{ "Event": { "published": true, "date": "2021-12-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-12-09", "timestamp": 1639094581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ce1e027e-53d9-4adf-96d2-298cf1adeb9b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3abdde5-5907-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1639065096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065096, "uuid": "557df9a4-ad6d-449c-8b7f-fff12a48a454", "comment": "Malware payload (TrickBot)", "value": "3d646a89bba2a562b8a491fe0a4fff75", "object_relation": "md5", "Tag": [ { "name": "100021", "colour": "#B7B903", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065096, "uuid": "1f2ca729-09e6-4e59-9def-2d34235f66c8", "comment": "Malware payload (TrickBot)", "value": "00ac480eb8e89d69c6f7ad4b701801d4834aa3d9afbade4f3bb6701be52d5336", "object_relation": "sha256", "Tag": [ { "name": "100021", "colour": "#B7B903", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065096, "uuid": "6a8a347c-1bbf-4abe-8150-1982b5ab07af", "comment": "Malware payload (TrickBot)", "value": "728641affd87d450fb3596ec61b4e912f4aa91cb", "object_relation": "sha1", "Tag": [ { "name": "100021", "colour": "#B7B903", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065096, "uuid": "93f5e6de-afa2-4fce-b6a8-c05fc4eb95eb", "comment": "Malware payload (TrickBot)", "value": "3a0f7940180b365e86afe01069e0aca45a74c201a381333ea46f96d69cb6dd077199cdba0ffec572a208c6f6af42666d", "object_relation": "sha3-384", "Tag": [ { "name": "100021", "colour": "#B7B903", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065096, "uuid": "92fb04ee-6124-40ce-a32c-307c3baec597", "value": "T156D2D01E95A53C19C373983DC24699DDA00E5C622402BE9230E0B34D33B16E727DFAED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065096, "uuid": "ca3c7c99-d695-4863-bc39-639ee29fb498", "value": "768:hSTg3sx6feommUxjfC30+kS4QyoY0ckCam:hH3sx6JmXYk4pZcmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639065096, "uuid": "a0113b93-7343-4a7c-a7e6-225ac77dab3d", "value": 29785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639065096, "uuid": "0445b92b-4123-47d0-a82a-efab856bbdb0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065096, "uuid": "8b47c189-f8f0-40c4-b254-b02e7204bdb7", "value": "9360.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94ec6ef-58ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639052650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052650, "uuid": "d3ec3e39-1aed-415a-aa0f-19befc38129e", "comment": "Malware payload (Heodo)", "value": "a756b033477e98d537ece195ffb4cd8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052650, "uuid": "17b84f1b-4026-4736-9e1b-d2e3bee8d59e", "comment": "Malware payload (Heodo)", "value": "00fb6971817095603fc969736e9ea7ca1e2783bae2c0ca896b74065f6eea718a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052650, "uuid": "2fe04ad5-27de-4426-b59e-1cefe685bfca", "comment": "Malware payload (Heodo)", "value": "09da684da99ec0de6bd03462098a87ab7dd0dc45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052650, "uuid": "a9f66231-6893-4b51-8300-747399787a7a", "comment": "Malware payload (Heodo)", "value": "9ae30390187a4f3a5972f5220e7b021974763897c245818628c9c8975b242151249a0605fac4d57142de945579bebf30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052650, "uuid": "00cd97eb-1296-4586-88f0-b5233403b099", "value": "T1B244BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052650, "uuid": "1db489c3-4ee3-43d8-8a55-694f1425deb3", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052650, "uuid": "acde90f8-758b-4573-a74d-1c703d52dcb1", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBE2ypv:6jIG/pjjuLbJLmGshoCUnWTMpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052650, "uuid": "9fa42fb8-77d3-4d0d-bc6c-9cd363d478dc", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052650, "uuid": "6128bb3c-f0cc-42c0-b915-a5115a9b392b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052650, "uuid": "45adb187-351a-4a2a-a702-c3d15fe19b78", "value": "a756b033477e98d537ece195ffb4cd8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d36677-5912-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639069530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069530, "uuid": "357b008c-b2b5-49f4-a6de-716b512b5d70", "comment": "Malware payload", "value": "80eb2763b2e6052ffee5d54c57f36294", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069530, "uuid": "32b589f9-da08-4138-9ab3-a4623fcf8be0", "comment": "Malware payload", "value": "013dcf7049eddbbde1a44b63f4d6ac04f30be79b7128846d8b8ed971475e7f48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069530, "uuid": "0937c835-cdae-42f7-8190-4c803962841b", "comment": "Malware payload", "value": "d950e56bf7e4c9eda00b648efd4ccd422e44dcfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069530, "uuid": "b178a0e7-80fc-4077-916f-5e3a426b147a", "comment": "Malware payload", "value": "106eeafb9e2bc020ada437eeb3746ae9b9cb41f56eb0b8f9d561a845909ba2db0d3aa0ea56f3fe873acfceb7d4ba1924", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069530, "uuid": "55c7e7a5-a3c4-414f-9c54-894d9777fd89", "value": "T1EB64136231C095A7CAE448B48ABA923EA3F9C11553D18E177760ECF73D361CE0E16BD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069530, "uuid": "13e6744d-20ca-4e1f-9b9a-916a56b68e2e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069530, "uuid": "9300bd3e-99f0-4c51-a385-4c69d5c884cf", "value": "6144:rGiPQ/ZfdKE4c3iwXaGpWAl0Wjc+o4Ar2PXopJM7UDmGBtZ5TOK:OR4c3/XaMl0KJoOPXoDM7UDm4bP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639069530, "uuid": "f56760c3-2c3d-4a09-bfb5-a92dcb623c86", "value": 312841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639069530, "uuid": "c3e362c3-343b-4f36-a613-4ad2459a1d70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069530, "uuid": "f1f59b81-184c-4821-b02e-5ee8f0fd89dc", "value": "80eb2763b2e6052ffee5d54c57f36294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d07f41-5906-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639064693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064693, "uuid": "6c559881-ed73-4636-9672-2db7814df96a", "comment": "Malware payload (ArkeiStealer)", "value": "9d0d5618a8d30f60180bfd2e061f78de", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064693, "uuid": "401a456e-f5c6-499c-bc2e-34ad5bb47870", "comment": "Malware payload (ArkeiStealer)", "value": "0241e8302dd7f1dbb90ad8f26e6d852b665c4068dcd02903f0eac1b7208cf9c3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064693, "uuid": "6fc6409e-a476-4311-97e4-998757664f6f", "comment": "Malware payload (ArkeiStealer)", "value": "b6d80a023d6b68901e48c4e194dd07ec08704743", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064693, "uuid": "289436c6-9eeb-4c6a-bb02-689ae0119b0a", "comment": "Malware payload (ArkeiStealer)", "value": "aaf86ba3bd3f324f7ea34dc3d2ff641bdbc6db3affaa9aeb875f6aba2635fd2f23cd193705eb8c92beba52fd6dd818b4", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064693, "uuid": "c980a423-19de-4222-9faf-8678867d1cfe", "value": "T19AF4F110A7E0C039F4B616F85975A369A93F7AB12B3499CF62D156EE47386E0EC70307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064693, "uuid": "33136fbc-365b-4b78-88d4-1778eb7b12f6", "value": "32bce393cb54cb1fe98663ad8ce84308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064693, "uuid": "ba697cb5-2617-4df0-a590-fae40743a08a", "value": "12288:YQZsEBx4QAaiAwZpcbQunHjQQlek7d0O12ORaFtLm4i1S3jIcvht15wpNvZnwk2Y:WE4QAxcbFnH/tsPhTIswLRjG4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639064693, "uuid": "be5049fb-f217-4a81-95bc-4f85caad2d96", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639064693, "uuid": "bb830dab-16f3-4fa9-a02d-929b7da32270", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064693, "uuid": "34d2a89f-34fa-4207-b584-56d060d96eab", "value": "9d0d5618a8d30f60180bfd2e061f78de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2161b53-58e9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639052235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052235, "uuid": "682397cc-b79c-4bc4-ab32-3f4a1e477a24", "comment": "Malware payload (Formbook)", "value": "ccaa1e132290240311de8c0441287981", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052235, "uuid": "bef330d6-356c-4a78-8569-e91895fac10b", "comment": "Malware payload (Formbook)", "value": "02849a4363429354f94f2e725e203c59c7db6256a2de6730b7b7bacd3fe56893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052235, "uuid": "f552e9c8-283e-4e72-915d-3e5a9c592e9d", "comment": "Malware payload (Formbook)", "value": "e9ee7c7a25d56fd1006763797f0e80330826c19a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052235, "uuid": "5b703b1d-6e8c-4aec-840f-92e310a5a6d6", "comment": "Malware payload (Formbook)", "value": "f96d214166103199201ade209f1c2e6802e1be562705e65d5942222d53083238689208b67206ccc34f515d4b24246271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052235, "uuid": "71b64e16-7f2a-4778-8c6d-8fc8cf7f525e", "value": "T16745231E1DE0E5AAD5695BF183A7C0508A7CF4063CB3F3B55CD242EEB7386CA9542A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052235, "uuid": "3877bee9-c413-4f8e-aa4d-afb207de65eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052235, "uuid": "7137ed38-fefb-405c-8d7e-22b1318da3b1", "value": "24576:WIKjy/SYCpJAv9oP2j1Vq8Hvq+n38KkqyfypuJTbI3N/P0fDi:kjASBZMvPq+DzyfypuJT+n0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052235, "uuid": "35dec2f4-3702-45a9-ad7b-c92607cc23df", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052235, "uuid": "8bd587ac-c728-49d9-ab7c-327399d66aef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052235, "uuid": "8ddea55b-fe93-4bce-934d-dbc82a41257a", "value": "SOA ekini bulun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b267a8-5906-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639064317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064317, "uuid": "17331002-485c-4bc2-b85b-c4fde1540f04", "comment": "Malware payload", "value": "5096680c111700a7343cac14d166ce90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064317, "uuid": "870b32c5-9493-41f5-816b-7f96da02fcc8", "comment": "Malware payload", "value": "02b1c52fbed352a5a52090d0ee09b1e39a15f2218186a94b97e5ca1ef3de73c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064317, "uuid": "7528e983-ed34-4e9a-9898-c5246358d65f", "comment": "Malware payload", "value": "8277b38de8b62abbd9c1722c1a512741622e928c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064317, "uuid": "c5821ecd-d90a-45e5-bdfb-932609f48f07", "comment": "Malware payload", "value": "b9590cd6986fa5c9efd85e73687ff8dae4a34fdd85054bc344f0c6978997886a7f8718a2e495c3b1b8b31ae7d91a84fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064317, "uuid": "3e25c296-3c31-4514-9b56-6c29ed032008", "value": "T1494633031EE78C21F76E32799EF45A2C6548EEBB65C4720E56DAF8842873F060C955F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064317, "uuid": "506abdab-ff19-4368-bc25-70d96c94c9f8", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064317, "uuid": "1fc90dcd-ddca-462f-8762-37688995596a", "value": "98304:PZ1kw1BgaXlJJeDAnT6ieDjoWynHlsRi3AwvVO2HLQq3Hy8El9b5:PTX1jlJtT6ieoWynHH3AoOKQq3y8E/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639064317, "uuid": "ddee3bd3-8a09-4673-a7f5-b544f9841e1a", "value": 5708440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639064317, "uuid": "e2c8dcff-7fb3-4684-a735-de4bac136fae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064317, "uuid": "2e084aa9-6356-4280-ab94-cb168964b8d3", "value": "5096680c111700a7343cac14d166ce90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354a51db-588b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639011545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011545, "uuid": "6fdf9b74-8101-4e0d-8e5d-851983c34a7a", "comment": "Malware payload (Heodo)", "value": "350b52509935a8c7716cb5c5e88c65e5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011545, "uuid": "93cbf95d-4409-4af2-9de9-641553d545a0", "comment": "Malware payload (Heodo)", "value": "0326bb9f9a79a15e6d13754958ec557f077e89dc080c9e7ad99fe90b82d0d6ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011545, "uuid": "b2d59d61-5b30-4e42-9f3d-a9ad22428fda", "comment": "Malware payload (Heodo)", "value": "ad323f8a137bf2d5c0520abea121c497fe02d03f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011545, "uuid": "3e22ad42-b0b8-44f9-812f-eec3b6228589", "comment": "Malware payload (Heodo)", "value": "8acfa7a28b8a6a8a3b36ec48c4fdfcc895d7fde36ebc5695f59a6654f973ec128ecaab0734d59852241187c6004e569b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011545, "uuid": "f3caeafe-d8d6-4cd7-9449-6d514ea87aa4", "value": "T19444BF10A181D036E5FF087A89FAD9BE466C76600B80DDDFA398187E4F6B6C1763059B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011545, "uuid": "1fec23cf-3c9e-4f64-b1b7-f9dd6ddbc9fe", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011545, "uuid": "90adf3ea-7870-4dfa-a77c-a4aaf09097c5", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTB8mgL/S:Wvef8+h61mRcHL+rF6l5EAQWTIL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639011545, "uuid": "0042a3d7-1839-4490-8e6f-ea572a653584", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639011545, "uuid": "dab2a1ea-ef9e-46f2-bc37-2de798142a67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011545, "uuid": "98b6bb3b-27ea-4ec9-97af-4f4cbfe82574", "value": "emotet_exe_e4_0326bb9f9a79a15e6d13754958ec557f077e89dc080c9e7ad99fe90b82d0d6ab_2021-12-09__005901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb441d8-5894-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639015638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015638, "uuid": "255ef7e6-5f55-4d40-bbab-533249c7bc97", "comment": "Malware payload (Heodo)", "value": "1067eac1dccbd9bf47ed17e1ada03c21", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015638, "uuid": "d975941d-70a2-46bc-b284-bc2d4c4eeb8a", "comment": "Malware payload (Heodo)", "value": "035c2f86f6544996a52f4fe3d4f40e0b226fc0ea839636dca320cd7b44c0ee6e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015638, "uuid": "a0221aa1-9f2f-4955-aff3-3b3784e7ca75", "comment": "Malware payload (Heodo)", "value": "8bc6b07f41026931327aa5a207fef85b2d9887a0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015638, "uuid": "ba9e2ba9-5757-4bb9-9d1e-1db3066b293f", "comment": "Malware payload (Heodo)", "value": "c4340c1f8f8eeeee89b12a49c7372de37bf0ecc2ac0cea5f730bdfba8c6ed5f26fc5ee90342cc0b6090f5c341035eeaf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015638, "uuid": "058d667c-7452-4223-87a2-a004f3a84426", "value": "T13593F1DBD299EE6EE4E7D438D5BBA0E92722C027C1685EC181CDCE8C852C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015638, "uuid": "9eb636c7-c877-4446-bdf2-8c70d2f44173", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySZ:Gp4Z3MYeGt9sLBrGrSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639015638, "uuid": "5fe70a74-ea59-4c07-b056-538c807ab80a", "value": 90141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639015638, "uuid": "acd63053-b5cb-4393-8311-dd5410c43fe7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015638, "uuid": "7ab8864c-fb9d-41b8-a967-5f45949f0e67", "value": "emotet_e4_035c2f86f6544996a52f4fe3d4f40e0b226fc0ea839636dca320cd7b44c0ee6e_2021-12-09__020704456265._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdacb479-5894-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639015667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015667, "uuid": "550ac12e-a15b-49d2-a7d7-1ab0a67ed354", "comment": "Malware payload (Heodo)", "value": "0ce96e9e0e675f1d0bf50396472f740a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015667, "uuid": "881fe0b5-3546-4600-9ca0-5e89bbffac96", "comment": "Malware payload (Heodo)", "value": "041a42c759636a5c39f1b8422b93c343c6fd4cad6052009431493992135f1ab1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015667, "uuid": "d6f76e06-dda4-4335-88a1-32ca9e410158", "comment": "Malware payload (Heodo)", "value": "e2f5f0c3f429835667d4479db2af600bf1c925da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015667, "uuid": "6adcec72-3a34-4c39-986d-fa0fdc1c704a", "comment": "Malware payload (Heodo)", "value": "ccd41d1f7fdc5da1e129c3cf8cd87da870a1097157c2a3b2e58a0cf72b95de319b84cf61ecbd41f1d3d537197cdb90d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015667, "uuid": "143c001b-4096-410f-b9e6-df764967ed23", "value": "T1E744BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015667, "uuid": "a125d0f8-9f58-4dd7-923e-dbbf28a66d7d", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015667, "uuid": "f4ea177f-f32e-4cc5-8bf4-8ecd0716e7ee", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBn2ypv:6jIG/pjjuLbJLmGshoCUnWTdpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639015667, "uuid": "63d67e0b-d439-46eb-b9c5-9e894cb4a734", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639015667, "uuid": "867b4dd6-ebaf-41d9-94a7-8ade65a68f73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015667, "uuid": "1048cf1e-8293-4a8a-8784-8ca7a3fde815", "value": "0ce96e9e0e675f1d0bf50396472f740a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7caec2-5901-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639062374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062374, "uuid": "554774df-cbbc-471a-8fb6-e5c27ff0fac9", "comment": "Malware payload (Heodo)", "value": "ae85cd79b479d6fced9b386bdce1f307", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062374, "uuid": "ee1fbc6f-a657-4d08-b1b1-92c377029a13", "comment": "Malware payload (Heodo)", "value": "052fa4aa100211ec170bc835ccee15ab601aafbe131ec86a16b553a0b2f17b4a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062374, "uuid": "8a00a60e-4e2c-4229-aa26-499fa4eb10e1", "comment": "Malware payload (Heodo)", "value": "51e1181d52c22e8e06ab9c45821381606d646e62", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062374, "uuid": "99fb18f2-2a74-471f-8905-707c9c219e12", "comment": "Malware payload (Heodo)", "value": "b2378e2b82203135f1b336e19332634505718507b3f2106200a487aeff40a94b7b61e7c25a94d032ef9e1d92e6f37b4f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062374, "uuid": "29640329-697b-4f09-a119-4dc13f26611d", "value": "T1739301DBD295DD7FF8E6D438E4B7A0B92372C071C15C2E82628EDA48812D5C657FA2C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062374, "uuid": "a5d1d9d4-7a84-499d-b3da-cbe5e63d6d38", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nb7:yIBQ3MYeGt9sLBrGrB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639062374, "uuid": "b66a6070-29b4-4314-b1bf-30ea040e2321", "value": 90156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639062374, "uuid": "5e1cd5aa-2838-4e8b-a35d-3adaa77c9ef3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062374, "uuid": "2da5353f-0293-424c-98ff-b8a0402b5096", "value": "emotet_e4_052fa4aa100211ec170bc835ccee15ab601aafbe131ec86a16b553a0b2f17b4a_2021-12-09__150547074272._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ce8e9d-58d5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639043405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043405, "uuid": "4fa8f126-58b0-4db3-a4fb-b2e3b13251db", "comment": "Malware payload (Mirai)", "value": "bf595aeec75527cb0629e815dc785704", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043405, "uuid": "e24f4487-46fe-4147-933c-96cf89021515", "comment": "Malware payload (Mirai)", "value": "0578a69a2a98e0bf56fd3d580fe7559e82992ee65e0d9fa485935a84dffed540", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043405, "uuid": "72e85897-b54d-4cdb-9414-7f3ac4e426fb", "comment": "Malware payload (Mirai)", "value": "2d9ea6677fca19512fb515c4768a9c48f65eb623", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043405, "uuid": "e4622773-6ba5-4bc8-b770-d71fbc548db7", "comment": "Malware payload (Mirai)", "value": "c227b07c7634371747bb0044ab3145b01654b9cda2357b9d0c36013e84797481a4f77fce77ba886d5eab0c052dedfd14", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043405, "uuid": "30bc8979-defa-45aa-a76f-5edf0ab223a4", "value": "T1C92302132093B903E03458FA45228C8EB65EA7BDB1BE77AB25450E154C35D93ECB1CAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043405, "uuid": "6c9a18f4-5337-4272-a888-1e9b8ca70dc2", "value": "768:aK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFD79q3UELWt/iw+kvBGg6+fYtrBHU:E12O1LCNguovDPH7Tcr1aLWhiw+kvBGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639043405, "uuid": "34775dd2-c004-4722-b46d-e9ae20363e05", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639043405, "uuid": "7fe6aac0-c0a5-4eee-8a28-0cc9c69735bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043405, "uuid": "aad9995d-a57c-47bc-a67b-7feff216ebe2", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d9cc47-5934-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639084294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084294, "uuid": "a9671ca7-98c6-464f-a177-59c37151e647", "comment": "Malware payload (RedLineStealer)", "value": "0b22a5873719e2b8311f7ad1ed0445d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084294, "uuid": "56116d3c-1eaa-4885-882b-ff493e900994", "comment": "Malware payload (RedLineStealer)", "value": "058ac782ac134a4d874c76d4a62ad773fd8ffc9186216fc9d1d44c85e235b1f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084294, "uuid": "a9af83df-fd87-42de-80dd-1082a52c76d9", "comment": "Malware payload (RedLineStealer)", "value": "de183c1d502eec3ae743ac5a4ff3e7367b2f6661", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084294, "uuid": "9e42cae9-53e6-4534-994a-14182e7015d2", "comment": "Malware payload (RedLineStealer)", "value": "bd5d8337f2b4030529da2858b080edab2b82d5338f988dfe2f6d498cf0d1e5a73a6bcf1589be776f48ab177a93fc7259", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084294, "uuid": "4198f6b8-8bb4-4dc6-bcb4-32ed530d2b4c", "value": "T10BA35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084294, "uuid": "4753c125-7fb1-4f0f-a3e4-5c71ecc03426", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084294, "uuid": "057b71a3-168f-45cf-a07d-b6d7b2ae8eeb", "value": "1536:5qs+OqJGlbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2KteulgS6p8l:XRuOYj+zi0ZbYe1g0ujyzdq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639084294, "uuid": "a7755c79-9dcc-48c3-b855-9259a53a85f0", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639084294, "uuid": "eb28eb2a-763a-45d3-9f39-5d7467e230e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084294, "uuid": "8b1a9843-e02c-4d62-986c-2303e6703bd1", "value": "0b22a5873719e2b8311f7ad1ed0445d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85287bd-588f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639013510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013510, "uuid": "66d63607-e672-4850-8ef7-fe3c90b468ae", "comment": "Malware