-ac77-4570-877e-46e5861caf34", "comment": "Malware payload (AgentTesla)", "value": "d7b4694fd77cca5b3d0064bbc240552805a88769", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648560249, "uuid": "8d4431a0-a9b6-4c1c-8640-724b1b411ce3", "comment": "Malware payload (AgentTesla)", "value": "a685dab423bd9dcbf9802319329c4d5a21c6a55525c06f4b761301fe234d7f709047c5c65f5ee150dbecfff2e4f79391", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560249, "uuid": "213ff3eb-805b-40ee-b773-d52c7cbdff51", "value": "T1D0F49ECA6F332200D5EC13ED5CA119A7BF03D662213E89FED4DE3965818B2691715FCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560249, "uuid": "bb175491-29c1-4dc1-b4c4-3570f72b1d3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560249, "uuid": "ed4518a4-d828-4cd2-9e8f-bd8be43b0fb4", "value": "12288:919/uUO6v8koyUtjhRzxjo4/VEJEEgmQI9h/heoe5pegsOpJT141pDVuPZZ2tdXt:9vA6v8kGxpuJ3QQN2TMOIY2WlyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648560249, "uuid": "d390afaa-489f-4347-9b5e-2ea105f02ea7", "value": 763744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648560249, "uuid": "cec6343a-0288-4bfc-b7b1-28dc7cfefbc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648560249, "uuid": "b2c92f61-a12c-448a-9aca-695d642ede01", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053334b2-af57-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648554882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554882, "uuid": "88de8c4e-f3ce-45c5-b254-6f8ad41e8ecd", "comment": "Malware payload (SilentBuilder)", "value": "77b18bf838cebe8ecf85689e55b030a9", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554882, "uuid": "3b976116-2aa4-49d1-963d-80ec5108725f", "comment": "Malware payload (SilentBuilder)", "value": "d86934e6a162cdcebc09f09c00b807bfbbf3ac0e67b239be1480fb15e0ed76fd", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554882, "uuid": "a3ea4355-6c70-4282-90eb-6275593e6676", "comment": "Malware payload (SilentBuilder)", "value": "6db690b161e9b1e9ddc24cfeb0d113da07ac5ec7", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648554882, "uuid": "3aab0324-7bd2-42d5-b00d-a8baf7f05cbd", "comment": "Malware payload (SilentBuilder)", "value": "2ecd6cf734d8575e886bcf37795c49068f3cc40627b533968817ca0af63a5eb09d732e6306124295d5cb63e3aa10269f", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554882, "uuid": "a9dd1b62-890d-4230-8f51-1e8dd526c270", "value": "T156C3AD8BB659486CE922877489DB879A7323FC354F6B47473214F3367EB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554882, "uuid": "73457180-2638-47c7-a5cd-aab22158e775", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgt3Syz+nzQIceCRlCI:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648554882, "uuid": "0e9aa5a5-debe-41be-8113-eb3324a830c2", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648554882, "uuid": "a1b29c8c-9a52-46dc-a185-4ba5236a0f3c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648554882, "uuid": "45aaa358-82aa-4808-975b-6210f07086a5", "value": "Payment with a new address_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec38b72-af2e-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648537584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537584, "uuid": "8a0e33f5-ca56-41cc-939e-7e593a39d7e9", "comment": "Malware payload (RemcosRAT)", "value": "d5f24aa0e828d9cf1ad6cd5b12b22d34", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537584, "uuid": "7d9d3349-1661-43da-8c1d-62da338708b6", "comment": "Malware payload (RemcosRAT)", "value": "d98541f0e7659a620cfd349405facb991e7e7973e90f7bef7f7882315023e96f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537584, "uuid": "0dfc3264-5e2e-4a5f-89fd-0bcd642614e3", "comment": "Malware payload (RemcosRAT)", "value": "505a0f72aa8d6b0403ebab2e0e291f53baa6bd09", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648537584, "uuid": "e9d0d7d0-ec6b-4cbf-9c4b-f45ec2d750c1", "comment": "Malware payload (RemcosRAT)", "value": "122b84df7cc829f5f6237f3b5fda2741375e476ce9f3e3d0845e452794b13a9c7245591aaf638f93c3beff1144cf8272", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537584, "uuid": "dddcec74-08bf-48c5-9ed5-c0798398a01b", "value": "T1F6512119708B757822311E72EC1B14DC9A774383A27851A0FE1DDADACE365ACA7C1C1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537584, "uuid": "01f8b450-7f6a-4a5f-af0b-8abef8e092cc", "value": "48:qUilCKD9UsgjSZJi1rSm02OFXWVf8e1SVpo0BdAr:q5Kv8Ji1rSm1vJ/mSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648537584, "uuid": "59054a65-126a-4e51-bf5f-56c835a071d5", "value": 