payload (Heodo)", "value": "e274247c9a0863feb5b997ebb0215ddd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013510, "uuid": "59574be8-8251-4f27-81b5-7ced4f85a130", "comment": "Malware payload (Heodo)", "value": "05b639997378ce45b83bd5c6ae4e8a1ad937848e6ef2c8c75c99d4a6c32f0126", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013510, "uuid": "fdefbdd0-0523-4616-afd7-be831c986327", "comment": "Malware payload (Heodo)", "value": "2d5e03eb40fd1434b1b0733b43ac2bf402d432e5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013510, "uuid": "00d04fe6-0596-4cca-a63d-51f86490061e", "comment": "Malware payload (Heodo)", "value": "0089434291f1c3584fe8cbb88b9bfd3738034f7efe57db47907a8df60d86f2bfb5aeb67a5e670d9d26f42e943290d36c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639013510, "uuid": "44048da0-1c5e-4d11-abdb-40fdd31ed154", "value": "T1D393F1DBD299EE6EE4E7D438D5BBA1E927328027C1685EC181CDCE8C852C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639013510, "uuid": "5f145b64-9967-4200-948f-d223f15d759e", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySx:Gp4Z3MYeGt9sLBrGrSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639013510, "uuid": "23bf3349-ed98-4627-90d7-63e7e0933f13", "value": 90143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639013510, "uuid": "e1194c1b-2c81-4759-8164-d431328c1a91", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639013510, "uuid": "c60fae7f-3ec9-4f18-ba01-71d8b5940ebd", "value": "emotet_e4_05b639997378ce45b83bd5c6ae4e8a1ad937848e6ef2c8c75c99d4a6c32f0126_2021-12-09__013134583250._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c74e938-58ba-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639031878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031878, "uuid": "b90258e2-fab6-41cb-86a7-ed2173390d5f", "comment": "Malware payload", "value": "b1274d12c6d07e13f41480dc37afcc1f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031878, "uuid": "443b3932-e7ed-4f72-abcf-8bdb537484e9", "comment": "Malware payload", "value": "05e454a0996825d01bc6b2173879f3fcd9e1f0d9eb3b682234a50e14d8839c88", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031878, "uuid": "a61f03ee-3b57-42f3-a890-4e6c8b939dd2", "comment": "Malware payload", "value": "b0df7d290ed1d742a0ec06981143a9c2d77cec20", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031878, "uuid": "8397ba70-8a29-48cf-add6-682d20b5c70f", "comment": "Malware payload", "value": "2517f9f7c4c1299011ff9b73d15610460b5948458e508b9baacae3e25c1e08ba4d0e8e8cc0f3ccb54cfbe48ac1d0f16b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031878, "uuid": "0c307a49-9f81-4c53-a30d-e272e0984208", "value": "T14BC55D22B1D1C537C0766A7CDD5BA39998257E201E28881B7BD43E4C9F39B817E2D2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031878, "uuid": "c1a658bb-5652-4ffe-8538-2c35325f0165", "value": "24576:qyvdtAZFoWCW5Aeeu3ZwuFEHVbil8Q5Bp8bcnMXCWDbvU7FFSh6ilLWTU+5FfJLQ:qyVlaJJF2hCM3v8TP5Fd61GYY3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639031878, "uuid": "3d8d6720-f88d-4814-baeb-c580b446c84f", "value": 2518528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639031878, "uuid": "2e7d3ba1-9819-4dcc-8eac-46da91bd5477", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031878, "uuid": "ae9ddc9d-3af6-4506-ae21-20c35ed15686", "value": "Factura_08122021_(977KB).PDF_office.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8bf20a-58cf-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639040715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040715, "uuid": "50d377f7-30f0-4838-899f-120f09980e75", "comment": "Malware payload (Heodo)", "value": "850464348342ba7eda70b20696c420a9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040715, "uuid": "c1010525-90c9-49ea-ba40-5b0c16e827ad", "comment": "Malware payload (Heodo)", "value": "060e3ceb92db18b7eb4f9c8b90f6c72724aa2d99dee24ed3a7907817fb76f706", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040715, "uuid": "d890a1ac-cb00-4adf-a935-103af008a034", "comment": "Malware payload (Heodo)", "value": "e5a949bfb8d0feab74e401f1645877510918408a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040715, "uuid": "0e260e51-04e7-4968-8f05-b60c4e4e0392", "comment": "Malware payload (Heodo)", "value": "413daf71bf37dedfba46fb96d94cf3c74e4be03da753535c1b5b76aa961351d3c5285a49e8721f05ac8d5cff391affaa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040715, "uuid": "ef2a2989-79fb-4d45-b3c4-de1290d7bbc1", "value": "T1E39302DAD695DE7EF4E69038E4BBA0B97333C037C0581E82918DCAC8812C5C657FA1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040715, "uuid": "46101e3f-1193-461f-ad25-40a056249122", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3VO:psXZ3MYeGt9sLBrGrQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639040715, "uuid": "31b2ed7f-80cc-41c3-8c90-e164fb5642d8", "value": 90149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639040715, "uuid": "0dde1a46-fee1-4854-a033-3328b6b52fd4", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040715, "uuid": "f14bf333-047b-4e98-ba7f-0a84891de72d", "value": "emotet_e4_060e3ceb92db18b7eb4f9c8b90f6c72724aa2d99dee24ed3a7907817fb76f706_2021-12-09__090501088745._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2ab251-5896-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639016501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639016501, "uuid": "0da2f7bf-dd58-4455-8e36-2374fee2d26a", "comment": "Malware payload (Heodo)", "value": "46f6cb1b7a484648ac86fa5a0fed7607", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639016501, "uuid": "477fd679-e952-4645-be52-3d89564c4fb1", "comment": "Malware payload (Heodo)", "value": "072f6e2f6d4ac61bb9af535b784cc54d3c80e17cb2723045152f96f684e2b084", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639016501, "uuid": "c54e154e-523d-4a2f-a163-21a7ced23e62", "comment": "Malware payload (Heodo)", "value": "5b103957bf0a2293750239fa69462911d7e52023", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639016501, "uuid": "2162f4a0-2a79-4a67-85ee-30934da62f2a", "comment": "Malware payload (Heodo)", "value": "cecc5224ba9090d4415841e1ee50c1b277b2b055e019d66be2f206765baadda1d60adaa3f9b9ec15a6e8f6e89834df8d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639016501, "uuid": "41e718d7-2cf7-4457-a5ee-ca7e2def024c", "value": "T12293F1DBD294EE6EE4E7D438D1BBA0EA27328027C1685EC181CDCE8C812C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639016501, "uuid": "966e2256-ef09-4583-8fbb-d8b1c45a537f", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iyS/:Gp4Z3MYeGt9sLBrGrS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639016501, "uuid": "a13f9592-918b-4523-b5a1-817ebb2098d9", "value": 90143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639016501, "uuid": "f0c211a7-c7e4-4f32-b4e9-d9a465292d57", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639016501, "uuid": "e2e333a3-8ef6-43c3-a88f-808d9b33c9ea", "value": "emotet_e4_072f6e2f6d4ac61bb9af535b784cc54d3c80e17cb2723045152f96f684e2b084_2021-12-09__022126627269._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c83e60-58d4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639042817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042817, "uuid": "0d15b731-24c0-482b-a484-5ffa8acd0471", "comment": "Malware payload (Heodo)", "value": "134fc320c49b31a25ecf23823cf83be0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042817, "uuid": "3167b12b-f03f-467e-a0cf-915afe78b1c8", "comment": "Malware payload (Heodo)", "value": "07862f9628c5171540d4cff2a5e597ae706aea712ae79c60ad7bd2484608ea8d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042817, "uuid": "d9f75879-cb2a-4554-a54c-c0a47b085457", "comment": "Malware payload (Heodo)", "value": "aec929f6bec863582a9a42bfb83d897d482ae2ba", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042817, "uuid": "d91e19aa-7623-4a19-8154-f04617c226ed", "comment": "Malware payload (Heodo)", "value": "a56c84338983c9f50e17bc222ea8e11dd5f4940b446122fee69b4a00f9a329d62d5a5a02746dfab31284b8e9cc47cc4a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042817, "uuid": "e13143f3-ec24-450c-9908-59d01208eb17", "value": "T13D44BF10A181D036E5FF087A89FAD9BE466C76600B80DDDFA398187E4F6B5C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042817, "uuid": "a131a00c-a1f9-46b1-9ad1-7b92cfa889e6", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042817, "uuid": "ae9f5cba-0616-4f2e-a763-5884cd49ac68", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBAmgL/S:Wvef8+h61mRcHL+rF6l5EAQWT0L/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639042817, "uuid": "8c1ec171-4d31-44d4-90ed-0fc187786ae8", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639042817, "uuid": "f0020c83-17d1-4fb9-9486-db220b66f50f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042817, "uuid": "1029222d-1ff2-4215-99ce-d641a0d5befa", "value": "5K4QeIUUo7QetlS.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcbe2fc-5928-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639079182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079182, "uuid": "da030ac7-3510-4d4a-8110-fd7b9e6e23a4", "comment": "Malware payload", "value": "ee9c0996d2aa9b44755c1c693e21181b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079182, "uuid": "eedac66d-0563-465a-80b8-f1e5e9d89459", "comment": "Malware payload", "value": "09487d34e30a980b92503f116d97ce80a8b20cfae702d03dca0e5e4eff79b4bd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079182, "uuid": "84f17e15-f7d5-4307-87f6-c9bc99aefe38", "comment": "Malware payload", "value": "286f93132c78543529765b2348dc09766c74ebee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079182, "uuid": "7592a47e-8b4d-4896-b003-ca38a556b11b", "comment": "Malware payload", "value": "4e458c413d12cef9620592fd5ac702d2ed0f38ae9ce44fdf114e46efb54c6e653cb7b16cb29bb1a342cf48119c90435d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079182, "uuid": "71684a52-e337-4004-9430-dd8e1ce31622", "value": "T1DD94DF2021D0C072D167247C8676C6B64B3B7C65ABA1EACF7FC52A795F343D1C62835A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079182, "uuid": "60b31d37-e3db-4e85-881d-1476e1bbc592", "value": "979c24149674ffe2c511255552b86b69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079182, "uuid": "04205124-27b6-4a29-9ef7-f93edc47b40c", "value": "6144:geRcUQM8GQIkuMp0SS6f975HyHxiwBNM9GyMGuhraQj8TdIThO5qXS:hRcUQM8GfkuMp0kPyR/kjfttTQhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639079182, "uuid": "95ae6014-fd25-4572-9624-19e1c3d80783", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639079182, "uuid": "11e1fb70-342d-4043-9e84-032f0b2f9130", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079182, "uuid": "bb846cda-6b44-4771-9b96-450122688a5e", "value": "roben.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2990a738-5891-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639014103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014103, "uuid": "f75dfbdf-1fd4-4d68-ac01-98df5e6d2dd7", "comment": "Malware payload (Heodo)", "value": "dfc32c3a77d6d848797e6af903ebd571", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014103, "uuid": "89fcdd1f-f4fe-4280-bb76-da895563c380", "comment": "Malware payload (Heodo)", "value": "0ab4057b95eeed07d9c21b8d2a3d5e3ca4c3987eccd31d5b4c50ea08173b11f4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014103, "uuid": "5ca390f1-1fab-4bb3-8026-1cf2050954d3", "comment": "Malware payload (Heodo)", "value": "f9cfe5c39c74fb1ceec19e7a166f871ee1ae3db5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014103, "uuid": "def909f9-e9df-4550-bca5-caa43b7bf40a", "comment": "Malware payload (Heodo)", "value": "3214929ba114bc5baa7b1d29b055828bb0acc120e024386af734e28b451cf73defea2759e31563078c5fbf2816ceb0a6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014103, "uuid": "6f2f8b05-5280-4202-8daa-adad1c6972dd", "value": "T1AD93F1DBD399EE6DE5E7D438D5BBA0E927628027C1685EC181CDCE8C812C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014103, "uuid": "f2e78d9e-bd5b-4425-93a9-22efc366298a", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iyS3:Gp4Z3MYeGt9sLBrGrS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639014103, "uuid": "63b163ca-988a-4e71-8964-b1c50eea09d3", "value": 90143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639014103, "uuid": "5f4c8ad6-2271-46b5-9431-958cb598df43", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014103, "uuid": "6ec8c50a-6bc6-4a24-b5aa-888b9fa4097e", "value": "emotet_e4_0ab4057b95eeed07d9c21b8d2a3d5e3ca4c3987eccd31d5b4c50ea08173b11f4_2021-12-09__014127923110._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43af22f1-5890-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639013717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013717, "uuid": "1079e108-9602-414a-9c1d-38a8aaf0a8ea", "comment": "Malware payload (Heodo)", "value": "0bcecc55ffc51d1c3c076e7011f45bd9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013717, "uuid": "07dc753f-7ced-46fe-b848-46b2b02610af", "comment": "Malware payload (Heodo)", "value": "0ac10c9194dc423e5827161416b0727c2ec83370c29909329c3efb374d606f06", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013717, "uuid": "65ecd818-655f-4df0-a92d-1308124ae423", "comment": "Malware payload (Heodo)", "value": "9ed471cd66a6a565f10bc8ee978a41cc9ac1df70", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013717, "uuid": "9c593831-2c5f-42f6-93c4-9bd214c1a6fe", "comment": "Malware payload (Heodo)", "value": "751a59877b5f0f22ea4407411b0c7ed087fcf56228ec1e0c1b485874da1fd0abf83296c4b4add827de48ef8b8d29e586", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639013717, "uuid": "a343b363-b25b-4a9c-b8a9-ecb084b12b49", "value": "T1BB93F1DBD399EE6EE5E7D438D5BBA0E927228027C1685EC1818DCE8C812C5C657F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639013717, "uuid": "fb7560ef-6761-4139-b95a-7f647abeed26", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySR:Gp4Z3MYeGt9sLBrGrSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639013717, "uuid": "c0e3022b-2d23-413d-bd53-a83637b48032", "value": 90145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639013717, "uuid": "027beb18-44b1-4942-9fdb-ecce28c9cb9c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639013717, "uuid": "7caf941c-36cd-45ae-b56d-1001b21efe48", "value": "emotet_e4_0ac10c9194dc423e5827161416b0727c2ec83370c29909329c3efb374d606f06_2021-12-09__013453043106._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de7e74b-5914-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639070455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070455, "uuid": "330569b2-5b46-471d-925a-26364f2f7249", "comment": "Malware payload (Heodo)", "value": "cda0af45af75732408c46cc27ee72106", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070455, "uuid": "c70e1e82-052f-4624-8621-4dd5d4c6ca4b", "comment": "Malware payload (Heodo)", "value": "0bd193c285d357f2d8207c3e78588727dd95c81425e8ff31e4f6abb76923c470", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070455, "uuid": "97f858d6-d330-4824-b379-4bd47026d469", "comment": "Malware payload (Heodo)", "value": "80ae472499ce49922f76b1159453ac6ecc9fc62c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070455, "uuid": "aa43c6d4-d0a7-4787-9033-4b25154ba3b2", "comment": "Malware payload (Heodo)", "value": "493668987c2b36008f088d1fa45c81e176197e4e6aadb5bd25c13d0eec6c6b6af70771b4165d2140b944a0e446f0e983", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639070455, "uuid": "68fa6d2b-cd5d-4a88-9b05-7147413ad828", "value": "T1859301EBD294DD7EF8E6D438E4B7A0B923328075C15C1E82628EDA4C812D5C757FA2C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639070455, "uuid": "9db8105b-c079-497f-9bdd-50a46bc6af47", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nb7HLx:yIBQ3MYeGt9sLBrGrBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639070455, "uuid": "aa207bd9-fb20-41f3-b3a5-6265d8e996c4", "value": 90155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639070455, "uuid": "b1ed223e-835a-4fff-9ed8-f14ad8b24386", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639070455, "uuid": "7f986031-fb0a-4ddf-8712-e5f7fd6b10ea", "value": "emotet_e4_0bd193c285d357f2d8207c3e78588727dd95c81425e8ff31e4f6abb76923c470_2021-12-09__172040889727._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eedb293-58dc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639046270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046270, "uuid": "86312084-3bd0-424a-8671-5928a87e6166", "comment": "Malware payload (Heodo)", "value": "82c3a10c3718774b3ed9a3b0b00627b4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046270, "uuid": "70e39f95-11d7-42c9-a4e5-62078e3ed3bb", "comment": "Malware payload (Heodo)", "value": "0bd426c1d8d8160a73431c75b28a7de85bf7ec92e4360bdccf867008e0806f7f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046270, "uuid": "b8e79285-5b85-4275-abda-c2b13d81a856", "comment": "Malware payload (Heodo)", "value": "7d20dd504272387317500b666e1f698ee515b3e5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046270, "uuid": "40126787-d03b-4f93-afe5-7c9c8e19079a", "comment": "Malware payload (Heodo)", "value": "9ae27a351f8a87d6db23f5433c694e26ba98adf91149cec114100882cdc0a257290e7d43d90947198f9c301fbfcfdd3c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046270, "uuid": "aa3732f6-0706-4e69-b01c-f6b27cc5df11", "value": "T17B93F1DAD6A5DE7EE4E69038E4BBA1B97723C036C0581E82914DCACC812C5C657F61C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046270, "uuid": "e0a9f6bf-f5e9-43d8-afaa-4ea63c7e25d4", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3J:psXZ3MYeGt9sLBrGrQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639046270, "uuid": "bebd8927-4dd2-4ae3-9218-d1dcaa907775", "value": 90151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639046270, "uuid": "14070c1f-642c-40b2-808b-1685b311f5a0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046270, "uuid": "3e1f3d09-6af8-45b9-852f-7865074ee075", "value": "emotet_e4_0bd426c1d8d8160a73431c75b28a7de85bf7ec92e4360bdccf867008e0806f7f_2021-12-09__103727079013._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27b02b8-58f4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639056960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056960, "uuid": "f5907ddb-527b-490e-ae84-d0a66505f464", "comment": "Malware payload (AsyncRAT)", "value": "39f2f42cff9efd4f2ff4940ddda3ba5d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056960, "uuid": "c635d189-a6bf-433e-8526-daf073d89043", "comment": "Malware payload (AsyncRAT)", "value": "0bd4aa36cf9aa255822ad523b07c55d66fbaddbfff978e22160b875655f84766", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056960, "uuid": "0c74a822-093d-4bdf-b043-30f9e5f1c9a9", "comment": "Malware payload (AsyncRAT)", "value": "f42be8733a41c272ebf78ec680c127aaa499b071", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056960, "uuid": "78905a3b-1c9b-41cb-bc95-8b01f3fa0740", "comment": "Malware payload (AsyncRAT)", "value": "7cb3ddb302560540e476c7659201100e8fe4a682a38565aecaeffc3457bb65dfd0cfa7298414d957cbad9a0e3db6eadd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056960, "uuid": "78855b87-6cf5-4bfb-b898-a4fb40a61139", "value": "T109B44B6D1282E7DEF03ED7B5AA203144E3F4ADF6D723E2C9FCA630DA4563E546A11121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056960, "uuid": "10f011b3-ae6f-45c5-a9d8-7ea6853173b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056960, "uuid": "2ece7f53-93ea-440d-90f9-0c58addb9ee1", "value": "12288:rFZnYdVrwX9IjHoNercRE+78v5e1dRFb:rLnQpoMcREhcdRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639056960, "uuid": "bbb8e890-a43c-4186-8d54-fccc4a2d29f0", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639056960, "uuid": "705d2b82-5c58-489b-8246-ca9535180dbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056960, "uuid": "7e5a6644-6e22-468e-9c78-2809500a844e", "value": "39f2f42cff9efd4f2ff4940ddda3ba5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece67951-58ed-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639053944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053944, "uuid": "77ffaf4b-9827-4cc2-8128-b703e4ea4add", "comment": "Malware payload (Heodo)", "value": "b8707407860c79814efd0406a25b5e08", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053944, "uuid": "6d472fcd-2508-42d9-8e16-c91b18a79f63", "comment": "Malware payload (Heodo)", "value": "0be9d6cb334fc62f10b751c241c8f21645a12c17e1ad1ef4439a9ca0ef278ebb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053944, "uuid": "58163317-5cbf-4ebe-a48f-945588280038", "comment": "Malware payload (Heodo)", "value": "2f705d84ebc30b2899f4d1a6d6bf935aea529e88", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053944, "uuid": "2416e836-34c6-44d3-bc81-370c3a00b224", "comment": "Malware payload (Heodo)", "value": "a5efc80d55bf1541f198fd0603c33c12c370f33d43c2f76e2abcf0efe924b2b9b73a6a7b968c4bd8fe9240145a47c7fe", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053944, "uuid": "7c7c5d01-7475-402b-96b8-ca0c52442995", "value": "T14F9301CAD6A5DA7EF4E6D078E4BBA1B97333C036C05C1E82918DCAC8812D5C657FA1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053944, "uuid": "5f2faa91-4ece-401d-9c05-28148b612f59", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3pv:psXZ3MYeGt9sLBrGrQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053944, "uuid": "a5d950cd-403f-46c2-8bd8-c26538ac259e", "value": 90147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053944, "uuid": "493a6804-466a-4109-80b7-a5fdc948d258", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053944, "uuid": "1eef8643-7902-4347-a5e8-f11542094342", "value": "emotet_e4_0be9d6cb334fc62f10b751c241c8f21645a12c17e1ad1ef4439a9ca0ef278ebb_2021-12-09__124518218907._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a068390-591a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639072945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072945, "uuid": "d6ff7fb7-87cc-4c9e-892f-814c1c6061da", "comment": "Malware