2688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648537584, "uuid": "d5af6793-a86d-48f5-b7d2-9312068a285b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648537584, "uuid": "e0ca51c6-2c29-449b-8f0f-1d9f0a0186ad", "value": "payment copy SWIFT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059b4aee-af62-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648559607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559607, "uuid": "6009d18f-d84a-4c06-9b99-7881814d6de2", "comment": "Malware payload", "value": "57f1fb2f9b64a5a7c16fa0ce50bdcb79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559607, "uuid": "8e712ab0-80c8-408f-825c-e1e95a1be900", "comment": "Malware payload", "value": "da25e0194722f65f8d488c93f4df5a871e50715cb191bd6e845a2db7a112d505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559607, "uuid": "5313a697-0394-4190-83d4-7a96e5ad4773", "comment": "Malware payload", "value": "3eb51f25e0a9aff04c11ade01c73fb8dccd0d5b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648559607, "uuid": "128f8595-3119-4270-a800-6fd968b3bf50", "comment": "Malware payload", "value": "1d5e10264f88bdf984bc2c468c837c1bb612f60b7e360f21292bfc93ddd04dcae040d6b6b362eabf697445cc19ebf302", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559607, "uuid": "8714846a-f9ad-4304-aedc-d4caa76f9f9f", "value": "T188346D6AA2E50A96FDBBD6B9CD53C227D7F238451B64C31F13B0CA965F47321B218342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559607, "uuid": "822c3128-6b84-40a5-8119-88e6a652f0a8", "value": "6144:qyihnaKbEFhck6xW3SJ5gtS3z9pjFAlkkO4alpf:qyih1EF2k6S/SD9pylkjlpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648559607, "uuid": "5363572a-bc0f-4bde-adbf-720036f08243", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648559607, "uuid": "539f8bd7-bf6e-4a05-98af-4c2e26bda512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648559607, "uuid": "fe1b0805-2d05-4cd8-a510-37b2fc3d3b3d", "value": "1f6b7000000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42fea164-af3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648543819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543819, "uuid": "a9f76332-d1c6-4412-bc62-9397e12633c7", "comment": "Malware payload (Loki)", "value": "b56daa79ce1d21efee3f6481572fae90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543819, "uuid": "59bed221-54b2-40e9-b101-c1b9b580dd89", "comment": "Malware payload (Loki)", "value": "da2ad193ca616a908d2f7b3d9a68a76983c812e4b98f3df0bf6a8c096e93a8e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543819, "uuid": "70edd94b-91ae-4912-8a33-35f4b6ebd4d6", "comment": "Malware payload (Loki)", "value": "501dd7c7ceda1453deeac10d53c8b83d49d2c9bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648543819, "uuid": "487c8f34-07eb-454e-9555-23b20729bb44", "comment": "Malware payload (Loki)", "value": "45d9620e99c5119a679740c44ba92c2d62442ca7b7ccc05d0f143d48ba4e8af307baf5a4183b23c506beb1810e057df2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543819, "uuid": "f318b0d2-0330-4cc7-a291-4ee7fa950eb3", "value": "T1D23412706260C897E4A346761CB415AA6BF9C62560B43F0B13547EBC3C636D0DE1FBB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543819, "uuid": "1b38cebe-60b7-42ac-a03a-4045586187a0", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543819, "uuid": "6274dd23-bda4-4518-8a0e-5b646400a07f", "value": "6144:mbE/HUbCRvzbQWHKhk2Z4hVLjtgciSKuikOIX:mb/CBgWHKhk2Z4VLFS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648543819, "uuid": "4b773384-ab82-4759-aa12-f6039e76b948", "value": 246390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648543819, "uuid": "edc95f7d-3c42-4051-88ba-8a0d7b8cf2bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648543819, "uuid": "a60de8e7-9dea-4848-838f-dd16e515b53c", "value": "b56daa79ce1d21efee3f6481572fae90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7956f8b2-af78-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648569250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569250, "uuid": "4a3cca4e-c488-420e-941f-668a23f4590b", "comment": "Malware payload (NanoCore)", "value": "6c4e6989cd6c51cbb1824ec964483146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569250, "uuid": "ba682b6b-2613-477b-bae0-73b197575146", "comment": "Malware payload (NanoCore)", "value": "da425af20ded926a82d0bd1e8b525ea99aa3668f245d82c55cea495cd906eba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569250, "uuid": "dc384263-e846-4c6a-a504-31bebb8b5ada", "comment": "Malware