payload (Mirai)", "value": "91245ee439a09a0c69d48e500bbb3aac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072945, "uuid": "8f23e087-0088-431f-b34d-1850262026c3", "comment": "Malware payload (Mirai)", "value": "0d815be628d7abd8f0f8ad976d217e2ee52e7a3e6a84d73d9ecf240c87042443", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072945, "uuid": "7cde6292-13c5-4d49-a963-27cfdc0d4f9d", "comment": "Malware payload (Mirai)", "value": "50251877628cc9c5c9e2f1de809527a47f694402", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072945, "uuid": "358af300-ed42-4851-9360-a4436075bc02", "comment": "Malware payload (Mirai)", "value": "97ca7216d49992d24408e85172bb8baac838eb0402e0fa3bf76f64a1b189c72f2708c4d35aa4dfd82a1f0c13f884842e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072945, "uuid": "6892977c-7dd8-46d3-8194-ec1b4b76b37d", "value": "T184739EA5C079EDA8D2A48278BA94C53943139405A1673FFBDAC1C7BAA047FEDF5047B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072945, "uuid": "8f59ba42-f080-416c-b606-b219e3ab7605", "value": "1536:XasfEz/gLltKgh5KcJfX6Ll0TAs3Y5m2CVaoYCBS2:XVIYL+yKcJil00+2MVaoYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639072945, "uuid": "19c04774-174f-4d3a-a826-0d36ad1ed639", "value": 74740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639072945, "uuid": "abbf15ce-5071-4ed9-8c9f-2a998ae95d58", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072945, "uuid": "e3afc890-2cde-47c5-898a-660b9a3ca98c", "value": "91245ee439a09a0c69d48e500bbb3aac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c3b67c-5936-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639084911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084911, "uuid": "f3b42912-7c56-4eb5-b538-d30a23d54fe5", "comment": "Malware payload (Heodo)", "value": "e01658f40196c8810a4b654d10212ade", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084911, "uuid": "4b776992-b49b-4d91-9413-90b9ed186d0e", "comment": "Malware payload (Heodo)", "value": "0d93a4f12d6e52dd86f8194dc522bdf7b6c4724898e929e12943c15cef4f3aa9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084911, "uuid": "c11aeace-851b-47b5-9e94-8ed63266eb25", "comment": "Malware payload (Heodo)", "value": "caed09b776174509351dfe57e87325cacee7c69d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084911, "uuid": "3c989f84-302a-491d-a7fa-0acb8c2ad6d7", "comment": "Malware payload (Heodo)", "value": "3c23c0736c5994c9e92e17b39c7beba9438295d81aee2667dccda5a2867d5b552f2acae8aa97620db060fe93a766e595", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084911, "uuid": "dcd33b55-3478-4dc2-8aed-0a32fd1e4919", "value": "T1E5A39B3C97B6524ED8CF1C3AC1380AEB93770704E24EA479F115E4CAABA76513B5AD1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084911, "uuid": "3fa251ae-4f8b-456c-9fe0-5e70f6a399c1", "value": "1536:l89Wq/YPp20B+axURtKckrr9qZGrhD1GW+wZk4lHpuaI4qMCIZJ:lzXHHxutKckrpqZGh+wrlJuaIjEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639084911, "uuid": "c4f66cee-c06c-4d11-b7bf-8a6a6cf80016", "value": 105277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639084911, "uuid": "63c1cb82-4849-4288-ba43-1e64cfed8e60", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084911, "uuid": "db74613c-16d7-42c9-a21c-f887d8a499c6", "value": "92C25CYW5XDC.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8971a63-58d1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639041911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041911, "uuid": "521db60d-8a0c-4d5b-9f2b-35c3528140d8", "comment": "Malware payload (Heodo)", "value": "76284c56fe88ea148cadc3652ada5ebb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041911, "uuid": "2aa05202-81ec-4dc3-abd2-2b2d3262c4c4", "comment": "Malware payload (Heodo)", "value": "0efb405f6ef2cc680be2a56615d1f6224cf18f33e931fcd314b1f2c52ccc640f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041911, "uuid": "73b99aad-b8a7-40e4-b591-5f50dccf1ec5", "comment": "Malware payload (Heodo)", "value": "5fa57274e5a91d2135633ec8cac22d31c2e29499", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041911, "uuid": "666a56f1-08b4-4920-88db-6ab3232f663f", "comment": "Malware payload (Heodo)", "value": "76cd01a578f3c7d47af9e6a8e4074176b43e34c0f41d5f2b8bf1dd61fb610d66d6087ba270630ea2822319676a60fd66", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041911, "uuid": "5fdb1d9d-a993-4873-bf8e-daa3d502cfca", "value": "T1169301CAD6A5DA7EF4E69438E4BBA1B97733C037C0481E82914DCACC812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041911, "uuid": "f9ccd563-e445-4d64-9e6e-05d04cb5102a", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3q:psXZ3MYeGt9sLBrGrQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639041911, "uuid": "2aa4eb90-2aaf-40c0-87b5-d5d31b0ed602", "value": 90150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639041911, "uuid": "d2e5f322-635f-45cb-a789-44a74f9e0f39", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041911, "uuid": "2962f5cc-0a63-4e08-aebb-8d55481c05a0", "value": "emotet_e4_0efb405f6ef2cc680be2a56615d1f6224cf18f33e931fcd314b1f2c52ccc640f_2021-12-09__092457638155._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afc2306-58eb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639052840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052840, "uuid": "3edb15fd-a227-4e0f-ab78-236bcf67b57e", "comment": "Malware payload (Heodo)", "value": "3a63c9e5cd5ccbba9d2625a7671328f9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052840, "uuid": "955040e7-c7b7-4f9d-9aaf-c2a1d1baa96d", "comment": "Malware payload (Heodo)", "value": "0ffb6e6284253b46814ee31b14dc52780ff06134d6599f1dbe7a31ade56467a4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052840, "uuid": "10b143b7-5258-4044-8f3f-c2d772377390", "comment": "Malware payload (Heodo)", "value": "a7d61820d73ace01671234c70e31fb15bb40324b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052840, "uuid": "6cc6d1fb-ec7f-4f87-aa39-9e2965d3dd71", "comment": "Malware payload (Heodo)", "value": "15f088c616d2f44db01681057689197ada49c4be24e5bf29c1cfbea2d8611aa491ff184d42f730f4132b5721e4e564b7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052840, "uuid": "0e087f71-27cc-430e-8418-e29aa99fc226", "value": "T1429302CAD6A5DE7EF4E69078E4BBA1B97323C037C0581D82914DCAC8812D5C657FA1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052840, "uuid": "430d0898-6d86-4f9e-b253-46ab3f26ab64", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3b:psXZ3MYeGt9sLBrGrQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052840, "uuid": "994dd0af-3f66-4de9-9b66-2957c663a6e9", "value": 90152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052840, "uuid": "c478ff35-280e-4d53-9032-2e365e70dc8f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052840, "uuid": "615fd1b1-bd7a-4e5d-8528-1f72ed99d6a0", "value": "emotet_e4_0ffb6e6284253b46814ee31b14dc52780ff06134d6599f1dbe7a31ade56467a4_2021-12-09__122653986588._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bb36a4-58ec-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639053122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053122, "uuid": "0f97bcd7-73d3-40f4-8a4b-f8887f8a596a", "comment": "Malware payload (njrat)", "value": "b43b1abc6a39ce45305c6e946b20e698", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053122, "uuid": "6d220f93-16b9-4c7f-bfdb-1624ea7306cf", "comment": "Malware payload (njrat)", "value": "101af417f59a62ab91bc1ad215a123ce42fc4b055390b2de038f21cb145c2fe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053122, "uuid": "edd1fe7a-b72f-4399-9820-24a716d951f9", "comment": "Malware payload (njrat)", "value": "af7cc28f1d57ca4f50c816de6d13c3e505e84487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053122, "uuid": "66f980e3-9a02-4418-ab1b-76c9f02ae4ad", "comment": "Malware payload (njrat)", "value": "552dc49a956446601002b46c9d6ff119e9363bb3d8328ec33fb98c6e4340020afd6fb32da12d06d1df003c5f1581a46f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053122, "uuid": "c482c8cb-c0b3-413b-950b-7b6811ac2324", "value": "T11186334226D08245F2626674D614B2B2DEA79E191F07305304D6FFBFBA21F709BB81F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053122, "uuid": "dd9d6a24-8aca-4f1c-8cc2-19dc4b398161", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053122, "uuid": "96ebd1d1-79df-489f-b454-107587ecf6af", "value": "196608:kh+wTEcGuxBviwvoQq9H3vpHSfFs/pMIsVOrVcHJA1yxptTw:sTeuoQq9/pyfCxMIuOrVM4y7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053122, "uuid": "9f314740-8410-458a-8029-eb97c6cafa05", "value": 8008704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053122, "uuid": "985bcda8-fd45-48b9-a267-e7b8fde210a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053122, "uuid": "5d87ecf0-3679-4c20-a98c-8111e69ce7ff", "value": "b43b1abc6a39ce45305c6e946b20e698.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b98656-58ed-11ec-96a4-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1639053956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053956, "uuid": "82fcf79f-c03e-44ee-9431-cab85e1d4fd6", "comment": "Malware payload (Socelars)", "value": "5a388102ebaedb43be90a3e3994d4b75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053956, "uuid": "b479ae17-fd23-4688-882c-3b766ffa7876", "comment": "Malware payload (Socelars)", "value": "10ad1157d0f3d569e472da1f124471820d31fc00ac19aa123b897a99ef205d1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053956, "uuid": "71fd5fa9-515f-421f-be13-7bfdcbbefd40", "comment": "Malware payload (Socelars)", "value": "cfe3149c4e127fc99f24a2fdb3a593053bb95770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053956, "uuid": "4543ca7e-99ed-466a-bf0b-c4b6771f429a", "comment": "Malware payload (Socelars)", "value": "a8ae7bb9799ee97e0afa326f04af2cc4adf6bcf9b2972e81f6022d2cf27710e1036e83ae0b5c5a2bd5e24af74165faf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053956, "uuid": "1cc66a2d-cd7c-4a35-a15f-e4a5b0969299", "value": "T1CD658E13FE42E0B6E8E3047381BF46FB9D2FE9110B2854EF93C419695A615E33B36526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053956, "uuid": "d70297f0-42dc-4dc9-89f8-72091d074b86", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053956, "uuid": "f2fa19f8-5e97-48e5-aa98-123b1d6b1841", "value": "24576:hEpfLmZkUtN/Wy+jtYkQkbF7vZjnYdG/9QDkmhxBXDrdJAdQ3gwXg:WpylrKY2G4+xTBXDrdJOWDXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053956, "uuid": "01142939-c4d1-4a98-aede-4cea8dcd70db", "value": 1489408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053956, "uuid": "97b037bc-ff30-48fc-a8de-85782dd8bf76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053956, "uuid": "634b6c66-f0fc-47d2-8bed-73fc005cb354", "value": "5a388102ebaedb43be90a3e3994d4b75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0edfc887-58f8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Stop)", "timestamp": 1639058296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058296, "uuid": "00139834-3f8f-402b-8162-1df5c7c675b2", "comment": "Malware payload (Stop)", "value": "fbd17faee155b253f513529817c3cd69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058296, "uuid": "cc0f772f-a209-40d6-9856-25e47a5bbcd8", "comment": "Malware payload (Stop)", "value": "11b7f1d4359ffc59bb196438cac277478ebd3e4b03bee2f7ba1f5622f6491b20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058296, "uuid": "deb7f70e-29a0-4641-9687-5e999bc6be03", "comment": "Malware payload (Stop)", "value": "b432e24610b0f157e687235d4ab7c5aa06e96d75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058296, "uuid": "6d1ca06c-1066-41ec-b5a9-8b5c2b8128e8", "comment": "Malware payload (Stop)", "value": "61320e6b9f83f193a65e82a8b665896e8bbf7e9bcd319076978847c91f48c725c3042fd7e2b5bcc0c57bfe8af07be63f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058296, "uuid": "3a575882-aa72-4e23-a3b1-6c37abeb2a48", "value": "T11145E0C2A25443D7DABA32715679B708B13E36B1DF2497C729C73876087BAC06C34D9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058296, "uuid": "496f61cc-c0bd-4352-ad25-5e62bde477ea", "value": "bbdc5cea7d9bbd6ae9c6a36e9d9fb769", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058296, "uuid": "4a3c860c-6b9f-4a51-9208-f6b794ffd0e1", "value": "24576:zl8RRE6uNwusmKYzNm2ICQaOm7yooA9waRWa5iVBQWp0x:GRR73mKYzNdIe76ha58Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058296, "uuid": "537510bb-f1a7-4b88-9c50-678afea331e7", "value": 1263616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058296, "uuid": "ceb250a0-1915-411c-883c-6eef33545907", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058296, "uuid": "8b376041-5967-4feb-b4c2-b2600bf876e3", "value": "11b7f1d4359ffc59bb196438cac277478ebd3e4b03bee2f7ba1f5622f6491b20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2ddf9f-58f5-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1639057114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057114, "uuid": "eecf2d1c-aeb4-4ad5-90d3-649ef260841f", "comment": "Malware payload (TrickBot)", "value": "651d2d8853d25171e8e7ea735de0d104", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057114, "uuid": "a15046c6-65d8-4b5a-a331-8e6c3dfa9a61", "comment": "Malware payload (TrickBot)", "value": "12086cdc5bcec06d1b8b549784a1b46fbe1a18a8330aff3fd4ed164e0ae1e9a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057114, "uuid": "a115ff09-7b85-4848-82ad-320c5ba4ba17", "comment": "Malware payload (TrickBot)", "value": "d782af768518837f4788ecd2910204da813c686b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057114, "uuid": "6f0022bf-af4a-4691-a348-45dd20ed349e", "comment": "Malware payload (TrickBot)", "value": "97246c760fae457d735171cb9b6b4a93e0667bb2ad21e42d51ce0deca87c5b1b6f1865579d0ae8fdc994881aaf100685", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057114, "uuid": "70ee519b-e5ad-43fc-8d6b-d8c94533645d", "value": "T1C0A4D00272E0C035C2EF133D19269B1967BBFD20DB7586CB2751BE9EAE346D18939352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057114, "uuid": "9a8be10e-3a1a-4401-87a7-df6b37ff5bfc", "value": "e768cc53caa0b68006b0ded6604c348d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057114, "uuid": "e8673950-15b7-40de-a0ce-436078c694cc", "value": "6144:v5+iRFTkRhO9SEPtZtfherliYSuTNpBRaj4gzaxCdKJjWJFWMaDTX3H:JFTkatZTm4EBpL0zacMScx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639057114, "uuid": "5d75bd7b-4270-4480-9607-5cb0f7803160", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639057114, "uuid": "856e915e-568b-401b-a37b-94fd7b357a16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057114, "uuid": "5da5a7a5-ad26-45e8-b913-018e37b558b5", "value": "651d2d8853d25171e8e7ea735de0d104.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5353926-5908-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639065555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065555, "uuid": "59ff8eee-3245-4ce1-b33b-834291c9ea2b", "comment": "Malware payload (Vjw0rm)", "value": "91f6af74d269b8020d582cb41392ac11", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065555, "uuid": "311389f8-6c67-4019-aecc-90c509963a4b", "comment": "Malware payload (Vjw0rm)", "value": "126a1a59ccf49cb5c09e69f8588ece339dece436be5af14de462c871ec1fe83b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065555, "uuid": "feaf2018-6e0c-408d-aeb6-fd7a69c2980c", "comment": "Malware payload (Vjw0rm)", "value": "9c03d6159f46325a57c6888109cbd9ef6c7e0139", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065555, "uuid": "f0b2d9e0-2817-49ba-9097-d6c54ff2dfed", "comment": "Malware payload (Vjw0rm)", "value": "28f962258f38825f63d3bf27e89db578be9ac4b8cf72f25fc52fd4810326d12c52e3825c277809f084106d96431795f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065555, "uuid": "86f621c3-8b14-45c4-9322-dfbd592f96d4", "value": "T1BA73B5C4A7C1F88122476B7BBB2770E2E56E1D9876C4897AF044F868F4DCA5EE5C4270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065555, "uuid": "1df03657-b91b-4e4e-9cfb-22de9dc1fd99", "value": "1536:yw7ujs9lkKURcRJTRPln+zxMUIn9QJlRfbpAAWEXwDFr/jXz9S:y8ujs9lkURJTRPln+zxMUInU79WEXwxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639065555, "uuid": "0d155a0a-d18f-4d60-bf3e-9d7c39f3500f", "value": 73768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639065555, "uuid": "39a8fce0-d56f-432c-adb1-fafa2f8288e8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065555, "uuid": "f32966ee-1074-4910-997e-58c4b244c2c5", "value": "QWUOPNSFGA802NM.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6fb7a27-592d-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639081368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639081368, "uuid": "f404167f-b31e-4d56-bf94-2ce2b8b83f84", "comment": "Malware payload (RemcosRAT)", "value": "0d203203558ddf5aa0d072f712ef5f88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639081368, "uuid": "8a4ad1d7-25d3-4150-a8bc-fd31e49fbbd8", "comment": "Malware payload (RemcosRAT)", "value": "128de1f0afc928bcbbcd321202a1704aa25db3950cbaff7da96c5ebfe59620c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639081368, "uuid": "99fe7415-17b1-4d57-b3d7-9a16b69228db", "comment": "Malware payload (RemcosRAT)", "value": "732f1a92ca7719e31ae990404498ac783bd16388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639081368, "uuid": "28706273-c44f-424e-8a8f-4a5ca00b057f", "comment": "Malware payload (RemcosRAT)", "value": "6c1ff0457f3bb6c4c4fb60c9fe639d98a5cf18267b28bcd3cce61962459913c1c5dc07d02dcdc3e97faf2511a922940f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639081368, "uuid": "387ad308-a560-4018-b4c8-83f5665e26f1", "value": "T193F404FC7A425A62FD1FC1308D510A0DBB67CB1362A0B99667CF15CAAB4F0F66D45C88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639081368, "uuid": "b5e4cc69-b8d2-45d0-bbf5-cf4d085c9e23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639081368, "uuid": "e8628caa-a102-4db3-aeb3-ac9268dce87c", "value": "12288:eaABUo8j6TA2/cGvdP/p4UveIaVqRfL2vIUFRySnqzXrNPsJeVImYaG:/Q/cGUUbLRU+Snqz5PkmdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639081368, "uuid": "9d59e4b6-ae52-4e46-98cc-05105cd0aace", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639081368, "uuid": "4dcac26d-5852-426f-8ce2-d19d363ac78a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639081368, "uuid": "8062dd3c-2f13-47ac-87d6-0637079a00ae", "value": "SecuriteInfo.com.MSIL.Injector.VRI.357.19581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ceeb578-58ad-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639026081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639026081, "uuid": "3ab03f9d-d354-4ba0-a13b-53325c92dba8", "comment": "Malware payload (RedLineStealer)", "value": "a955541c6474013b6efb485552876715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639026081, "uuid": "c6a047bb-42be-477f-a505-9dfcab85bbc3", "comment": "Malware payload (RedLineStealer)", "value": "133942beaaf6972019c3fd0f5056173cd2c35ce7769f206b6d1f04ef9cf1e822", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639026081, "uuid": "2d4d079a-d76e-4f7c-af28-ad0be083ed44", "comment": "Malware payload (RedLineStealer)", "value": "b303a7f67d874fede358f7dde134547d6b6f81a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639026081, "uuid": "73d696ca-e64f-4054-8d6b-07df53396b39", "comment": "Malware payload (RedLineStealer)", "value": "e39defccc35e7c7c8fd0e084c677ff8d4876ffbd377d648ae2be5c0e2005b8e04577712ba2b32bc58f4da1fc05ce5c11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639026081, "uuid": "0ac4566b-5b53-4e03-9767-b0c17974d51e", "value": "T1C7A48C2236D99B94F83EE7B91871718403F1F2DAE311F59EFCE410D99492B914E31AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639026081, "uuid": "2c92e2e6-2b14-4b62-8092-c96035789d70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639026081, "uuid": "7f790fe8-a430-4c6f-86af-b582c16b779a", "value": "6144:D4QErtg3bJQJmWFRSrLjE746qh+ePmPdapfvnI0sqznAFrt9aOpO0k0aEJ7/p:GcmojE0DPmFoffFsqznAook05J7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639026081, "uuid": "194fa186-5e5e-4c7e-9ff4-10c33631f799", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639026081, "uuid": "ff870aee-8d1c-4946-9374-fdef530087d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639026081, "uuid": "90fbd25d-c5c0-40fd-9cf7-7af43ef88544", "value": "a955541c6474013b6efb485552876715.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe460533-58bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639032498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032498, "uuid": "0eaef703-561b-40ed-a775-7e79b988f0d7", "comment": "Malware payload (Formbook)", "value": "6b1323fd061cdb11cebd6b69d2fc5501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032498, "uuid": "01db0e11-6ad5-498b-9258-d6630049f267", "comment": "Malware payload (Formbook)", "value": "13694b3225a6c61e8f0ceb508e5d7e03b3f52070bf659109ff3d108251e13a7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032498, "uuid": "17be0297-e51b-4409-bc26-3f0ea63b4e3f", "comment": "Malware payload (Formbook)", "value": "c27376500ca17de23ecbc24aa64e35db0144418d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032498, "uuid": "1e2453e0-1775-41ce-a163-46cde90b93d0", "comment": "Malware payload (Formbook)", "value": "f942e61b58dbb7b03b0f47511710c135e92fd81b6901585d97ccd4baaa59be67a8ee2ba932b4e6ef6d9b784170e50425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032498, "uuid": "0e6a846a-a227-47de-8b62-7d8271efcfb5", "value": "T11535F024997B801CE80736F14F06BD522E2BDEB9D0458A0A277EF2515A3E657CF227CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032498, "uuid": "397cdc83-8766-4cbf-b8f6-fce557fd0812", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032498, "uuid": "d8656ee7-ebf0-4889-aeea-51cf67a6aaee", "value": "24576:G+fX8NbjQpA7BzZagYwDkJGVnyearo1g6IrDAOacWIFD2+u9WdOQPnn:NI7BcgYwDnVf+6CcOHJFChWdOQPnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032498, "uuid": "d824a10f-d3f9-4add-93fd-f0ede84d8179", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032498, "uuid": "4baaf81d-0e33-4a03-8c62-56930ea633d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032498, "uuid": "0b81680c-61f1-44c2-8869-75eb126f0ae2", "value": "HSBC_Swift_Payments_00064.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ffde9e0-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639054164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054164, "uuid": "aacf1d4c-f695-4191-8bcf-fe903981b43e", "comment": "Malware payload (Formbook)", "value": "b2cc8d9f397fc63b47b6a8fc6b263263", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054164, "uuid": "347dd015-c96d-4448-bfa0-a08ed12c53aa", "comment": "Malware payload (Formbook)", "value": "13952c36ff62b97edaaa48649874cf5a353f9646ae29218e28908365c8ac6c7a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054164, "uuid": "2900c0ad-5926-4b34-9994-fa1b47abce6b", "comment": "Malware payload (Formbook)", "value": "18a8e8f678f4f82fc19966074f5d2055b0b08994", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054164, "uuid": "43f01606-f414-45a4-b8f4-5420218f660e", "comment": "Malware payload (Formbook)", "value": "b36ddd58dcff0bad6bd7301b60996446fa1698cd05cce9d3651ef5f189527b3b553f5e07726def8857fa1c0fd2b5ef09", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054164, "uuid": "ebf42b92-7b28-49c4-953c-f7577f171498", "value": "T1D872E6ACD4534295CF86AFB96B1B1F49124C366EF788AA337138573517D6C7A80138BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054164, "uuid": "bf6cb46c-9b9b-4203-a58b-744c8de5d909", "value": "192:DJj0PPfn66WEr6q7DaQ1WDz3vANgHtLnzj3VgyAmEIah72u0Pgm9+FAE2o2mvyaW:1k6697T1KrtLHey6h72JPV8x2olKUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054164, "uuid": "0d6a2df6-cf19-4aa2-8d39-d259c495edf4", "value": 17217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054164, "uuid": "0829d499-8e9b-4fde-ae63-9c9d8eab8d26", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054164, "uuid": "1ac170b7-9cf1-4861-91a0-ce08c59a6bf8", "value": "BSL 21 BYT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f810bfb3-5901-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639062553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062553, "uuid": "2c3064a2-ef51-41dd-9a2c-738934cd8bb3", "comment": "Malware payload (Mirai)", "value": "f3e218496fa5044dec029b3fc98a79f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062553, "uuid": "d2989dc7-9c85-46bd-beec-4a158b0e47fe", "comment": "Malware payload (Mirai)", "value": "15113b33c56a9e562dd6f8a87fb9310f0a6cb034616af0a9db0b2b8843a4599a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062553, "uuid": "3ab1e72f-4705-47ff-acae-998c70036bbf", "comment": "Malware payload (Mirai)", "value": "367513860440f36d1cbd8bf179ec373037f7a8f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062553, "uuid": "bcdc37d1-269a-4a4a-bf35-7fd0776273a0", "comment": "Malware payload (Mirai)", "value": "100cd8b8dd7357d9f4443815d0016ef2c77469f36f206d48e804f6901b898038af172c27061c6f3c3593c7effdfcab01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062553, "uuid": "1e2a2e38-f52f-458d-bb31-851a804dd40d", "value": "T1A5539EB5C5A8BD99CF699278B61488389723900565E33DFAE741C7A6D00BEECF00D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062553, "uuid": "c9c45b05-dbdc-44ea-bd9b-91f3d4a6b72a", "value": "1536:B/bivQhunGauwt4IduhosjT1RYeycfs3QtLok1cY3CJLa:BjiBGFOdOT1Rhf+Kn1cY3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639062553, "uuid": "0fbcd6c5-786a-406f-863f-8b6be2140deb", "value": 64348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639062553, "uuid": "fb87b5cc-ff08-4d7c-b23a-3ca97e5f501d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062553, "uuid": "07385ec8-a821-48fc-b57a-0198c65b1ef5", "value": "f3e218496fa5044dec029b3fc98a79f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399bd23b-5900-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639061804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061804, "uuid": "2e7c16ae-0d52-4e98-b75b-c8cdbfe48dad", "comment": "Malware payload (Formbook)", "value": "2b3e46088a238be94fe9abbd71ff8b11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061804, "uuid": "cf69a18f-babc-438c-8a4d-0dc38649318b", "comment": "Malware payload (Formbook)", "value": "153973d2cd26d5d2aff49d692bc9afa7e5b76e1e465db0aaab1299596f988674", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061804, "uuid": "1f6c8af1-e7a0-4d62-a3ce-33279dd1590d", "comment": "Malware payload (Formbook)", "value": "ada6a12fb2d3f7ac070b37cfd4a6b9d78456f8cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061804, "uuid": "fb14e45b-8bfd-4ac5-8448-625f9b1c27b9", "comment": "Malware payload (Formbook)", "value": "954217d979f2e233c98ea95744df76c92d8dd6f13cc6f42ec064fd880b21850d1d8e8602c2d39c6871573e16210669ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061804, "uuid": "717473ed-0fc4-49d8-850f-72faa4c33074", "value": "T10864235DAEC1C0F3C7A81F35167FA66AE132D2D842521D0337782EB67D112A60D29BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061804, "uuid": "7eefa5f9-7012-4d1b-8c56-78b81a3921ce", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061804, "uuid": "741c48ef-894a-4945-9ec0-f066024ecedd", "value": "6144:rGisu302VktojNX4H3vvtJaNXOSpVO4yndeoOXcNwQV:AuE2tXIgXOSp44ysoyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061804, "uuid": "2565559f-b0b1-456f-99e1-61aec605dfda", "value": 313726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061804, "uuid": "47dc92e4-1860-4e03-9224-ab6803a07f7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061804, "uuid": "58b95384-2c97-4c40-9e9e-324577d805a9", "value": "2b3e46088a238be94fe9abbd71ff8b11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4b709b-5893-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639015074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015074, "uuid": "7b40e8a1-182a-4920-a425-4bf8cf7a0b79", "comment": "Malware payload (Heodo)", "value": "9872ce9b79141647b5ec3b6e96a4ce72", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015074, "uuid": "fb7fcae5-eb2d-4c35-b465-1f4188ec7221", "comment": "Malware payload (Heodo)", "value": "156418b34ca4ce16da844c3c97fd55e06b5f57a739a7592c8ed7d410a4d505aa", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015074, "uuid": "5499b839-e527-4ade-8e93-9d5f237c053e", "comment": "Malware payload (Heodo)", "value": "dd96f19f2a99f2c48d06b239ac2d3b9461371697", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015074, "uuid": "637688f7-85c4-40fb-b62c-63e3eb5d253e", "comment": "Malware payload (Heodo)", "value": "4d571a730ef7027942764db38d9444325fd2e1f883d43837c3352e4e42cdeef758d6a08db19bc43869c616410b6ecb8c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015074, "uuid": "6bc80c58-131e-47f8-bdbc-575e16431054", "value": "T17393F2DBD295EE6EE4E7D438D5BBA1E92B328027C1685EC181CDCE8C812C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015074, "uuid": "46b8342b-fcd4-4076-b3f9-26b2e8043766", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iyS73:Gp4Z3MYeGt9sLBrGrSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639015074, "uuid": "7896169d-16cb-48f2-abdf-e6662324c3b9", "value": 90143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639015074, "uuid": "a4982cf5-d93b-4ab2-8607-6517d12d199d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015074, "uuid": "65055881-f321-46da-b57d-07f6282a7b71", "value": "emotet_e4_156418b34ca4ce16da844c3c97fd55e06b5f57a739a7592c8ed7d410a4d505aa_2021-12-09__015741091805._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aca0206-58c9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639038130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038130, "uuid": "00148814-5e62-4347-8bc7-0d2dfc9b0a22", "comment": "Malware payload (AgentTesla)", "value": "82eaad7c27eac46f9376e57861d12304", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038130, "uuid": "804eca42-47a9-434f-b23b-8a21b7f6569e", "comment": "Malware payload (AgentTesla)", "value": "156d1e789042dbab005c28766573302521bcb24acbb393cd474a21effedc8b85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038130, "uuid": "c6ae9fca-970c-41ea-bda2-401119fa9cd3", "comment": "Malware payload (AgentTesla)", "value": "67ac4f8f0119346d43a84972d9a46d4c8ca70213", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038130, "uuid": "ae7a04cd-84a9-4b1a-9ea8-f80ceec33a5e", "comment": "Malware payload (AgentTesla)", "value": "91aac126ce842d95bf262dc7fd3ec141fffd97e5bef14f6a0478bd260754bddcbb72fe321e38dd2f98ccf5a030fa46e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038130, "uuid": "82cf19e6-0be6-4190-b504-b1295a3396d1", "value": "T1AFA2E47EF58B0E499E57D6A8160A7BA5164DF02D32C840E237BCDB38795D8178B23D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038130, "uuid": "c27363c4-1cb6-4f9c-97bc-b33f1e909eff", "value": "384:D4T2bQYrfJeme0ZgN06fWcMBiM8pnwTo1ScdOjndeuGx4ssH/:0T2b51edPNFEgM8pnwTo1ScdOndI4s+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038130, "uuid": "de1581ce-a219-4921-92c1-3704b106a8a7", "value": 21905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038130, "uuid": "24a4d5dc-5a23-4e6a-b3b3-ffe7a87515ee", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038130, "uuid": "080f4db3-417e-4b19-bb39-ac3fc4d04b1f", "value": "82eaad7c27eac46f9376e57861d12304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008c2770-58ef-11ec-96a4-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1639054407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054407, "uuid": "056a22e2-e0e3-4fd9-b406-964f67de540c", "comment": "Malware payload (STRRAT)", "value": "d79532f750087749d27a51d2b6193c5f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054407, "uuid": "ad974d92-160c-4015-9445-e0d00fa9fef7", "comment": "Malware payload (STRRAT)", "value": "1571a4bf6d272dced62cf114cbc864994cd7d360097263b277a3ac50ac226d21", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054407, "uuid": "3bf8da7d-2d5d-42a2-b31a-4e52751aa752", "comment": "Malware payload (STRRAT)", "value": "5f4c9b790017fdde77432984b125baaf59ca3144", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054407, "uuid": "c2962fd5-5317-42d4-8bab-0e53e2793a0f", "comment": "Malware payload (STRRAT)", "value": "62961395559fad88c654ebdb492d9b497295dc67d6699b75790617a040081c0e5f32afd67b073943e907bfbbe67497e9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054407, "uuid": "04dc0ec6-ee5f-4bd7-aefa-2a16c502c304", "value": "T1C2A3CF1BBDAEC1B9E297C87AD046C233A61D5298E049D21B2DFD54870D70C6E4722EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054407, "uuid": "e05e6d8d-3be7-4008-a758-44299f4c7d61", "value": "1536:bxfJ8oq7atbQEUYku3AYJEC+YGX5vAgRx+J5nukE5N5KWszTvgVxKXDlF:bxfWstHPAYugGX5vlR0J5uz/MBzTEGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054407, "uuid": "c63bc432-939f-405c-ab3a-3a79c7c819c8", "value": 97723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054407, "uuid": "3bf527b2-064e-4af5-b124-1971c0276f72", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054407, "uuid": "6e1a569f-033e-4407-85b7-a2802f2adfa0", "value": "DOCUMENTS_SHIPPING_107865489 (2).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171a03cc-58f8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Stop)", "timestamp": 1639058310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058310, "uuid": "c5c2d06c-a26d-4b44-8930-515afec94bf5", "comment": "Malware payload (Stop)", "value": "7382be38c39bfd3ff5ddd1d8a9faaa6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058310, "uuid": "1c149b03-2446-400f-b189-32558e6aa132", "comment": "Malware payload (Stop)", "value": "161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058310, "uuid": "a1deaa58-a86f-44dc-9020-4ed870f4004d", "comment": "Malware payload (Stop)", "value": "a37a2e981d9cf51ab0527833ec801f45f9e823c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058310, "uuid": "161e08b3-efed-4b7e-902d-22e4704b2899", "comment": "Malware payload (Stop)", "value": "351aa61c29107b648e08ce5ab82a92d1d5b6fd435fdc41baa749a3c9b04929296bf1e7b26453a764d03375d789f50af5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058310, "uuid": "d97ca334-5024-44b2-82ef-6d5aadac9f6e", "value": "T1B20512F029A89935D1A37E30985586905B3B7892E960544BB7B0178F1EF3ECC86F335E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058310, "uuid": "8b71688e-efea-4ef6-bbfe-c17689be107b", "value": "d34b718a18d802a29e1f93c7c2b293b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058310, "uuid": "45a47e1f-4505-4263-8d54-4aefe1ca1213", "value": "12288:8DlGYF163bXquBKPXmZbMbolKqEasaIT39afgUSfJzm0Jlvunnn7s:ul7f5uEolKqKaIT3IoBzmUiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058310, "uuid": "68c8c301-057c-4006-94f4-ae76a3f32162", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058310, "uuid": "0e50cdd9-6dd7-4754-be74-26f7a86d54fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058310, "uuid": "0d801719-6a64-4285-86f3-d9c9821f0550", "value": "161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90286d0-590a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639066313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066313, "uuid": "6a1b0527-9e5a-41a4-8c4a-29ef2efd5074", "comment": "Malware payload", "value": "5a5002f7dd75d7af43ff3392051d1243", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066313, "uuid": "bac089d2-e95d-481e-beff-fd6e1eb55627", "comment": "Malware payload", "value": "163710cd2c2a718aa97daf52c7abe812fd26b3c70e8d26446f56c252698635f7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066313, "uuid": "27f192ab-8485-4101-b801-31417d2002db", "comment": "Malware payload", "value": "8ba688f13a1570ac93d3a1e53763364cc8641465", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066313, "uuid": "2715883f-19a7-4459-96b3-a14e99c0d905", "comment": "Malware payload", "value": "4425f9df42c10e547d388fece186974166957776ea3b42e50a95f7540709cdca28a0b164ca84bd1aaac60f2df027cdff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066313, "uuid": "973d6a68-ef48-4749-9929-23fd58919d45", "value": "T184448C2276C1C436D2A334B1821A96B565AD6A305BF6C2C7ABD05E3A5F341D3973CB0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066313, "uuid": "b36573ac-26ae-41f7-ac08-04a7598bc024", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDaH:HVqLOGNVDzZtIlHN3nkja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639066313, "uuid": "4e960ee0-24dd-4bf7-a37d-ab0972e40eed", "value": 278102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639066313, "uuid": "f54e7ff1-63dd-4aa1-be50-88f34e895813", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066313, "uuid": "8da55ed7-85a0-4e46-a85b-f6860aecd2a6", "value": "emotet_exe_e5_163710cd2c2a718aa97daf52c7abe812fd26b3c70e8d26446f56c252698635f7_2021-12-09__161148.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c631f11-58ed-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639053648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053648, "uuid": "38a5b8e0-ce37-4df3-b6de-2ab0995bc0d5", "comment": "Malware payload (Heodo)", "value": "8a6b76e7729d1da4bc10e0a6238e7bea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053648, "uuid": "edcaaddb-4ac6-48e0-a025-ae8f39dc25c2", "comment": "Malware payload (Heodo)", "value": "16cb3c38360da57e54ec021d529373281fd85cc4afd380356316591456ae1206", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053648, "uuid": "a304a187-ca3c-4e82-a7d2-2be921170fa6", "comment": "Malware payload (Heodo)", "value": "753c3e7caa111c980754f375dd047b45aa692b01", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053648, "uuid": "74dfef30-a891-4d0c-81f3-1d02fb935408", "comment": "Malware payload (Heodo)", "value": "3e51ee6f2ae5f503579d1f7ac9d04b85bff72ab7e303114baa8d0a653b097e339ba48a6cc7ba913095b84fb960c2636c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053648, "uuid": "443562fb-2d6f-4a0b-bec5-dddce804806a", "value": "T13B44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053648, "uuid": "afb41f86-121c-4d1c-a0da-2231b76c44bd", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053648, "uuid": "fd7024a8-7c67-475a-acb8-51d5a07f181e", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTB92ypv:6jIG/pjjuLbJLmGshoCUnWTDpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053648, "uuid": "ed6fc6f6-261b-4890-8b10-225ab25c13bf", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053648, "uuid": "6b75ee89-4192-4e1a-918f-34602058bf80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053648, "uuid": "b7cbd8b3-864d-420b-8300-4a05c4d22088", "value": "RhPpLXoS6q.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e195e3-591b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639073342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639073342, "uuid": "0360c183-e659-4936-9b03-147f3a89b6cb", "comment": "Malware payload (AgentTesla)", "value": "46740189d423dec95e5c3b97b09976b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639073342, "uuid": "d36365a6-216b-41fb-877a-a45180ffebbc", "comment": "Malware payload (AgentTesla)", "value": "17d4779603f929c3efb6312021a597c196fa7a0d452332e41276842ed3956871", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639073342, "uuid": "b67f2f2f-81f9-4376-bf98-46b6e146322d", "comment": "Malware payload (AgentTesla)", "value": "afd4334f95c2e8652506b2ddf591bdae7cee5f19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639073342, "uuid": "0d5dd9b0-9449-4086-ad80-699cdf9f7edd", "comment": "Malware payload (AgentTesla)", "value": "378364943f42b56d285a94d2a9c349c6792843a771ceb072b7f7a616e9aeacc7a6aecf2527f6748833edcff6882218cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639073342, "uuid": "950bfff9-6284-4c4e-8c49-45dbe1811b49", "value": "T1C655019276A5D77EF8364E36D22234500FABBD0B2B41F12144C2B7EE6FF89647582721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639073342, "uuid": "9e22ce04-e8b4-4d13-b83b-987876b4b231", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639073342, "uuid": "1f723fe7-d226-4321-a889-053de819a79e", "value": "24576:JIKjy/SYCpcIjW4BXri9Mt6YYLxWP8RVfbYfCunjhkdCn37Rq:BjAS0IjW0XrIRbPfMKkjh2C37R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639073342, "uuid": "4f29d933-3685-4454-8265-5e6c92351438", "value": 1380864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639073342, "uuid": "885953cf-5e4c-4064-acac-07a4b720acc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639073342, "uuid": "189dfcd2-7941-462f-bcbd-f1e5bc5da926", "value": "46740189d423dec95e5c3b97b09976b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7b1d24-58d1-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639041861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041861, "uuid": "034e53fe-b42f-4a44-aad4-f795d35f682a", "comment": "Malware payload (AgentTesla)", "value": "c61b3e98ec857c92ff456be4ec617420", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041861, "uuid": "a096070b-cc21-4426-bd68-afb375bcf6c5", "comment": "Malware payload (AgentTesla)", "value": "17df1e357b9c6a190182c2feea3ba3fcea97eb5f9cef1d6abe66e366131fa662", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041861, "uuid": "80272e65-efac-48ac-b7a0-5d5f228abd40", "comment": "Malware payload (AgentTesla)", "value": "94354e0fa82be0e54a44d80d04dbd73087eeb85d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041861, "uuid": "43f9cf8b-e0d9-400f-9988-9335271adf99", "comment": "Malware payload (AgentTesla)", "value": "28ccfa87edcf19fcad4caf0146033d66546cec0d6b452dd5c432867dc5ba582529f444da59b484ee51e1ef2f07a857dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041861, "uuid": "03c6561b-6bf7-45d0-af18-9b32331266ff", "value": "T19455231A26F4D0AFD4789AB5C7679090CFB9E0061E73F2759CD6449E6738BC4DA03A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041861, "uuid": "c1c48c18-bdf7-4146-88a6-65df0514fa69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041861, "uuid": "c631fde6-40cd-43b0-8a33-5014f1466a0b", "value": "24576:BIKjy/SYCp50/qqBnU3iWbBgSQFvxLtxIs9F+Mrmoilx46sHAxS/:5jASx0/qYAafxZysv6vx46sHAxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639041861, "uuid": "967d1738-48dd-4ec0-8e4c-2e884b733eb6", "value": 1309696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639041861, "uuid": "a4b55ed7-21cd-4ef9-8834-9e2db0204a10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041861, "uuid": "c70135cf-620c-48c7-b8fa-06bb0e758421", "value": "#RFQ ORDER484425083-NJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea2824b-58fa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639059235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059235, "uuid": "7e5c6134-c13c-4088-9507-eaccbce826f8", "comment": "Malware payload (Formbook)", "value": "c94b0ddd96db5e228846e983856ef81b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059235, "uuid": "4270ff88-e277-4873-8583-004395ed4c74", "comment": "Malware payload (Formbook)", "value": "18a250b294600f42d1883fe122bf7b5e4cf932eabffa5d3a3faf3427cafb2189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059235, "uuid": "587a1f22-f6ba-48bb-ac35-64464df4fdc7", "comment": "Malware payload (Formbook)", "value": "cf03f9a7fe14236bb47d9bc4acda3a9044f773cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059235, "uuid": "74fae4a8-54ab-4a4a-a2dd-f2b8aabd5594", "comment": "Malware payload (Formbook)", "value": "cb36b56e027e0c30fd0396ecb358f34e9683dc01ebcc75a63e789596606361b900d15bdf0df2ac241a5a75f3d89433dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059235, "uuid": "3131f34c-6350-4617-afaa-2c042788afd6", "value": "T10B64125A3AC0937FC84411761A76FF3DEB3BC6BF416A8C039F944FA8A52B807845A542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059235, "uuid": "a80905f3-8d78-4946-964c-75efab9c0d7c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059235, "uuid": "dbb795d1-42ee-40f4-9ad0-429082301e43", "value": "6144:rGiKeI9VuxwE4zs+dW+40Qh5x4WhJGzZrU66NfYs7J:dqFB4d0K5x4WhJGVrlYYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639059235, "uuid": "774ca69d-996b-4075-aea0-2d95ae7084eb", "value": 308145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639059235, "uuid": "8caaf2b2-b9ce-4858-ae01-d8efaca6a313", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059235, "uuid": "5997e82a-8dbb-44d5-a177-3cdc3547890e", "value": "c94b0ddd96db5e228846e983856ef81b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356b8b80-58ed-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639053636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053636, "uuid": "33d57a0e-9908-49ee-9ce0-f8f8f5cc71c6", "comment": "Malware payload (Heodo)", "value": "020b2d4b6e006e236aa4251fe89a2d79", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053636, "uuid": "b3ff42ee-a646-4659-9fef-e09fd77b0f3e", "comment": "Malware payload (Heodo)", "value": "19e1352f3be1901715956efb47d9f8464b59962ae06517b74e966634c659ac25", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053636, "uuid": "271d8e55-5d3b-49af-b0e2-6ae650af07eb", "comment": "Malware payload (Heodo)", "value": "acbc316d5bc033e3d487c79912469de561ca41f7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053636, "uuid": "2a55b7f9-2bfe-454f-b887-8a2689f587dd", "comment": "Malware payload (Heodo)", "value": "784c5f749c35710673f3890cfa2924e44e670e0fafcd5ab77e2d08c667c96f49bf31ec08ed0c90a2948bb5cb7e8d61e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053636, "uuid": "c0b61035-1bc2-4ab3-979c-4430c6b23b2a", "value": "T14A44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053636, "uuid": "ee71d705-4a36-43de-a26b-00e795bef0e8", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053636, "uuid": "b5f76f4a-6da0-4d5e-8cfa-1107ab79e383", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBH2ypv:6jIG/pjjuLbJLmGshoCUnWTxpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053636, "uuid": "25df64c5-705d-478e-938e-be0a40bace41", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053636, "uuid": "c5196d6b-ce4d-4f2d-adc7-bf117d322cca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053636, "uuid": "2c7d744d-e0f7-4bd5-b2f7-f0b5af9d9c60", "value": "43JVowedfNtd5w.