payload (NanoCore)", "value": "b1a087742c72058c3cf51e2f44e5f7f8b0ef8112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648569250, "uuid": "8b2fcb74-e35c-46ff-9234-f151efdeb7fe", "comment": "Malware payload (NanoCore)", "value": "30b308a75414866279fcb5ea875a9521d0be98066f0db8d54f02f70fd33b1b28f6940c077715817ba9ac3992499a0acf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569250, "uuid": "50a3329c-4575-4cb7-b3b6-a0c032b23dfd", "value": "T1AA35121817FC8580FABE57FAE4B484108731752B1237E31D8E8669EE1E723C2999B357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569250, "uuid": "b5b7feca-ea53-4311-9f24-a3ff12382168", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569250, "uuid": "23c4800a-19ab-4888-b744-21e0a4a3cbee", "value": "24576:syexOEBHbZwh+BXvRI0R1lx/CRnjqDbx71YlFtGppzEeHzrqDxr:sye4EB76EBXvy4cnOZ1ZppIeT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648569250, "uuid": "d263080d-efe5-49dc-aa91-9d14db5ee667", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648569250, "uuid": "5572b40a-2fe9-476a-9b8a-261ba6d8be64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648569250, "uuid": "b5b6f4e7-940d-4b83-b187-475cc289f92a", "value": "CV Job Request_IT MANAGER_____Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1462accd-af67-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648561780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561780, "uuid": "e9b48824-6136-4fdd-a772-a422f50bbeba", "comment": "Malware payload (Mirai)", "value": "ecdb738cc9b5b083e69765005a652948", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561780, "uuid": "270cef05-be6e-4b4d-bc70-c4f2b8e1a32b", "comment": "Malware payload (Mirai)", "value": "da83e9d216805a6e305859e2f4e02926c7e6cedfc27d9d6d1d5316dc5e7f7b87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561780, "uuid": "3ea43330-5d15-440d-9676-bc42adaa13bb", "comment": "Malware payload (Mirai)", "value": "19a4b72eb7d1f110f09ded9dbb3cb07fe57dcc47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648561780, "uuid": "48cd9669-5e0c-4172-b5bb-3ef63e044f5d", "comment": "Malware payload (Mirai)", "value": "fd428ed3d4efd5640b8b9a4ea3ab5ccc1dff22b8a4b9cc9f3d3fd4800d53a132429bb67885c95c97b13f7a505662686d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561780, "uuid": "acd336e3-e321-429d-af15-fc0150cd4c17", "value": "T1CCD2E134814F8A8DC7349777638610A72B519C809FBEDF99BDE445C339D339A0868BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561780, "uuid": "0b2c48a9-eac1-40e4-b6ef-545f610c472b", "value": "384:M53laICh2pDOtJ9eJlfALH3PtteckPx5JJq0kbT+z3kvIeKtJG5Jl9MgYgBk5hr8:c1anjtbeILH3PjecoTAKzqIeKMn/Bx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648561780, "uuid": "af4f219b-9a18-42f7-9ce7-710c549c5727", "value": 28432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648561780, "uuid": "26a8d7c6-bf23-434e-aaf0-0c94fc73f22b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648561780, "uuid": "e043693e-528e-479a-aad8-10278e387abe", "value": "ecdb738cc9b5b083e69765005a652948", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6aa1c8-af77-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648568668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568668, "uuid": "bcbfc2ed-270e-41bc-ab93-bf9c83b1b7a8", "comment": "Malware payload (Quakbot)", "value": "a24bc9f2fc5095861df112e32f721465", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568668, "uuid": "fdbdb568-a8e2-4568-9431-a1fb4cb5727c", "comment": "Malware payload (Quakbot)", "value": "da954e82c9fe0cbc713547393b50f5b449396ce8059a6a049ee51c7440427c61", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568668, "uuid": "cd84b606-f501-4375-b3a8-8d712cf86992", "comment": "Malware payload (Quakbot)", "value": "5117fb60be91044b20ca9f6a0d887cc749dd9970", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568668, "uuid": "98f3362e-5d3b-4246-82a9-5617cc9e31be", "comment": "Malware payload (Quakbot)", "value": "6f3328bf1e18322c3edbcfab45325dd8efb4cbb54fc139b0393c216ee0c6b88d7dd6f7af9cf4b4f749d806d580fc5936", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568668, "uuid": "2fcb19d5-4420-4559-9e7c-c845e9e90082", "value": "T1CD451267D6D2B052C9E4823C43052883691799D650A8FE9848F1FAE72FFF1AE1C5C1BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568668, "uuid": "87a54c11-6644-42a9-a1ca-5ff903f94dbc", "value": "24576:idM3J1a4NL1SkQDjTC2JCQDjTC2JsQDjTC2JqQDjTC2JzQDjTC2J9:2M5Z+kQDhoQDh2QDhAQDhFQDhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648568668, "uuid": "46b58745-835d-41c6-8a55-7e7c327ed68d", "value": 1218913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648568668, "uuid": "5f14ead1-0452-40b0-ad86-d08d14326d0c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568668, "uuid": "36710578-6116-4334-8f2d-fd0af351b5ef", "value": "litsebsiidtna.