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9d60b1-58bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639032172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032172, "uuid": "640933ae-d33d-433f-80a2-777235659521", "comment": "Malware payload (Formbook)", "value": "a9d8f1f85206f809e72b738ecbc910fc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032172, "uuid": "20ecb577-664f-403c-b70e-8973c2018e59", "comment": "Malware payload (Formbook)", "value": "19f62fdd0c1ca0d335c9ed2ae709637e2ab541041560c832dda236ea0823f328", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032172, "uuid": "22c6bb41-62d8-4de2-b92e-30ed8a5c82f9", "comment": "Malware payload (Formbook)", "value": "3e7ca57c49da25b596f9b5e6d3e5a89ff7eb37a5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032172, "uuid": "13d8743d-6c24-4f89-b8a5-536527736930", "comment": "Malware payload (Formbook)", "value": "c35e97ce67570f27e6c90e282ba1c2d45594b6bcdf3fa05b2fb954258c877c12576eea47f2dbbf0d56e6d69b524da88f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032172, "uuid": "8a450c14-f9c9-43ec-abf2-9870cccd95fb", "value": "T1103412273EC226D2E8514A3445BC8FB4264BFC73D63410293D6377CDB8BAC519EEAA15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032172, "uuid": "63b3a101-4dee-403b-a07d-802d9420c1a9", "value": "6144:N1MMjG0Jhlh8ZGMBA+82eR4hATFc4tqWdYS:N1MyJE+d/oATHYWyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032172, "uuid": "5443a735-ca6e-419f-86de-1f6f4140c593", "value": 234616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032172, "uuid": "6916811c-65d4-49fd-bbcd-940fd89ea96a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032172, "uuid": "ecb70221-cb9e-4cce-961a-39cb34c64ba4", "value": "2010.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e8b8d5-58cb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639039039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039039, "uuid": "f73415c0-8446-49da-8d3c-9a18b673a9b8", "comment": "Malware payload (Heodo)", "value": "202a660ca47155018853bc3b467caabd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039039, "uuid": "50d53ae9-91b3-4ed2-b814-77ce2a4f0024", "comment": "Malware payload (Heodo)", "value": "1a5ddae23beb24dcc434b2fb006ca45239931c0c4a12d95f58d4f5059c169634", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039039, "uuid": "d3d4a5c1-7c79-4635-ab21-1b839b38d378", "comment": "Malware payload (Heodo)", "value": "c877e362d447eaebb1a243d4ea2eba0ccaca518d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039039, "uuid": "69e8c109-1ca8-4c65-9b93-ad9e43d5a57c", "comment": "Malware payload (Heodo)", "value": "c1246ba37d3bab97e862b37f4363f4cc2d329a88e6692d41a481d95306ad9bc4971ec92c59dcb3e46185d6d9ffd7e66c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039039, "uuid": "bc996293-0906-4204-bf8d-dc4d2bc2bd09", "value": "T1E69301CAD2E5DE7EF4E6D438E4BBA1B97323C036C0581E82914DCAC8812C5C657FA1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039039, "uuid": "2d058911-94d9-4f04-8093-0d82c3633a69", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3BH:psXZ3MYeGt9sLBrGrQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639039039, "uuid": "35fd7dfe-d243-44f1-a550-a21f74750a8a", "value": 90151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639039039, "uuid": "f4637b15-4428-4b46-9e0c-565a5cb56b0e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039039, "uuid": "d59009af-5e57-4e98-9c4f-bc29c30c2aec", "value": "emotet_e4_1a5ddae23beb24dcc434b2fb006ca45239931c0c4a12d95f58d4f5059c169634_2021-12-09__083656814083._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b6e8a2-58a5-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639022767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639022767, "uuid": "424f9bfa-e527-4f36-b2b6-a166430a0d76", "comment": "Malware payload (RedLineStealer)", "value": "0ea21a71d90c5925b0ef8628312d1659", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639022767, "uuid": "688a9866-bd06-40b5-b819-95504732bc60", "comment": "Malware payload (RedLineStealer)", "value": "1bd73c44580fbd77e95250390ac449d528b2ed9a65afbb1d6f6311a115324ba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639022767, "uuid": "fc1a6e4a-2029-4a08-be11-95db1b025420", "comment": "Malware payload (RedLineStealer)", "value": "afa3a432b8f558e69d0812569f618990896e54c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639022767, "uuid": "85faddaa-2afc-44ee-8563-8199c6ab55e6", "comment": "Malware payload (RedLineStealer)", "value": "1862940026496d0454b88323ba07d1e17bddc28e62ddc6e4aa7df100a8fdbb1ddd524402edcccd30b9d80f56daa2ec27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639022767, "uuid": "01f465fb-3ab4-4a58-abfa-0c12a954e70c", "value": "T11984F01B92CE7ED6D23422B27B775BD0E7EEEE4240A2D81D51F542252C3E11B39823D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639022767, "uuid": "3311ecc3-8598-4920-8e20-5421034c9a3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639022767, "uuid": "e4fcebb5-49cb-44c0-b685-cc5c9c190cb9", "value": "6144:uJQltUut8GETrNXj3tgIWtq7jRqqkTdqw/qFplRb6hNYNLO5nCs3gV:llOuiGcrNX2ptqfkMFJbqt5RgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639022767, "uuid": "23587f16-883c-424f-8065-4267fc3f0b76", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639022767, "uuid": "8f5b0081-ad69-4a41-ac55-f66a9921da91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639022767, "uuid": "e446a066-8891-48df-8f9b-34f1ee88198b", "value": "0ea21a71d90c5925b0ef8628312d1659.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9559a302-58e9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639052079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052079, "uuid": "e754056d-8408-40ec-95bb-b8111fe641af", "comment": "Malware payload (Formbook)", "value": "2cadc6a3746b3c53c91a39d9cd23fc58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052079, "uuid": "8225711b-ce80-4699-9369-ede79b3882ac", "comment": "Malware payload (Formbook)", "value": "1c960c3a6713b6964b98334618b02f3b2d7b134f63841f7d621efa7e9bb5f2fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052079, "uuid": "c96ebcbd-b24d-4568-9558-ab7ba814ce13", "comment": "Malware payload (Formbook)", "value": "9d0bd14f5d9cc75442afe06579aec13ff896c7ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052079, "uuid": "f11e8761-4ee9-4062-925e-02f4c532f566", "comment": "Malware payload (Formbook)", "value": "45ba885a731f6f42c6d7db9d7629f81912b442c9619199ac1d08371dfdc331cadf88592e52a1b57758b32c29e3af6541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052079, "uuid": "a9ab5d18-4940-4e55-9ed3-058c92bbb932", "value": "T1BD45231D29F0A06FE5A867B1C267C0508FB8F8073D66F6B95D9336EE77346898702742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052079, "uuid": "aecc420c-a1d8-4720-bc40-f373783c0c6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052079, "uuid": "b2dd6a3b-ddca-4bed-9f7b-363c7a0ed4e1", "value": "24576:hIKjy/SYCpx3SDNY8B56iKyhvEVaCcd5cbBjtA:ZjAS5CDNl36iVhvEVyd5cbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052079, "uuid": "1a0bf002-972c-4325-92b4-c9de40de7e2e", "value": 1254912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052079, "uuid": "c3e025fb-487e-41c6-ad40-760f41cbb673", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052079, "uuid": "e48881ca-0072-4bcb-bf11-5ae5dd378cde", "value": "FACTURA DE PAGO DE IMPUESTOS MI\u00c9RCOLES, 9 DE DICIEMBRE DE 2021,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768874dd-5887-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639009937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009937, "uuid": "1204bb9c-6e6f-4641-82a0-f43a013d028b", "comment": "Malware payload (Mirai)", "value": "1432b24df9a2f7d198b385fed8e26068", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009937, "uuid": "22ebcd41-252c-4815-a0c0-b76640b41643", "comment": "Malware payload (Mirai)", "value": "1ca81ae653cae148d93f2b0c709ddfbdb12a18477e29bcabecd75a9887881e53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009937, "uuid": "d94228ad-e3ab-4904-addf-b889a3b0f5d0", "comment": "Malware payload (Mirai)", "value": "05dd351e7aea52699abe05cf9276aedca407188f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009937, "uuid": "baf5a4b0-505f-4c48-b482-8c6088e8a382", "comment": "Malware payload (Mirai)", "value": "6514da5a43c25bbb3d9e233dbb362bc5996ecdba954e3c2f102ad7a489e850c93d1a0ace6353f9b950e3fc2bb01e32b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639009937, "uuid": "13bce3af-bbc4-4fce-a46d-d47f582e37de", "value": "T151F33A46AE40CE03C0C71B75BB9F514D3323A795E3EB73068E18AFB43F86A994E66115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639009937, "uuid": "74d05dcc-b766-4d33-b587-05d524baf112", "value": "3072:1xTiMfu/QVk8A2wymDNba8aXoR9j8m2o1m/CeaKiZDM/9j5UCvK:1xTi0u/QGhoaba8aXoR9ImOKXKiFM/9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639009937, "uuid": "5c609933-87f2-4797-9723-b11d6a0c2a0a", "value": 172499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639009937, "uuid": "b5d625e1-5f5f-40e4-9467-84b1cdcbbcdb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639009937, "uuid": "156b70e9-4ca9-4dca-8026-e1d53d72fbde", "value": "1432b24df9a2f7d198b385fed8e26068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfa9c43-58d2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639042051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042051, "uuid": "dc569705-8d16-49fd-91f7-bcc5e7b14321", "comment": "Malware payload (Heodo)", "value": "5260d0b3cf000f4c472036e53a2726eb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042051, "uuid": "bffb51c7-929e-4341-a412-5975c09887e6", "comment": "Malware payload (Heodo)", "value": "1caca6c62444690fa5aa5de8673178c8891570fcfe031130fe19d0834f06b6a8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042051, "uuid": "ba450632-bab9-41b1-b4f0-8e68ebbe8059", "comment": "Malware payload (Heodo)", "value": "a05e67e5958bcca931639c2a5d67b1c796124a81", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042051, "uuid": "c58cc49c-975e-4231-b42b-4bd91cfc9d25", "comment": "Malware payload (Heodo)", "value": "c11048b06f611d701c61d232dc8068fa030d557a0eaaf314f8f4c89c4c6ded061dd563c8c72da2a79d3b4c8cb206e13f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042051, "uuid": "f282e50c-49c8-4ce1-bf7a-a51c562f2206", "value": "T1769301CAD6E5DE7EF4E69038E4BBA1B97723C036C0481E82914DCACC812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042051, "uuid": "63543f66-92a8-4290-a374-e108aedc4f30", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q35T:psXZ3MYeGt9sLBrGrQ5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639042051, "uuid": "3311337d-f9af-49d7-af3f-8ae34095e634", "value": 90152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639042051, "uuid": "b4eca0cc-30a5-42b4-9cbb-2beafc2f3228", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042051, "uuid": "4571cbfa-ff16-4e89-88d4-558e47530e06", "value": "emotet_e4_1caca6c62444690fa5aa5de8673178c8891570fcfe031130fe19d0834f06b6a8_2021-12-09__092708843188._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863e54b5-58ce-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639040458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040458, "uuid": "44cc554d-eca2-48ce-9f55-ab0b51f836b1", "comment": "Malware payload (Heodo)", "value": "fc5a0312a9483fc5192101d23a2e8ac2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040458, "uuid": "57367842-3261-4bd3-af7a-ff7746dd017f", "comment": "Malware payload (Heodo)", "value": "1d19369072f9ba1c982064323ae1c22fe005280ba3e88d6f7b9c23e33985ee25", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040458, "uuid": "6586c387-d576-41b6-ae8c-cfbe456547b6", "comment": "Malware payload (Heodo)", "value": "75d9ddff3f0e7605b7f3d6cb5e9c9320c15f22be", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040458, "uuid": "7fb2db0a-b808-41c5-9267-c9bc1ff3e650", "comment": "Malware payload (Heodo)", "value": "668489888e8a58120e4377501811eaf5b6266a942d0b48d616730ae91184be403d9040c7a825243822c918125412fd3c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040458, "uuid": "bbee668d-ffbb-4a28-b4a1-40a5d96c8900", "value": "T15D44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040458, "uuid": "264011b5-ad0e-41dc-b081-c753e5839b88", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040458, "uuid": "79b4bd4f-5dc4-4d62-8b23-12c939554942", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTB02ypv:6jIG/pjjuLbJLmGshoCUnWTYpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639040458, "uuid": "644ad150-df9c-42b0-8e1b-09ddc541e200", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639040458, "uuid": "7939c4e4-127f-4df3-b710-0828fc340284", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040458, "uuid": "6076d808-8616-4d9d-979e-cc41dd3128ea", "value": "EQhYuiydEfhZ7awOLUe.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347b7b0d-5929-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639079405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079405, "uuid": "97eda801-2889-4d35-946c-a766769be00a", "comment": "Malware payload (Mirai)", "value": "5e61fdb755a251da9127ba29d8959f2f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079405, "uuid": "a75bbc8a-0be9-4bf2-bd4b-1753696e9df3", "comment": "Malware payload (Mirai)", "value": "1d99e9dcb122b48f926d27ec9ccadd4d5c4abd20c729cb27e7e56e0c134380d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079405, "uuid": "bac7fad0-5e5c-4a73-87cf-2b59add7057d", "comment": "Malware payload (Mirai)", "value": "267861442065d40923c33dd776eaae76eced2cb4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079405, "uuid": "3a69cdd0-574b-4aaa-80eb-5a24066555a3", "comment": "Malware payload (Mirai)", "value": "905856ccc64168e4b5524a39fcc497452e0563d635a950eea30b7c68df7c326f91a85099fc97bd9846cef804a35ee2cf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079405, "uuid": "d1fc4a19-302b-41d5-8ca3-a5568ca3e7f0", "value": "T1BE330125C7DE88A5CE201977E1BF1246B16FE7BCC09676D603A8A8907DEB2C77674103", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079405, "uuid": "fdb7b470-70a7-46ee-8ab3-572d497a0945", "value": "1536:5APtoKBLM7wUJSZsdyDL8r1/t4iBpYu68JFJC:5APtcqLIV4iBpYu68JFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639079405, "uuid": "c7cea68a-8b92-433d-9264-35e58aacde38", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639079405, "uuid": "cb760704-fc4a-43dc-875b-1b4f20658011", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079405, "uuid": "f3674f6f-56af-46a4-a6f4-c993a804d2d0", "value": "trynagetmybinsufucker98575.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e7a4a9-58f8-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1639058630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058630, "uuid": "7cdbbe03-953c-45fe-ab2d-86630d41b790", "comment": "Malware payload (TrickBot)", "value": "a56afc71de63613695d894a4632ac249", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058630, "uuid": "df6ec205-56de-4350-a3fa-461e9244d0a4", "comment": "Malware payload (TrickBot)", "value": "1e4e1ad5130eb287fdcade1a16b004803a67577d138e3151c53c14c03fe0df44", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058630, "uuid": "439e2f64-10d5-4cef-bb39-8d5c09c6f325", "comment": "Malware payload (TrickBot)", "value": "4362d61ded17e2e732a74a2a3f78f018fe3cf47e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058630, "uuid": "f4fa0d2f-3396-44ce-90bb-6140e03272c6", "comment": "Malware payload (TrickBot)", "value": "79ce11b2e8654a69e6d6797b1bd2d0f2da704b36ff76d0b1a8b34308b5b6d6f7cecba2c44cfe57a744cb3e6815fb4523", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058630, "uuid": "5b9e3cda-9aa3-4312-ac16-26f3ad65882e", "value": "T1A39549276DD2E0021C175CF69EFB56F4760BC84529224CA72B377645E0A6270FA6F38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058630, "uuid": "596bc7cb-2a0a-4d3b-95f1-8255dca72fa3", "value": "ada2df5716cdc204b561f1444d64c9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058630, "uuid": "e6369983-489c-48c0-9cba-c75ccdc8645a", "value": "6144:qpXjcPUqviYVZFiKXJxDPbOoJcfgQwJ2vkeDkCSHVmrOISZKByfjYoxj:qpXjcPl7FzHebpID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058630, "uuid": "47b29cdd-831d-46b6-9f30-80cb6faf43d9", "value": 2057728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058630, "uuid": "493e734a-646b-443b-ad7b-a9c66b640fa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058630, "uuid": "b90220e2-1266-4c1e-9db2-8a7715dd6bd5", "value": "Google.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c060325c-58f7-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639058164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058164, "uuid": "99bae222-1809-4f14-8493-04bbe94e8e13", "comment": "Malware payload (AgentTesla)", "value": "83f56a4719ebbc90a0f27843cebf19ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058164, "uuid": "7433eb69-84bd-4d6f-88d9-35e9627be82e", "comment": "Malware payload (AgentTesla)", "value": "1e55fa6d522797aa62f012c3015e78a4cc6a27a2d76c6dbd41ad975d3e43b78a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058164, "uuid": "bb8ae5f5-3e48-4726-bcab-b79370dcd1d1", "comment": "Malware payload (AgentTesla)", "value": "0335fabf1139672d7d345878fb455bb871e91445", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058164, "uuid": "7c9f0e10-0660-4581-b7e8-ff1fbeae5b99", "comment": "Malware payload (AgentTesla)", "value": "017cf8aec5ce9b5e6d8355d85adab169d67f02b5e81f7684c16ff63e11e7ceed39ed168f6f1c507416e398cdc824dff3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058164, "uuid": "83956b2d-6c1b-4a3e-b109-33b65c11ee33", "value": "T10C3522AD36A396CDC99142BB3766813802767C37645BC29CD4AA328F5C377D0B973A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058164, "uuid": "dc3a0486-06f5-4d48-9a6e-7ce3d37e02dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058164, "uuid": "3260656b-e5d7-4c9d-9ecb-770bea1e96a5", "value": "12288:Dk6n+1aULytD/pq2GpS5pYPbyENVhqWSHsQWFHAy6wK+RWJrYVvYTwKcFCipLN5+:Dz+IiiLYpS5p6voW0MT5G8FRxnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058164, "uuid": "8d1e69d9-40b7-4be7-9e84-68fffc4df6a4", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058164, "uuid": "5a70b5f6-7363-43e0-a60a-52782b6fad73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058164, "uuid": "e1a576c2-f9fe-4ed0-ae42-11b3c10adba8", "value": "83f56a4719ebbc90a0f27843cebf19ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fae9a8-58e9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639052218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052218, "uuid": "cb2fcd2e-e0f7-4753-8a8c-df3190347527", "comment": "Malware payload (Quakbot)", "value": "083a7886ffd1a916a3991ec80c5e056b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SALES e MAINTENANCE LIMITED", "colour": "#5ECE08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052218, "uuid": "e8803079-4ee6-44c6-af75-64450f4b3cc2", "comment": "Malware payload (Quakbot)", "value": "1e9962a003e423c0bd217ea674754e4d683df8749575302156f9f3e28f3fe6da", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SALES e MAINTENANCE LIMITED", "colour": "#5ECE08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052218, "uuid": "dbcffe42-bfef-4a61-82be-0db045b022aa", "comment": "Malware payload (Quakbot)", "value": "ac30ef599ba025908f5a971abf8ba640d5bd5368", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SALES e MAINTENANCE LIMITED", "colour": "#5ECE08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052218, "uuid": "9dae15ef-7dfc-43ce-b60b-f2f3ee3026b2", "comment": "Malware payload (Quakbot)", "value": "a68274f7e92b90473a19f93a319fc3edb76695823685f665cf248dfcc252c27c525617548b3aa12dcf35252d59e7cdbd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SALES e MAINTENANCE LIMITED", "colour": "#5ECE08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052218, "uuid": "b7493bc0-1624-4c56-ae8f-7ae6e899aae2", "value": "T123C49F76F6D08837D13325389C5B6368A835BE503D2858856BF81D8C6FB93813E7729B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052218, "uuid": "819a224d-328c-48c5-bc5d-fc4c5de3e1df", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052218, "uuid": "e86761c4-fcaa-4180-95b0-baec4e15c6c0", "value": "12288:KWXcaMsRJed93y4JPIkFdHl1L8G394achNmQ8DgrCrhxEhQj:KkrMwi37Tp1Im5hZgryhxEaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052218, "uuid": "6939b915-d7b1-4d26-9b3b-f6917b73c2ef", "value": 596896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052218, "uuid": "ab5eb485-185d-4e95-829a-dfe6fa96c272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052218, "uuid": "103f6afa-bc01-4a46-831c-b870f8b76389", "value": "2021-12-07-Qakbot-DLL-Volet1.ocx-thru-Volet3.ocx.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5150b30f-58d3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639042516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042516, "uuid": "b7457aab-16cf-415a-b847-0f7fcca1b468", "comment": "Malware payload (Formbook)", "value": "acc1b2cc12b044c7037f2295d6c3c242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042516, "uuid": "51c356d6-a712-4903-b47e-5e99700d847f", "comment": "Malware payload (Formbook)", "value": "1ea629620465d959f9f18caae889aa41e0abf098691c7c97b5fc2d523bf14d68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042516, "uuid": "4bfd9a47-840b-4acd-841f-2d0d1f05aae2", "comment": "Malware payload (Formbook)", "value": "e240aa4af43be11fe99511e37a74ee14d52c87cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042516, "uuid": "d83470f5-2428-4e60-841d-866d49cf85c5", "comment": "Malware payload (Formbook)", "value": "91c8bf90cde4287f7caab1dfd6e007bd5df0d853d6fb6892055257e18469730f6748ead113b5d0415f2ec55f0b40a3ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042516, "uuid": "9fbe5c48-8633-4534-b402-8a4bedf71765", "value": "T1DD64239F65D27F6FD58604341CF2E3B6A73A51A822418E4243F81F97AD137824947AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042516, "uuid": "1559bfa7-4265-43ef-8a59-e6e0f863ff43", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042516, "uuid": "c771cbfa-f9a8-4d7a-a5a6-ebf04f92e4ad", "value": "6144:rGim1+dFWpumRUDMaOXhZzj7KTjdReCDSSIXdDFJwe5rxO9RVFfRR:jFWpumRXJNKThtWSIXvWYxOdfRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639042516, "uuid": "cad68ba2-0b58-4a7f-88c6-876a32283cf0", "value": 312020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639042516, "uuid": "784d4798-61be-49ce-887f-60081a3cc126", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042516, "uuid": "a75729c8-16b1-488f-ad30-456b6f1db85f", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.1873.19317.29743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0051fc73-58c8-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639037656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037656, "uuid": "f8533a48-6dec-4468-88cd-d5fb3179bb82", "comment": "Malware payload (AgentTesla)", "value": "aa9950aa2890c5c00ebe48b57639fde8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037656, "uuid": "3d64ede7-40df-4c97-89ce-9eee03c1ecaa", "comment": "Malware payload (AgentTesla)", "value": "1ee21093e235b13a076bc84c04eddaf26fce00598d4ce17bf316f02bd5559fd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037656, "uuid": "e45b9a7c-5ce3-412a-8911-18d20c4e53b6", "comment": "Malware payload (AgentTesla)", "value": "f9e95e8f662370fc787d15c5fdde88848664a0a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037656, "uuid": "35ca3278-1a79-4981-800a-657efe3b90d9", "comment": "Malware payload (AgentTesla)", "value": "b0ac1923591541589f2888a6d5bae7b483752eb80371e452289beafa4ba6917960359a3ad9352d2ff52fb38d7041e62e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037656, "uuid": "02c2e444-3fd4-420b-b476-e8443b93bb87", "value": "T1C6D47C2E1586ABDDF03FD7B8A620605493F0ECE3D723E6C8FDE635DA4567A017A21421", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037656, "uuid": "3315f5ce-5782-4157-bda0-8c1d47ff49b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037656, "uuid": "a39084f1-135c-42ee-9b03-966539cff086", "value": "12288:9R60JOf6N9BazkwRoGfWiV9kZtJqHS2xuA15:9FxBiWiHknJeuA15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639037656, "uuid": "343926d9-af21-442d-b2ac-5ebb943d4a8f", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639037656, "uuid": "b9a91d0f-f655-4fe0-857c-0f0698062fa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037656, "uuid": "1871d6f6-76f0-4fb1-ba0e-ac1b4b859657", "value": "\u66dc\u8f17-2199DO0253.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078e84c7-58f8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Stop)", "timestamp": 1639058284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058284, "uuid": "331ae5dd-8517-4a5d-a8c6-2c05414fa121", "comment": "Malware payload (Stop)", "value": "d614d132dfa3b19348fe0d5da4c6cdc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058284, "uuid": "96f9f382-5cab-496b-84d0-5ef3c960f8ae", "comment": "Malware payload (Stop)", "value": "1f33686d2e744459290a1e7fc82363b201819265c2eb17e3ddbe783eab9fd2b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058284, "uuid": "77cbe807-a5ce-4b3f-bf70-3a2980760dd3", "comment": "Malware payload (Stop)", "value": "e688acf79c0e20cff0fbd0c1cb0fd962b6ef99f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058284, "uuid": "7a27e569-1312-4166-8e23-ade23a2f5ef4", "comment": "Malware payload (Stop)", "value": "c2b032db631b594f099beee08acd599dbd2fdd17df07078510e1040113d60661a153b49009df80b240c9f088c44bb8bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058284, "uuid": "3730e542-392d-4c78-86b3-e7361fa474c3", "value": "T1C515F110A7E0D032F5F613F85AB6937DA63E7AA19724A1CF52D416EA4B749D0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058284, "uuid": "0d7be105-0f73-461a-b518-0177c8158d9d", "value": "d9d9fc0ee02596fca6336fbe79f431ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058284, "uuid": "7c5f5790-1edd-4b49-9fe8-80f154c3e774", "value": "24576:iIalIimv8TjSFg53+qFdYZi0aGKyKy24kaUMiAEk:iIGIz8RhWdaGFKy2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058284, "uuid": "dc092271-e2a6-45cb-afa6-409e71ed6e0b", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058284, "uuid": "9d86f7a0-5797-47e1-94af-e2bd22497618", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058284, "uuid": "de2568f1-5ca4-4494-ae08-e53b28423047", "value": "1f33686d2e744459290a1e7fc82363b201819265c2eb17e3ddbe783eab9fd2b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110e9a10-58fa-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639059159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059159, "uuid": "3d325d7d-18dd-4205-bff8-91a95a8fc1c8", "comment": "Malware payload (AgentTesla)", "value": "d5c24aa2b60e9f8a7e3652f0a18787ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059159, "uuid": "1ab8c563-c43b-445c-bc86-5882dca1ac82", "comment": "Malware payload (AgentTesla)", "value": "1f84003f349f6355ce2617612f0515cc844f0d430b53bf6ed8d7965ec9df14af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059159, "uuid": "a2994a4e-dafd-4a76-b38a-633810e0fe24", "comment": "Malware payload (AgentTesla)", "value": "3baaef2db31bd8d8f0d753382b4168a420ee73ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059159, "uuid": "54c13f42-630d-4c89-9365-5a645807af19", "comment": "Malware payload (AgentTesla)", "value": "37355c01f92dfae79e00e37bf1beb3f6ebd4c939adc42f4b726d284d96d74e510455343a2f530ab74acb66db1e044a4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059159, "uuid": "4e5bd09c-a2e6-495f-aa94-6bef2fb30975", "value": "T18D45231B29E094ABE57C9BB1C3538091CEB5F0031D62F2B45CD741FFAB38A85AA16753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059159, "uuid": "f1280404-d494-454a-af1d-9123a4fdf11a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059159, "uuid": "e205df24-df17-48a8-83ec-814629ad03a5", "value": "24576:xiIKjy/SYCpY4/8CmmHJ/vNMYTNwvgwTuuf+5U0EzFkRqq9XV:6jAS1/8Yp/vlYgVU0ExkhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639059159, "uuid": "a01dfb6c-97de-4621-897d-2a1dca367f34", "value": 1277952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639059159, "uuid": "7c85e70a-005e-4079-a02d-ec6a51a46968", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059159, "uuid": "a3efe854-8fa0-4aef-83d5-e947a04523ec", "value": "d5c24aa2b60e9f8a7e3652f0a18787ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783b0873-58c6-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639036998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036998, "uuid": "3ce96b3e-ee01-45e4-a04a-1af99461e7d3", "comment": "Malware payload (AgentTesla)", "value": "2c2b6500f20bdf91de105e94a918ac74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036998, "uuid": "bd709ea3-416d-45dd-bc7b-90a8daf8ca27", "comment": "Malware payload (AgentTesla)", "value": "2006620442e566078cf90c4d681e7a618c33f2b7a0b598026ff302e97c022f7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036998, "uuid": "2f85e2b6-655c-4614-86ed-eb8f5b5f4eb1", "comment": "Malware payload (AgentTesla)", "value": "97f326541c592fb8b26ddf9441ee84c1f6b8e293", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036998, "uuid": "615af194-c56b-4452-9294-a2bcad3cbbc6", "comment": "Malware payload (AgentTesla)", "value": "e55f7443d17513f4864035f4851cde4a3e54f32b7e626392f332a7245512f36e1bc8cf2c03c99ba4a3b217d7626c7bee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639036998, "uuid": "22251845-a419-4233-ae34-eec3152c6631", "value": "T138350120E97B800CE91775F04F65BE821EABDE78D0128A56677EB158163E313CF2279D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639036998, "uuid": "b56f887e-1fb2-463f-b403-7dd9f15bce07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639036998, "uuid": "72ab3735-a29c-4cba-9a55-d546e9f09743", "value": "24576:l95xS1dt25SofnDM7ExVWt4sMO2WJcSIg4noLMV5cih99qAF2N1:l95UR2pDM7g4t4/gy3J209qAFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639036998, "uuid": "71a08846-6379-45c6-9642-6bc763b88e14", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639036998, "uuid": "ec575edb-d349-46c6-9685-814620cc2b22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639036998, "uuid": "13cb53bc-d5e3-43fc-b6b7-31cfcbcfb42b", "value": "SHIPMENT ARRIVAL NOTICEHAWB R129724.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d4fe02-58c9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639038492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038492, "uuid": "5c0d47a8-01c1-4af4-b2fb-9f37dd81cf87", "comment": "Malware payload (Heodo)", "value": "8dde8a7d3bf01c94ddc2ae08ee94a15a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038492, "uuid": "9deef579-c2d5-41f0-b7fa-15d75e0d9eb0", "comment": "Malware payload (Heodo)", "value": "205f5d06947e589c658f45ddb9ce1ea9f44e649eaa58399381761253b1f84343", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038492, "uuid": "e7293650-9f9a-4ba3-9a69-642d9846f929", "comment": "Malware payload (Heodo)", "value": "e283ff6707937fd2298d926691fb2af28ecb0243", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038492, "uuid": "50b7af1c-1c0a-4c82-97c6-da0616dac021", "comment": "Malware payload (Heodo)", "value": "39d6095bfc9cdf9a30a9f12201db33e8f55db99b52db78d2700f42dd97a0508ab50ab84721d18fc559d1e56d61f83a19", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038492, "uuid": "aa4511bd-02ba-497f-9a40-18328cca5ec1", "value": "T1E893F1CBD298EE6EE4E6D438D5BBA0E92772D027C1685EC181CDCE8C852C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038492, "uuid": "4ca87479-b673-447b-9dda-188a57beaeb9", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySi:Gp4Z3MYeGt9sLBrGrSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038492, "uuid": "9e3b4051-9174-42dd-93e4-38f0d1630468", "value": 90143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038492, "uuid": "08664b91-e4b3-4b3f-937e-bbfd83458467", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038492, "uuid": "e7ed4acc-e871-4069-8148-1005a9cc1905", "value": "emotet_e4_205f5d06947e589c658f45ddb9ce1ea9f44e649eaa58399381761253b1f84343_2021-12-09__082747853549._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1dbef0-58d3-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639042591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042591, "uuid": "1dbd8831-3d58-4748-8b77-d8fa30bbe5b9", "comment": "Malware payload (AgentTesla)", "value": "cd3cac2d9631ac6549719ed3d37f8195", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042591, "uuid": "6fb66891-5fa8-425c-9401-3de97e89e62d", "comment": "Malware payload (AgentTesla)", "value": "21cb752792f97092ae7e9907e7db6b1fb467c76d102759550f7d9bc0c93f559a", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042591, "uuid": "5c571ac2-27a8-420f-b78b-4c70e01f1c5d", "comment": "Malware payload (AgentTesla)", "value": "7f70ea0118cc156049553ec57b0f20adba789bc9", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042591, "uuid": "4be46c4c-1b03-48ea-9945-de1753eca4f0", "comment": "Malware payload (AgentTesla)", "value": "d270cdcb83a4a8ea49a4435a8a2607b4d8d7e87dcb647168f02574cacc08760dc18ac11ae2beca661d25bd70fbc18add", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042591, "uuid": "5d0f3394-64e0-4713-92c1-7b657bfff56f", "value": "T1B5A2D04D93246C0CECFC7BF6C2A2FD4E116E0A53D456F2E658FD22D851B1BA16B0292D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042591, "uuid": "abc69106-6006-42f3-bba8-70e64a8b9b2b", "value": "384:Rirej+ok8w5tNpBndBnapsP98ADW8GNE8bxI1svgAvkwMqR7CyW3Zt2vK9l1p:crg+dzNHapsP9lPGNEkxmyW3ZtP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639042591, "uuid": "2225b77c-e755-46cf-8688-83f63437eefe", "value": 21311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639042591, "uuid": "d4535db4-c22d-4431-bca6-cbfcf1c91d0e", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042591, "uuid": "69e9d862-efa5-4f9a-a4c5-11c548ad22b5", "value": "ProformaXInvoiceX09.12.2021.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23452823-5883-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639008079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008079, "uuid": "6e9606dd-4494-4527-a79a-b456d16d06e0", "comment": "Malware payload (Heodo)", "value": "ac8e52897624e4c393be34fa2f52bbca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008079, "uuid": "e28d59b2-3831-42a7-bb16-697f126f7d1a", "comment": "Malware payload (Heodo)", "value": "22bb3d3a8507c4fb3094ec6bc36731441e982a9d32cf1780538989187d5fadc9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008079, "uuid": "e665ef95-93b2-4dcc-bb7a-75c100dedeb5", "comment": "Malware payload (Heodo)", "value": "4f09021035475166fb0c8deee4ed95122c0f0fb7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008079, "uuid": "dc0fac8c-0780-4e39-ad68-9092b19087ea", "comment": "Malware payload (Heodo)", "value": "986658370dabfb2860364ad32b1f65a2dcf1100fb7aa10d06b8c4183f72b0dba6c217fb6685df860a0afe41a1340d626", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008079, "uuid": "cacde974-7053-4b85-8444-3e363162adc5", "value": "T1A144BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008079, "uuid": "5619dd0d-bc42-49c1-acf8-4ea54fea1fad", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008079, "uuid": "efd6f07d-addb-45c6-828e-06c202967feb", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBu2ypv:6jIG/pjjuLbJLmGshoCUnWTCpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639008079, "uuid": "64595f3f-be03-4cab-b74f-9429f8b84dee", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639008079, "uuid": "33d8a284-ccf5-4bba-a2d4-ac30c4251063", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008079, "uuid": "6ea3a8df-b6cb-44cb-997a-ac91e72fad33", "value": "emotet_exe_e5_22bb3d3a8507c4fb3094ec6bc36731441e982a9d32cf1780538989187d5fadc9_2021-12-09__000115.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3cfeed6-5899-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639017878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017878, "uuid": "749adc80-3a31-4133-9226-67db30f4dcf8", "comment": "Malware payload (Heodo)", "value": "d0b23316b9ee1a3671af4723027ad9dd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017878, "uuid": "a18e08f3-cc07-43ed-b674-311a7d9c9fc2", "comment": "Malware payload (Heodo)", "value": "23675edd086358b68b73c2f2bb2a2836f9fc376f428a3cd804057e6e64f28d4a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017878, "uuid": "a032d2de-820e-415e-b054-8a6921502cb6", "comment": "Malware payload (Heodo)", "value": "62d633630bcde996216d9d67972d218cffa57991", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017878, "uuid": "7ffa4bc5-c1c2-4eb3-8b0f-b101a5451494", "comment": "Malware payload (Heodo)", "value": "f0398fd1837467979bb4f16c6d2d51ecc3c16142743881b358c5cd06abd11146006513eb95b2c2c0d771bd576b676402", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017878, "uuid": "4c9a8a69-4f2d-4ad6-abeb-071a7be72511", "value": "T18B93F1DBD298EE6EE5E7D438D5BBA0E927728027C1685EC1818DCE8C812C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017878, "uuid": "56d3b59d-7270-45ca-b96c-f85094b3895f", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iyS9:Gp4Z3MYeGt9sLBrGrS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639017878, "uuid": "0d68edec-f757-4859-aca8-0970f9a245ad", "value": 90142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639017878, "uuid": "7660b0fe-d8b7-4566-91da-8a303c59ca6b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017878, "uuid": "84193833-f502-45e9-9546-e6c32074df78", "value": "emotet_e4_23675edd086358b68b73c2f2bb2a2836f9fc376f428a3cd804057e6e64f28d4a_2021-12-09__024422419184._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1c110e-590c-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639066938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066938, "uuid": "6772a99f-b0b3-4f63-9527-00661812e799", "comment": "Malware payload (RedLineStealer)", "value": "2d1d18ae0a0e475d1dc68abebc1626af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066938, "uuid": "0cd91696-bbd5-443c-9e8a-e1a6bf6f0b7e", "comment": "Malware payload (RedLineStealer)", "value": "23742e53bde3aeb3a7313e8b63cf12a5b3209b5bfa5b69b0ea1bbff5a8d2b6d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066938, "uuid": "aafa3443-87fe-429b-ac2e-6912130a55fd", "comment": "Malware payload (RedLineStealer)", "value": "c26568ff44f96198cd64e9b94e94ccd4543825db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066938, "uuid": "a2a7d4bd-bb4c-4379-9ef1-6d77a542fa68", "comment": "Malware payload (RedLineStealer)", "value": "6f93fc9cc5d17127bbaf89b6667a364dca8f7caca943f423acde1ea87614753e853a4f54977d28e3bdaafafd7db17a94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066938, "uuid": "36bd8741-2e33-4b90-bcc3-90c6fa046dfe", "value": "T1BD259E06B74CC0E1CA761B3189B6B765D6393C20CB249ACBDBD43D351E747F0A82B699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066938, "uuid": "c8397e4e-1bca-409f-8dce-e12e4d8e3cfc", "value": "9f1127f86499f6cda40cf38ebb837b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066938, "uuid": "965cda06-9de9-4723-a0f8-554651063c2b", "value": "24576:jLpokH5b1+MjP0xr4n45u1qWS4fFFJRTI8Ky:qu1+MjYv5uPXJR8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639066938, "uuid": "7971d545-f2d3-48f8-b948-16237c1ba223", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639066938, "uuid": "6e828ec6-a090-4844-8969-2a6da1159a0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066938, "uuid": "687acf7f-4972-4acf-ae51-d05336be8a73", "value": "2d1d18ae0a0e475d1dc68abebc1626af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666eb626-58ff-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639061450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061450, "uuid": "d91471db-134f-4de4-80e6-204ab7c19045", "comment": "Malware payload (Formbook)", "value": "aa9903d1d74d7074367585c7e4fdd3b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061450, "uuid": "89ba58a2-96d2-457c-83a7-d7c855f37730", "comment": "Malware payload (Formbook)", "value": "239d8f19fdabf7c7759164fe43f586eed4209d86988543b70927aabafc640702", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061450, "uuid": "37de7fdd-9250-4b7b-b01c-45d9ca7b15c6", "comment": "Malware payload (Formbook)", "value": "0104f34fde5c7526cf1b009f90ca667499e14932", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061450, "uuid": "1eb5b387-1be4-4f69-a2fe-eae41d6fa6ea", "comment": "Malware payload (Formbook)", "value": "60e1aed555b343a5042176c7fdaf9b2303a84d1ab6e24878d8b4e066d38dd9765d7acb846bbf225a2261c643a650454d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061450, "uuid": "3c7712b8-a857-4878-a4fa-087959e37d43", "value": "T1CD45231D2AB0916BD07D5BB5C65B80A04B7DF0033D62F6F158D210EEFB39A8D9A47B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061450, "uuid": "b1bc1f4a-6eb7-4d77-be76-58df2bdc092f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061450, "uuid": "90f71bbf-a923-4f2c-b6c7-29808e2e1025", "value": "24576:fIKjy/SYCpTe8MgbTzSbcbPvFraHoIbVI+YOGKnu8hBr5xHc:PjASbeazSbcbVrZACXhKn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061450, "uuid": "2c3cf288-8997-4502-9073-ffcf1f9b878a", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061450, "uuid": "5e7062d5-b5de-4966-bf12-003d2ddb0b2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061450, "uuid": "6986a85d-9f5f-4103-b501-652f51dd6e1f", "value": "aa9903d1d74d7074367585c7e4fdd3b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca54906-58d7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639044414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044414, "uuid": "9e3a13f1-1346-4380-be6a-4b0c9589a15c", "comment": "Malware payload (Vjw0rm)", "value": "eebde117fa1644f9b176dd62ef22cd12", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044414, "uuid": "1725d1ce-bed1-4098-bddc-2ae6fd9903ad", "comment": "Malware payload (Vjw0rm)", "value": "2439efeb595232fe819b8827e94d34363727f37f04b466ffccc31053b60f3061", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044414, "uuid": "c09ef656-1390-407c-9715-b0728cd113b9", "comment": "Malware payload (Vjw0rm)", "value": "4b8beaafadbea30379442a2610125e685f1c580d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044414, "uuid": "b445391a-6561-4574-9f87-fed08139b45f", "comment": "Malware payload (Vjw0rm)", "value": "c8acb0014740afd53949b6580acaefd4f3a83b5e9b8e4a3964268ccb8521f3bcba97668b004e1d896135ecf1de1eeef1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639044414, "uuid": "743ebe85-dd0f-4ee5-bb9f-878c3699d2a3", "value": "T13E54BE10ADC01BF94BC99A1F259E113AE3B8F34B70555C68B152E92F3DE6E00C297D76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639044414, "uuid": "bbb786e3-5b2f-4357-b9d0-98b89df69cb4", "value": "3072:Fp/dQM4zsTkRaP+wBTqUJCKSNHvn3f83WIO/x2xk42/ZUx6+2qEcmw7QngHYcsEd:Fp/dQMn2jNHffW3O/0xAJgHYcsEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639044414, "uuid": "bd58b279-5e41-4b72-8e16-90242e5e014c", "value": 302892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639044414, "uuid": "6f4da0ae-6ef8-4c66-bf4e-77a1d562cd17", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639044414, "uuid": "0d2ea7a2-95dd-4899-b4e6-9f9f2abf3fa9", "value": "DOCSHIPPING107865489.