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376db50e-af76-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648568281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568281, "uuid": "89d9ef4e-18cb-4a75-a7ef-8b05bb4cd9a2", "comment": "Malware payload (AgentTesla)", "value": "393bfb18911160c03c68367042e7ed27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568281, "uuid": "a8e1de66-c934-40cb-95dd-339de98c45cd", "comment": "Malware payload (AgentTesla)", "value": "dad636121376d5be76f70c74bc3a32b4d2022e07d2ada00d53dc6ee2f63759cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568281, "uuid": "3549fb56-3d09-4a1c-88e3-205335301987", "comment": "Malware payload (AgentTesla)", "value": "1b205134bfaeac6fe0470158237f51199a13d05a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648568281, "uuid": "1faa9550-9a74-448a-83d8-37b5d0dc0bb1", "comment": "Malware payload (AgentTesla)", "value": "4f0964f84cf57ed5f41df8fa1a9f957854e3ae23ab642ab72023757be00d74c4e2c57311876f1951245e5c51fbd019ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568281, "uuid": "cd00d0af-c6b0-4d23-8ae6-7bf7ca4bb906", "value": "T1F1B21A159695C626D9E6CA7E9CF235FD467BBE03CC32A65FC9C0FF0D79711040A50A24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568281, "uuid": "54c7e61b-643b-4878-9116-290e29af7fd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568281, "uuid": "d6df8a6f-aa14-4842-ad4f-8952dd9df5ce", "value": "96:fGcrWyRt7Gw/Bwm932zm/FlZUCUqRXIjSZNFAMOHBFzx92OuFnU:KyBJH32zm/lUCvJNuhx92O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648568281, "uuid": "03fb1e23-8c7f-46e0-9daa-7e6b6a397c64", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648568281, "uuid": "b53b77d5-e9a7-449b-a371-632a8c7ff86a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648568281, "uuid": "59f0e927-3588-4180-9ea3-2369fa18bddd", "value": "Scan301103506730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee5fced-af32-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648539088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539088, "uuid": "04189ec9-603f-4db0-ad95-627baf7c18ff", "comment": "Malware payload", "value": "c9a9b729fbf5957a2068c0e2925232bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539088, "uuid": "3f9110eb-4aa2-44e0-b3d6-429ae371401a", "comment": "Malware payload", "value": "db2da84dcb194fcc1894fee2864cd5eaa5b1e980a97bbbd2cd375cb6205c8de7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539088, "uuid": "11d21897-51ab-43f3-856d-f8e43b0d92d9", "comment": "Malware payload", "value": "995daa589fa176b7e4d8258da3f691119247946f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648539088, "uuid": "ee661325-8cee-47ec-816b-ceff94889dc4", "comment": "Malware payload", "value": "3ee78622e5fcd5849a28aa8497e8b3d661c393f2c9576b0625ace179d4b1a3f05222fb2de06792dd429587b29e13abd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539088, "uuid": "f33c229d-a5d2-46b0-a8cb-0d2e43b4cb0c", "value": "T1E9B5233E2058E381C8D4DA7BC4E9E5ED436CDFD1E693A74351C23D5028B266E4299EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539088, "uuid": "1b4a5667-21e7-4169-8696-969f430b915f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539088, "uuid": "232843b5-778a-49f2-8499-5eb2c26f9bc4", "value": "49152:F4kduskZkROrPrv5BPNVsUU7N1g6/9A7yl3sp45wtlIRNSCMXiXd6Ceu:F4EquRO3vHlCX7XsQPvbg3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648539088, "uuid": "bcc0182f-578f-42a8-bf6f-c246f32cfdff", "value": 2394720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648539088, "uuid": "243233d7-3f87-4d30-9838-4b1d304bacc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648539088, "uuid": "0b79ba9c-dc51-477e-91f9-b7dde79dee24", "value": "c9a9b729fbf5957a2068c0e2925232bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4340cb4e-af96-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648582044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648582044, "uuid": "c36a4791-ebd6-4fad-b133-db8ceb3c0793", "comment": "Malware payload (SilentBuilder)", "value": "15607491b1fae48c53117a513dd5b413", "object_relation": "md5", "Tag": [ { "name": "excel",