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc372af-58f5-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639057086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057086, "uuid": "c42917c1-6b9c-4346-aed3-635f29598292", "comment": "Malware payload", "value": "66f27cbf386b919ec7f7cf7c8d7fea43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057086, "uuid": "46abf254-beed-4819-a542-87f72c9a08ec", "comment": "Malware payload", "value": "246504d097334c56ecdd717063ffd2b3c5acce5afb01b2e3fabb1d7ffa59efac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057086, "uuid": "19fd53ab-4abf-415a-bdb9-11c91f2f8c1a", "comment": "Malware payload", "value": "52ff08a3b33ef79eed170f2f528c699071da5720", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057086, "uuid": "c6980333-08c4-4f97-80bf-05bf047d059a", "comment": "Malware payload", "value": "ecdd673a6518999aecdedf2cc55f545554baf724eaa933296e3ed5e44367872c6f81b2592107173f9ce4fe9f90b59a4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057086, "uuid": "3a202030-f4a7-49ca-9e81-a75ff471a1ce", "value": "T159B1C605774085F2C1367DB985846AF5536DC021637A97CF9B0F4D382F72AC26C38A0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057086, "uuid": "ec29f37b-10e4-4827-8554-75fefb6e394a", "value": "96:7Iz0Wip6pWkkhZeaDkp8xQiefq9GCjm+EbyXcQBfAajHy0:Ezxip6pWkye6GwQiO+E2sQBfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639057086, "uuid": "e738f50d-8636-47ac-9712-fc2ad4fef0a4", "value": 5531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639057086, "uuid": "97d04a67-e6b4-44c4-a85e-49cdeedf7923", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057086, "uuid": "81684968-a31e-4633-92cb-8370e6cd2e8d", "value": "66f27cbf386b919ec7f7cf7c8d7fea43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dd436a-58e9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639052110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052110, "uuid": "3e03b880-b3d8-441a-966f-015bf5a82eed", "comment": "Malware payload (Formbook)", "value": "e535d43a1190a3341795c4334fbd4189", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052110, "uuid": "a7cffdf9-65be-4faa-96e7-227bdd31148c", "comment": "Malware payload (Formbook)", "value": "2484fb64f74b2c49b5ea851f2f609c9084d0d8aa0b04670d3ecc13fbbe93d62f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052110, "uuid": "5900056f-55a3-44f2-a0ab-4099003bbdcf", "comment": "Malware payload (Formbook)", "value": "e084536833f3cfed60c1a8c7220de98b59c5a6d9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052110, "uuid": "f7bc5afc-91d5-4c62-9c65-d77199695499", "comment": "Malware payload (Formbook)", "value": "604d9a4a89ff6f799419cd5c02743378ba7b5f96e6a1345a7b837ecee71a23f6a439b461da0195eeae4bf6ee8a2afe9c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052110, "uuid": "b1b62466-08bc-44b5-bcb7-8b89924b4649", "value": "T19565334A2BF75DD69704108295F39C65CEB8FF9302A58F42F5F83317F4A9A92CD90886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052110, "uuid": "38629a37-570e-43ad-a7dc-bbe1caf44c43", "value": "24576:H/VPehORuqtNfH3BarYFHnkGYyTqPWM/fHNccvT30H8T92YYFTgYjq4yUvEO:Q0Hnv3BamHnkGYYqVfHicoHE2UYjqzuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052110, "uuid": "a66dc24c-9bb3-4a8f-8b43-59430e42684f", "value": 1461895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052110, "uuid": "bd0bba9a-7375-46eb-af9b-19e22c359a2a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052110, "uuid": "4dd84702-7d94-4df5-9ad1-c364c10dbc37", "value": "PO SPLACK 20211208.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c8c6e5-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639054204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054204, "uuid": "dc09db0d-ee0c-4121-8b78-315cba7071f0", "comment": "Malware payload", "value": "7e8b5cee143a82ad1f9ff768533b11ea", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054204, "uuid": "b9a9c28a-8ce7-435e-8cff-32fd6215cb40", "comment": "Malware payload", "value": "26142949c9b7b54cb493c03fc07d9017dde87ed43f7554e5f46c7bd5c51df90d", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054204, "uuid": "69884e00-f2ad-4ab3-be35-2b2d713efa5e", "comment": "Malware payload", "value": "696c751011e14b30e45ea4927de84cb4157a9394", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054204, "uuid": "2cf97e47-af88-48f3-b43a-fcc56b91277f", "comment": "Malware payload", "value": "502362fccf32356b59c548f05a54a663fc49574b6fe66198debd77899d385928e0db9ff66c2f14737d0f85431fe0951b", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054204, "uuid": "b5141d47-b4a8-4daf-ba51-92f53fcbea05", "value": "T11634123A79E99AB7C066413AD5F90760245DCF1609C7B6360B823F99247C05CE9C8E7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054204, "uuid": "ef6b1e16-a656-4a46-ae0a-ea71c766af56", "value": "3072:TXZwd3Dq55SwoAZshp36auVnwYbs8PuPUdVlYjhtKAMJPDpJuBzD4iPs04xcpBXB:Tqxm5GAiqaUBPgUd4OAMZWR+0q0BX2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054204, "uuid": "bdbeab90-6894-4771-b0aa-4565957a4d9c", "value": 234328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054204, "uuid": "aa120bed-2a05-43f1-983a-0b645e30fdda", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054204, "uuid": "f9282254-4b9d-4a60-8dc0-30970d153395", "value": "CARTASCONF.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d3b434-58f1-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639055276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055276, "uuid": "b6250f23-594f-444f-9ffa-9ec99690b8ce", "comment": "Malware payload (AgentTesla)", "value": "3cf5578a63f3c0e1c2287b54ace97e1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055276, "uuid": "a86d53cf-3310-46f5-a659-9dfe06a721cf", "comment": "Malware payload (AgentTesla)", "value": "2616f21f603be9d713383f2e93569275e7ac181b5e5ef6d0e122ecdbe97a0977", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055276, "uuid": "fc23a05e-e052-4891-ab7b-48c8fe43a4aa", "comment": "Malware payload (AgentTesla)", "value": "ce6808b120da3b495f8a712f188264d230229b78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055276, "uuid": "5be39f01-c3c1-4665-8415-228e8a0f6e35", "comment": "Malware payload (AgentTesla)", "value": "1c227ea811f645722bc30a29769aebb22d92cfa6800241643bcf835c54d45949f3e2f0ba14ca98e908cc7adba7f16ad2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055276, "uuid": "b7ed65ab-4a0a-4c96-8d8f-57b0a9334856", "value": "T19035234A1664AF60E5786A33307790120B7DBD889D27773A7D40B1BE6CE2705CF43AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055276, "uuid": "8418a8ee-9703-4be0-97ce-999e610bd338", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055276, "uuid": "146762b8-0678-4d83-87ea-e92420044c3a", "value": "24576:1l7xmrH0B8/WXEq2l2zswXrPEcukXiKRXuwB9C/HkwG1YlBe4JN:GjhwbccukXiKRXHEvcYDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639055276, "uuid": "36f19757-c574-4305-8a1d-f02e44943af4", "value": 1082368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639055276, "uuid": "335bc05b-12bf-41ce-9d2f-dd61d1e66d2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055276, "uuid": "65272f9a-9a28-4220-a25a-f0b457f00b60", "value": "scan.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62dc28fd-58ff-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639061444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061444, "uuid": "874bdfd6-1d30-41a7-b113-d5923dd05f8b", "comment": "Malware payload (Formbook)", "value": "ce49ba36b3618ee7405996fd42c43580", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061444, "uuid": "caa3c7b8-054c-4d53-9973-acb7185dd8fd", "comment": "Malware payload (Formbook)", "value": "261f6891f91c54e852b53fa480e333c2ab5f3ef675abee81e3632ff9c67defbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061444, "uuid": "ba6a8c8b-e51f-45b7-b674-3e825c7c9c2a", "comment": "Malware payload (Formbook)", "value": "e92e01993aef5ed5adfd884c7104c0fa65c4e417", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061444, "uuid": "39a8389c-20f7-4188-a961-d2734518563c", "comment": "Malware payload (Formbook)", "value": "5a720f65559d92d068322f85b977af8d7ed365f306afaf5e877d02d3c111d51bdc6cf018ef417c636f68d9ab9303cca8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061444, "uuid": "43a2e29f-3ec9-478b-850e-059b138eeb56", "value": "T1BEA4E1116042854FCA912235D15FC22060476F9C3CC4F99BAA373EB5BB6DAD7BC3A693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061444, "uuid": "019052d3-71ee-465f-a61c-29349c4147be", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061444, "uuid": "43c0655a-3486-4e56-b57e-893c779f3686", "value": "12288:f6XTFI7zRuHQ3VAkyCM6wydenZteMTFibdVCPIlE7:f6XTFI7zRL3VAkyRwiwDCPoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061444, "uuid": "4e357bce-f6b5-4e7c-b102-712d6b2556fe", "value": 478163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061444, "uuid": "5a878a17-07c3-41bd-9f85-3d99113c9eff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061444, "uuid": "ddf91841-9d4f-4f94-8ee8-997afc022555", "value": "ce49ba36b3618ee7405996fd42c43580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a464c0c9-58fc-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639060265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060265, "uuid": "5486bcb2-8d85-4947-bed0-116f60f5f6af", "comment": "Malware payload (AgentTesla)", "value": "744ec7a585ec238ff0d15781c043327e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060265, "uuid": "7f21c204-30ea-434c-9a43-c9ec18133cb2", "comment": "Malware payload (AgentTesla)", "value": "266e38483a4da1a80d66024e616870cde350f8f960186b854d0d39bee20919f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060265, "uuid": "d7f9fb3c-137d-4bf4-adc6-317ed25e5ec9", "comment": "Malware payload (AgentTesla)", "value": "b909e0561719610e80bef8839718b644a72eed74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060265, "uuid": "6b33e58a-3084-4442-938e-e03eb5f835c4", "comment": "Malware payload (AgentTesla)", "value": "ee5a4edea41cb97ab0f4390d7b69a1563c71798300221d3dfaea0560dc6f3273468bccf0d81566fa6f7216357147b15d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060265, "uuid": "087bf357-4289-4321-8bf5-e92435bb3d7b", "value": "T1AFD40292A340D4CBDC798B75143790D871B26CDE41F882FE63EAB667AA73363420715B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060265, "uuid": "fb852b03-fbae-497a-83d3-06031017677d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060265, "uuid": "d1c7c929-cec9-4819-9367-b364562247dc", "value": "12288:WdslDw+zKEP4Ki315evLySoJuG3mXuPnF1LeFrFfFAVeJd:3DTmPx3LevtGWePnFpWrHAVeJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639060265, "uuid": "bf01191b-ac75-47d8-99ed-613c6f84ca5a", "value": 625625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639060265, "uuid": "658a3f69-80d9-44c7-9d43-ea520f384966", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060265, "uuid": "245f37df-34f5-460d-9409-566821e7e229", "value": "salary receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2ea39b-5892-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639014511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014511, "uuid": "b4ffe583-54f1-440a-a5b5-c0e0c29ab825", "comment": "Malware payload (Heodo)", "value": "0e98cb0307a2fb8756db4e40c02563ce", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014511, "uuid": "0e7f83f7-73d7-4e67-baec-a90e00b0098a", "comment": "Malware payload (Heodo)", "value": "269d1c7e269a65e41eabfebd31f8b69221ef8e8cf548bb85dc4232fb0eb2b233", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014511, "uuid": "5d265f83-c651-4716-8640-e9731dc5fbd0", "comment": "Malware payload (Heodo)", "value": "7580636b64c314a6cf4411720627f535c4acbab3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014511, "uuid": "61997aa1-e93c-4bfd-8bfb-67bf5b5588f1", "comment": "Malware payload (Heodo)", "value": "de5d24dbb4cc16f78bfaae96a132ebeab43f9926123eb640ca0c65d867074da476a2b2ab591dec3a52c42da315994542", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014511, "uuid": "0fa38647-c257-4f59-942a-c059b173905c", "value": "T16293F1DBD295EE6EE5E6D438D5BBA0EA2732C027C1685EC181CDCE8C812C5C657F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014511, "uuid": "43570d73-e500-4b9d-a766-0100aaf41887", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iyS6:Gp4Z3MYeGt9sLBrGrS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639014511, "uuid": "415a6a8e-d562-43e6-8f69-674c528c2167", "value": 90144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639014511, "uuid": "5fd7354a-c42b-4869-9cd8-0149f8e20e4b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014511, "uuid": "d3d92d06-13ff-4ab6-8838-27490afdbab1", "value": "emotet_e4_269d1c7e269a65e41eabfebd31f8b69221ef8e8cf548bb85dc4232fb0eb2b233_2021-12-09__014815281431._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f0b363-58b0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639027706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027706, "uuid": "1ad0ff08-26be-4dcb-bd15-a247bcf0d5d6", "comment": "Malware payload (Formbook)", "value": "62589453130012c75bbbd1f5fcb0ee9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027706, "uuid": "302c773d-1da9-4797-ac25-166684f0cb95", "comment": "Malware payload (Formbook)", "value": "26f8a3be2038752ea7ea42cffe424d460ac03d3128f2e9305259c48a9431a09a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027706, "uuid": "94db99a0-7841-4657-b101-d98d21844147", "comment": "Malware payload (Formbook)", "value": "af861b23a1a4585626bc8d8301344814812cf151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027706, "uuid": "4532eeca-808f-434d-80f9-2017b0263b42", "comment": "Malware payload (Formbook)", "value": "a52e82cd2734bb19c61d795b154a3e3addf23bbc90cd47bf20ff7e65e289c3f28ceba5df3c3f43d40a55286685e83a64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027706, "uuid": "109612ba-b214-41a9-85aa-1d0ecc506b5c", "value": "T1C164228AF4F0826BF1457A3147B76A68E7F1CC9139D319A7C7C95F374C9428B01261EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027706, "uuid": "c27e6ea4-1a8a-45cd-9cbd-60db78bfa003", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027706, "uuid": "ba7c0cd9-389b-42cf-a5a7-1a5319a2b8c6", "value": "6144:rGiAQUqgYMe4ajsGnk94pDx8DL4ozjp4DITVGTsqzIq:GqgXe4oxkmn84oGDMYTt0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639027706, "uuid": "04a4feef-315b-42b5-a6cf-8071219526a5", "value": 310990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639027706, "uuid": "565d3e47-223d-4e4a-8ce8-5ce3332609e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027706, "uuid": "b561cf3b-e3e9-4a9d-9d1e-8461b7df3ac8", "value": "Order_docx1.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd73f0e-588f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639013576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013576, "uuid": "26505220-29af-426c-a80d-cef1cbbf7545", "comment": "Malware payload (Heodo)", "value": "8d8550e99a47ffc69911fef6ec7400f2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013576, "uuid": "938f6a47-89fd-4ce3-ac50-df025711a7f2", "comment": "Malware payload (Heodo)", "value": "27bde2e65c9c39c649f79637cad810caa0644c38cde65d23f720e52f53c673a3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013576, "uuid": "760f35d5-5293-49bd-818a-c3495cf5e31d", "comment": "Malware payload (Heodo)", "value": "2d8fd0e22b31ee226daf2da987e10dab4f56b6a5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013576, "uuid": "9d372960-5ca2-4a4e-805d-6bde12e72baa", "comment": "Malware payload (Heodo)", "value": "ea4b13320a66acf8be7054df7f15da95870a60f441b225dc4df14ecb9a3b80512f374adfe75d150f277f50ad6509690b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639013576, "uuid": "bd52dba2-bda4-444d-be44-5aa1e7ec21a9", "value": "T11A93F1DBD298EE6EE4E7D438D5BBA0E92722C027C1685EC181CDCE8C852C5C657F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639013576, "uuid": "5749cd40-864e-4dd0-ae85-33c2e93d7a3e", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iyStq:Gp4Z3MYeGt9sLBrGrStq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639013576, "uuid": "2849fa6c-258d-4251-bc63-02f72bd482d0", "value": 90142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639013576, "uuid": "8207d2a2-316f-4b2e-98e8-5e3474080cf4", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639013576, "uuid": "22904e9c-556e-44e0-bf5a-32df2fc9391d", "value": "emotet_e4_27bde2e65c9c39c649f79637cad810caa0644c38cde65d23f720e52f53c673a3_2021-12-09__013245124214._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0863c608-58d5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639043253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043253, "uuid": "3aec7394-ec32-4661-bf2c-f7cef3842f12", "comment": "Malware payload (Heodo)", "value": "0ef568ac4a0c57c286db8ff218452ca6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043253, "uuid": "82faf32a-2c68-4248-8c0b-98fc377d2a75", "comment": "Malware payload (Heodo)", "value": "27d8d433591ead545c9bfe5911df5fcd1b6b43522c35d45bb535401da036ee5d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043253, "uuid": "d26af4b9-1c04-405c-83bc-3227b7aaeace", "comment": "Malware payload (Heodo)", "value": "14514110d94b9f506e62c51d39aae186153766d1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043253, "uuid": "1a8934c4-9749-4723-ae85-dec78c7713a1", "comment": "Malware payload (Heodo)", "value": "cf95df8d7c0a1077ced78640018a8d54c46cecfcf59e07b56a116c173c2c8312e011af65cc6e1690a869591f109e0683", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043253, "uuid": "b431b91b-2993-4fa9-8e61-ed2ab95ab696", "value": "T19644BF10A181D036E5FF087A85FAD9BE466C76600B80DDDFA398187E4F6B6C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043253, "uuid": "c37bf83a-26ba-4b72-8e71-68e3f697412f", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043253, "uuid": "e7195791-4c8d-4363-a572-35fbcd5bef12", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBRmgL/S:Wvef8+h61mRcHL+rF6l5EAQWT9L/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639043253, "uuid": "b2333dc7-417f-4e4b-87d5-2cc72c02df5b", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639043253, "uuid": "c3c88e88-3385-4f0e-a473-7993cf186e3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043253, "uuid": "5bd3ed10-909e-47b6-8cf3-99d0422fadac", "value": "FaB13UH3e9Lb8Nt.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd613cc-5936-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639084927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084927, "uuid": "c2374120-122e-4b18-8f9a-69c7625955b5", "comment": "Malware payload (Heodo)", "value": "c27dadeada04bd7c028ffb9d6c1a3f0f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084927, "uuid": "549216c1-cc2f-4a3a-8553-ef923c1017f4", "comment": "Malware payload (Heodo)", "value": "27eb195a0ed6e64b5b3a50fd111ddd216fd6545a3b74891745c72970cad9035f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084927, "uuid": "8864655a-45d7-4cb1-aa61-41ed8be0b3ff", "comment": "Malware payload (Heodo)", "value": "584338650595e7e06f93ea30476c9ba6a892cf58", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084927, "uuid": "fb34b637-f796-4dfa-934d-6c6c36ee9f58", "comment": "Malware payload (Heodo)", "value": "8304fd58406546d55fb0163218ca1ea61e17b19220c7bf094590a2773b42e99b6f64210b82e210b8bb5c950217b864f0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084927, "uuid": "0deeeff7-10f3-4674-b041-ef89570804b8", "value": "T1C9A38B3C97B6524ED8DF1C3A82380AE793770704E24EA479F115E4CA6BA76513B1AD1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084927, "uuid": "69d08b45-cfba-40ec-9f5b-4b2985dc820f", "value": "1536:eHpqqHip20B+axURtKckrr9qZGrhD1GW+wZk4lHpuaI4qMCh:YBHiHHxutKckrpqZGh+wrlJuaIjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639084927, "uuid": "2defd637-541d-4f23-8a71-f818143adedc", "value": 105264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639084927, "uuid": "1405f9a4-6562-4671-a5cf-9cdcf1a1247d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084927, "uuid": "b2c438de-71a4-48ae-9aeb-0d5b83e4f520", "value": "VEM1VZ1WWCQ9F.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1bff88-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639054047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054047, "uuid": "258ed531-7b3f-411f-b61d-7a9b72a3a250", "comment": "Malware payload", "value": "574d39ca0baa1576eaca8223b9e99395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054047, "uuid": "b5afd5e9-0dfa-4b74-a740-f52c059be111", "comment": "Malware payload", "value": "27ff9f9b57c554f1ad9dee6ab5a3e0f0a18a4275319dd55ec0e2dce1414c41f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054047, "uuid": "bfa215ca-f825-4380-b97b-89ea6067a27a", "comment": "Malware payload", "value": "4f9c3012a3c140d3c4fda2b0f4079d73865f7999", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054047, "uuid": "07e9b9d0-ae7f-4d4c-8b5a-a72ebbfdfe4e", "comment": "Malware payload", "value": "8541fad3a807a2e64b9d4e960f32bef2d014e5368975dac382c7e490768fa817dcbcc8fc7dcbc91513bf5b6e570bc436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054047, "uuid": "bae8be82-b4f2-4c9c-8ad6-fd063429a6a2", "value": "T12A557D0AA3A901ECD0ABD278CA52960BD7B1780503709BDF17D95B562F23FE15E7E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054047, "uuid": "aaa147af-67cc-45f2-be75-a492af96474f", "value": "2f875630aadecfb0f9b32d3379416fdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054047, "uuid": "eb976e2a-dfa6-4646-a14c-f92f5fbb7d39", "value": "24576:QH+9mwfaxNwTnfWKZrAZ/LD47RHQ9WFqc804cYq4IVJt:QH+9mBLwbfWirA5LsQ9W402YVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054047, "uuid": "fe4b371c-ff02-41ff-8cb1-6c090960f114", "value": 1407488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054047, "uuid": "7c41a46d-021e-4242-bfc8-597532b31e45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054047, "uuid": "cd50f636-b6d2-495c-a52f-f9a97034d1ef", "value": "574d39ca0baa1576eaca8223b9e99395.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e63774-5904-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639063598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063598, "uuid": "2addb0d5-ce85-4453-871b-01efb1c36ff5", "comment": "Malware payload (Heodo)", "value": "e5cfb1337bb4c9010273423fa5beb1ca", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063598, "uuid": "c16d7fae-8b8e-4b35-bcf7-d7db669d62fb", "comment": "Malware payload (Heodo)", "value": "2812ed1b4143a878e5b39bd51b05072d68465d0fd8fa313fc5c8216170644c47", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063598, "uuid": "f2f19f52-d51f-4e1d-904a-88cf848329d7", "comment": "Malware payload (Heodo)", "value": "b59cdc7f9913ee2c8e572ea2ed12aa5f4c242a1e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063598, "uuid": "1a31a5eb-fa3c-4dce-b289-f63aa0fbcd67", "comment": "Malware payload (Heodo)", "value": "1be1bc305af5bc2e1e365d9a566a118b5e38382fd6a7ed95d8ee3af5e01ed9b9a2c3bc55ad5525fb6af8bff1681576ae", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063598, "uuid": "59acba5e-7a3a-4eca-81f3-48ce8ea0ad11", "value": "T1ED9301DBD295DC7FF8E6D438E4B7A0B823728075C15C1E82628EDA48812D5C657FA2D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063598, "uuid": "bdd1fa18-0d66-4ddd-b0cf-f01c77110247", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbScJ:yIBQ3MYeGt9sLBrGrBScJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639063598, "uuid": "a874ea5f-6ae0-4543-a8b3-6a6fa780f1c4", "value": 90156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639063598, "uuid": "3dc08f90-b114-4c3b-b2f8-74c67a5aa467", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063598, "uuid": "bef7eab3-a5e2-40f9-868f-5075b246e76a", "value": "emotet_e4_2812ed1b4143a878e5b39bd51b05072d68465d0fd8fa313fc5c8216170644c47_2021-12-09__152611871058._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e73c07-58bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639032182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032182, "uuid": "d6d4b073-320d-4b87-b486-392a07844679", "comment": "Malware payload (Formbook)", "value": "c1d2a447a5251f9960916dccca964cc2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032182, "uuid": "e37a69d1-0756-45fc-852e-c889a4925b0f", "comment": "Malware payload (Formbook)", "value": "2821e7b85302a9c3ee997900379f8ecbd191587c34782f4ea77efbcda0bae332", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032182, "uuid": "51d0ceef-813b-4f38-9145-198c1c60908d", "comment": "Malware payload (Formbook)", "value": "5caa0e6205741362016661d2a25618eec1ee65f1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032182, "uuid": "eff00065-4c94-4a4b-8981-02cca51e9d11", "comment": "Malware payload (Formbook)", "value": "fb0de224997de48376a9d2d85c4b0f548e32b7201c1416e3a2f5b7f2ed8cbd1835319093139c31f5540093acb4970334", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032182, "uuid": "abfe5e34-de0d-4898-bafa-78d0a3178537", "value": "T15D3413BCBBAE3C0AE950A2376041908D4CEDCE76200D84B699387997D3716BF4D5B397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032182, "uuid": "859bc6b2-f375-410b-aeec-a7bde78afda4", "value": "6144:qHZxiVgV5uh67EeTZlS7jQCgSUfdWEi8y1BN:CAtI7EuegzfdHi8yR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032182, "uuid": "dfd91c5a-7719-46a1-8ee1-2729ceb51c66", "value": 234360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032182, "uuid": "655a2ca1-3cf3-4449-834b-f41ffa006b89", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032182, "uuid": "59117719-a9c0-45db-b110-ae85f6fa36da", "value": "DHL delivery receipt.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13615b3-58f8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639058649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058649, "uuid": "b20e220a-69ba-402c-8ee7-4173633674c5", "comment": "Malware payload (Formbook)", "value": "afc546fdbfef164bc14e6fa26d6890b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058649, "uuid": "5571e206-f45d-4289-9371-5f5139c037f1", "comment": "Malware payload (Formbook)", "value": "295645c8141d426a6f510e1461dead195177dd16f3e375d220cbc7bc3d1be98b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058649, "uuid": "fe3b4c36-7fe9-44e7-b923-ae630ea37d53", "comment": "Malware payload (Formbook)", "value": "65468d44d3df7fa8cd14ca3f23dcc8d7242ca763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058649, "uuid": "92ba545d-e150-470f-8827-c36586fd2145", "comment": "Malware payload (Formbook)", "value": "c3be446b45facd5af80368d5ddbce647751740d15f32b9b53484ce7929736ce9b212b5c6e21d24f61145687885517f49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058649, "uuid": "37504b7c-242d-4667-8191-a0815d6c12d2", "value": "T13464232772CC997BF6C211B10A75E23AD3BAD18446654A4607D22F7E3E7211F432BB87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058649, "uuid": "c0c245c2-1428-4ecc-9c98-88dfd40aee87", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058649, "uuid": "9209ba62-9d1d-4fcf-9efb-522e6d36b13f", "value": "6144:rGiGN+63bKOcnEy00DpWbw+xyRHVdS3LVlJ5COcxWWO4WU6CcsBx/Rp03hP2:Q3bnP/W2w+w9VcJzZWtWU6CcOx/70x+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058649, "uuid": "d452371b-99ea-4907-b638-e4314630cada", "value": 312290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058649, "uuid": "94c16f22-cfd7-415c-b6d4-b74373c401b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058649, "uuid": "98ec6460-c878-4e4c-ab79-990d11429a19", "value": "afc546fdbfef164bc14e6fa26d6890b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c20c75c-590a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639066184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066184, "uuid": "8cf692d9-77dd-431a-8f24-ad8b468a3db0", "comment": "Malware payload (Heodo)", "value": "82d6aa91bb7b884dacb46f1cc0d075b3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066184, "uuid": "69b6caca-6ed2-4107-a743-c5193a6a1780", "comment": "Malware payload (Heodo)", "value": "29ab4068dac49ad35bee5d3ae9be67726d2ea73c28d437bcbf827bfc5ca372fa", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066184, "uuid": "a3d9d467-6153-43e8-81a4-5f279b0b3ba2", "comment": "Malware payload (Heodo)", "value": "a28246ba8b9dbdf9d783432d68a62dae02d12500", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066184, "uuid": "3f5cf30c-ebd2-4834-831b-4d5e5e6ecd31", "comment": "Malware payload (Heodo)", "value": "5cdecb4855abf984c8bfa187707e46042f5523fd1cb5b7acae2b6472315933033d786aebdd20ae3024f94da9ede5af3b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066184, "uuid": "5be7262d-c70a-4202-ab99-f2ce0572f026", "value": "T14B9301EAD295DD7EF8E6D438E4B7A0B923328031C15C1E82628DDA4C812D5C757FA2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066184, "uuid": "87302076-a6eb-4237-b725-7e54012e7476", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbE:yIBQ3MYeGt9sLBrGrBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639066184, "uuid": "6e3b014e-0f23-45ce-844b-9e4f39947464", "value": 90157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639066184, "uuid": "7fe20fd9-6e36-4646-a5e3-896aa9381a3d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066184, "uuid": "95a17a00-1e13-4d56-a744-5128c88014b1", "value": "emotet_e4_29ab4068dac49ad35bee5d3ae9be67726d2ea73c28d437bcbf827bfc5ca372fa_2021-12-09__160934200606._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02627464-58cc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639039377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039377, "uuid": "f58c52dd-4e2b-44e2-a131-2d3718a4cb47", "comment": "Malware payload (Heodo)", "value": "7a00d9f677d7641053c2fae210349d67", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039377, "uuid": "d0c6de96-ad45-4425-b941-444014db8bd1", "comment": "Malware payload (Heodo)", "value": "29e87923e29c788d8cb137f11271a8127ec002297114741eff5cba332f6433de", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039377, "uuid": "011ae691-18fd-437f-ba31-5ea1491c1e19", "comment": "Malware payload (Heodo)", "value": "eb6c3609cd6d2098ac6245f831fe615fb12dd65f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039377, "uuid": "d3f11aa7-75ef-4cf6-8ad0-7034e3851e0e", "comment": "Malware payload (Heodo)", "value": "c937f37f6934f44cef0ce91a370bb9d57b95562ff0e7d1fbe94057ebd4adad5a727fb050ccd9f0acd0b153db4fc1aeeb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039377, "uuid": "0701de6b-22c3-437b-8cb8-7a4aff8896d3", "value": "T10793F1CAD6A5DE7EF4E69478E4BBA1B97723C037C04C1E82914DCAC8812C5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039377, "uuid": "96b243ee-2c8c-4e6c-9307-02ee830cb832", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3uJ:psXZ3MYeGt9sLBrGrQuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639039377, "uuid": "6ac58546-36f1-4117-8c03-e6eb63f959a7", "value": 90151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639039377, "uuid": "8ce43fab-ef6e-458f-aa64-6a415d289cf5", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039377, "uuid": "ecaf9dd9-ff61-4847-8c48-163336fa25f9", "value": "emotet_e4_29e87923e29c788d8cb137f11271a8127ec002297114741eff5cba332f6433de_2021-12-09__084236031778._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5d5280-5886-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639009494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009494, "uuid": "cf16b363-bd80-4276-873d-9f696a9e52f0", "comment": "Malware payload (Heodo)", "value": "320e7c17ca48b105b1ff9fe832a61e81", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009494, "uuid": "c532c5b7-6c07-4615-854e-c85991449d55", "comment": "Malware payload (Heodo)", "value": "2ad3608ffc390bfb68160d62daf77f3b2ad97810a1f320d8346a0d18f9690070", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009494, "uuid": "ea5a24bc-fe02-4f52-8a9b-dcffdd972789", "comment": "Malware payload (Heodo)", "value": "b27f0952a8aa4131b2b44f5c82c8d4698a017eef", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009494, "uuid": "a7c5bcfd-fe62-4856-bb25-7067b141cd94", "comment": "Malware payload (Heodo)", "value": "e05620c1a97456329636bee4ba845606642c75e15b2bdf4a56f6fd9134fb604a01d739b25533104d9289452e64865030", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639009494, "uuid": "027359d6-1d2f-4bfb-9020-7d6427b00a0a", "value": "T1FF93F1DBD299EE6DE4E7D438D5BBA0EA27728027C1685EC181CDCE8C852C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639009494, "uuid": "1e780a4b-4393-4543-8f58-cf8e36a8a938", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iyS17:Gp4Z3MYeGt9sLBrGrS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639009494, "uuid": "104beb56-8139-46a6-a5e5-5a3e8bfae370", "value": 90142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639009494, "uuid": "64737e19-30b2-4358-86f7-540be0d8054e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639009494, "uuid": "3c3f48cc-ea16-4934-a7b5-1617a9bc31a2", "value": "emotet_e4_2ad3608ffc390bfb68160d62daf77f3b2ad97810a1f320d8346a0d18f9690070_2021-12-09__002442884696._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fcf49c6-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matiex)", "timestamp": 1639054191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054191, "uuid": "7a743190-69ae-4067-b1ac-499a951e8a8e", "comment": "Malware payload (Matiex)", "value": "c7e65e956c6c206b1fb3032ce9b4650e", "object_relation": "md5", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054191, "uuid": "d677125a-3dde-4022-9e1b-258064766b14", "comment": "Malware payload (Matiex)", "value": "2d5cd4b22d447134ed36ef78f711b25b557f23543c481a5d56ef9cc3bf9a22de", "object_relation": "sha256", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054191, "uuid": "e3c8e6f3-e342-49a2-8144-06b87b43d4fb", "comment": "Malware payload (Matiex)", "value": "9420a4c92b99736592a9e4f9a18f6c3c89e3b825", "object_relation": "sha1", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054191, "uuid": "75e71cdc-1fba-41a9-a08a-4fc50470b004", "comment": "Malware payload (Matiex)", "value": "ea50d61b415c456593a82f65f59a2d2b258117b6e8e7be799493931ba44b891e6644b009ca9c3803526878e859be6fb3", "object_relation": "sha3-384", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054191, "uuid": "d9cee187-5c86-4ea7-beee-730a396a7226", "value": "T1E734122139EB430AC1B548F6796E937F7A93DF830C49810C60BA3904FA71DDA27957B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054191, "uuid": "b281c964-61fb-4a63-af7b-388484eecfc9", "value": "6144:oJcIbuYpzHEsWhmMSnXpxz1IQpmOa7yabrqx:ot31VXpxznmOadnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054191, "uuid": "81e9419b-5ff9-430b-bf9c-798c5d9620be", "value": 234728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054191, "uuid": "145c6d8c-4bbe-47ff-9910-72f42bf4c64b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054191, "uuid": "44a24ef8-aef4-4bee-9ca7-15966601a589", "value": "Order 191753 12205.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ecec62-58f9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639059038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059038, "uuid": "04dfeeb5-2008-4c48-8b0a-bc4a016b57c2", "comment": "Malware payload (Formbook)", "value": "e77fd6a6c69efd700eeb8b803915aad1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059038, "uuid": "34e61b3b-b3d9-495f-bd88-ca6dfc575faa", "comment": "Malware payload (Formbook)", "value": "2d69ba81e9f99d3c2b8998d98160bd087cb3f70203761a58255fbee3c7919a06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059038, "uuid": "0af25934-c6c3-4c0f-bdde-944e950f14d7", "comment": "Malware payload (Formbook)", "value": "8e6da531cf0262b26cc8bb702d6ed5859d453e96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059038, "uuid": "3a8a159a-23e1-48d9-9149-cffff8dc5945", "comment": "Malware payload (Formbook)", "value": "1b1d78a09183b5a29d7d46ad20f6c1b5c126157d3277c6885d7d08b3fa05b4dc6060b5a6ae908d3b701243523128105c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059038, "uuid": "6c02bb52-9df9-4088-82a6-48dc8fc66683", "value": "T13345231D2EE4957FC16987B28687C091CABDF0533D23F6F25CD201FE6A749899A02B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059038, "uuid": "4e704db7-3f71-45a2-9946-b5f1e68deb70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059038, "uuid": "25ebe6dd-08cd-4fbe-a746-92a206718d2b", "value": "24576:8IKjy/SYCpX3QxqWRGniFMZfDY0gBrS5f9jcgLh:6jASvGRGiFgfDirk9jH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639059038, "uuid": "eea8aae1-81ed-408d-ae9d-9f55025c00a4", "value": 1268736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639059038, "uuid": "1c880cbb-e302-41e4-807b-573d0b6cb38f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059038, "uuid": "074b3336-c492-4819-bfa1-5c069d17c549", "value": "e77fd6a6c69efd700eeb8b803915aad1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6e7eca-58bc-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639032658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032658, "uuid": "8d49c126-5ac7-46b6-b4e2-eacbcb0b1871", "comment": "Malware payload (RaccoonStealer)", "value": "31c650a1d18d5841b9ff01526a821d6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032658, "uuid": "24d199af-459f-4de0-be32-ce1a8b3f78b2", "comment": "Malware payload (RaccoonStealer)", "value": "2e6fada2618c01aea4432e6e08de41323077f51b9df9945132f4930e4c9e8a83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032658, "uuid": "c6e60910-4111-448c-be9f-5a599993db02", "comment": "Malware payload (RaccoonStealer)", "value": "897a779dfe62ce941d9b0274c19dd1842d2eeb41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032658, "uuid": "ba9454fa-129b-464c-b626-b465839e96ac", "comment": "Malware payload (RaccoonStealer)", "value": "b15556e94e30575c22215e417fc7fb94beacfda449036bcf029680feab67a95c22adf332a3818b80e99d6a25411f31de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032658, "uuid": "a9b0c111-0492-4ad2-8401-cb67b6a6001c", "value": "T1ADD4E000AAE0C035F5F316F85AB593BDB53E7EA1672894CF12D526EA16746E0ED3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032658, "uuid": "aee84c00-fccc-4595-b698-9ee2cdb6e9e9", "value": "d9d9fc0ee02596fca6336fbe79f431ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032658, "uuid": "4d6a8e07-f078-4329-bd87-bf75318960bd", "value": "12288:XjPmQu0nVeOq0idgjPRhA8zEUcQFVAnz5e3JjBVdk3/i0thx:jmZ6s18bA8XcapFVY6Sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032658, "uuid": "06a7bee2-3096-4065-83ef-51e58394c06d", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032658, "uuid": "45058a30-75bc-419a-8061-4d158c19d374", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032658, "uuid": "3e1762aa-8a43-4588-8c18-baef3d36b902", "value": "2e6fada2618c01aea4432e6e08de41323077f51b9df99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b545244-5915-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639070987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070987, "uuid": "5e429d66-83e7-49f0-9842-5a9423735592", "comment": "Malware payload (Heodo)", "value": "abb2c49e4857452b79ce9c1f4f00ba6e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070987, "uuid": "133493f1-62ff-4cfa-9750-60890cea4447", "comment": "Malware payload (Heodo)", "value": "2f3d0aff6f35dff6502af75f678a40b0705e64926d8b0c57b927a8046c0048dd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070987, "uuid": "3317cbab-3ab8-41be-bfe2-40d7ad55856e", "comment": "Malware payload (Heodo)", "value": "bc9477c6a442213f6a5afed05e53e903314da093", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070987, "uuid": "21345233-eb31-440e-abd8-a72e80eb624c", "comment": "Malware payload (Heodo)", "value": "e7983a1a1df9eb40fc8304c5d298167017d731222e1d3a4dfefbe00f7f0b80785a4e4d001c078d9fbecf8efe950a27ee", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639070987, "uuid": "bcb0b37a-d9e1-4c6c-9703-2cd9216865ed", "value": "T1D69301DBD295DD7EF8E6D438E4BBA0B92372C131C15C1E82628EDA48812D5C757FA2C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639070987, "uuid": "6905dc38-7f1f-4feb-856c-9dfe643ff25a", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbS:yIBQ3MYeGt9sLBrGrBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639070987, "uuid": "ad459b7d-eaf1-4a25-add6-219b92349e71", "value": 90156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639070987, "uuid": "cfebd32d-d21e-4da1-9f8a-d20d267d7ee2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639070987, "uuid": "4888b476-c584-44b8-93af-a952cc004b53", "value": "emotet_e4_2f3d0aff6f35dff6502af75f678a40b0705e64926d8b0c57b927a8046c0048dd_2021-12-09__172918412984._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdcf5d26-58bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639032417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032417, "uuid": "bdef2cd3-2947-4913-bcb5-c96305565a2e", "comment": "Malware payload (Loki)", "value": "3bb4517a8bde7bfe2f3d721223a681f0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032417, "uuid": "633b0767-2780-42d7-93bd-a987a3af7b9e", "comment": "Malware payload (Loki)", "value": "303f2c7d4d45248d1650e032189453ad26ec3e4a6dc8684310ffdaf0c5a4498e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032417, "uuid": "cb0ed5e5-c72a-490c-9751-871d257f425a", "comment": "Malware payload (Loki)", "value": "53fc4c17ad72e2d678624f2e17d32b049db6d994", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032417, "uuid": "9ee36324-01e8-4326-8569-774ec324e675", "comment": "Malware payload (Loki)", "value": "c7b5e1573ab911bea456ae802b84aaa32b95046b25e6355cfaefc26cbb0e0d238b0025739b7310fdc824e1953a57b0e8", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032417, "uuid": "185d1478-8cb5-4b5f-99eb-d451308856ff", "value": "T172847C226F2DF851C50CC8F3E613C4CBA9706E6813C569A3656BBA3F817C357EA1E149", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032417, "uuid": "db4b326e-739c-4975-868d-fb1a90af033c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032417, "uuid": "b6eab725-131e-4716-8236-addaea5d19a8", "value": "6144:8befgLW7wnfBISNxZ0KENaC1YnGuzSTg1WG:Df4WeImE8C2Gu+6WG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032417, "uuid": "2ab8363a-1814-430a-bf46-60668ef1300f", "value": 391168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032417, "uuid": "6f1e4a60-22ae-416f-b8a6-4e423fc4c8cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032417, "uuid": "b1757c17-8026-4810-902c-305bc760fcc0", "value": "Original dhl-AWB_9899691012_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a946d455-590b-11ec-96a4-42010a9c0029", "comment": "Malware payload (DBatLoader)", "timestamp": 1639066716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066716, "uuid": "9639937b-294e-4d9d-a67b-35a066fd2e1d", "comment": "Malware payload (DBatLoader)", "value": "b67d3b533d395332ab301841f688b04b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066716, "uuid": "1997d31c-0004-4ded-8c03-6dc43dc435ce", "comment": "Malware payload (DBatLoader)", "value": "309ca816bed485731d7702c80339e6b5d209618888ea92a972a7189ed1102518", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066716, "uuid": "8e147e23-3183-4ff3-99f2-1f73c1f842e8", "comment": "Malware payload (DBatLoader)", "value": "ce0936c360fb9f8ea7bc961982d0e139a9c92088", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066716, "uuid": "79b51678-08b6-44c9-9b6a-1a694ace14ec", "comment": "Malware payload (DBatLoader)", "value": "78ad7d81023201a4be8a83bd32891e39b9bd5037d6ad6cf952ca511baf1d5094f7820f6b264690b0e8d56e6c4e245e34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066716, "uuid": "c2ff6caa-71c7-4f6f-aa2c-6620a122bab7", "value": "T101F48D6631A1D873E27781BDCC57F6E85431FB212B54E8452AD8BC0E5EF4B50F81B28A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066716, "uuid": "46c5c531-8604-4b4c-81b9-d715f0d054db", "value": "cf4ac33deb94090eb70c93b194aa229d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066716, "uuid": "46c4024c-926b-4254-acbd-4f351a2be8e3", "value": "12288:/SYSMXRFwZEQ5TYy2apWLDcdIy7UdFRcqzit:/48wKOD2aI/Vj5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639066716, "uuid": "6e463afc-d035-43c6-b850-0482212b316f", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639066716, "uuid": "a583b793-0536-40c7-9cdf-bef2b539d10d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066716, "uuid": "dec8b51d-af7e-4703-928d-e5db326b6746", "value": "b67d3b533d395332ab301841f688b04b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a12862-5919-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639072531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072531, "uuid": "e85b07d5-56c0-47e3-8b56-a76e2f45bfc4", "comment": "Malware payload (Heodo)", "value": "10c83e70140a0650dc02b176ec4accbe", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072531, "uuid": "3b2b3c1f-f26a-4ccc-aa8f-bb9fbab5950c", "comment": "Malware payload (Heodo)", "value": "31f74ee846fd6f95ef9d7b418cfd87fbfeaaee7caacb1c306d8747f85fae3f25", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072531, "uuid": "7ddf0197-3f84-4fe9-82cc-fbaf30de608d", "comment": "Malware payload (Heodo)", "value": "a418f6953db4d70c266f6a57bdda5aa1155fe2ba", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072531, "uuid": "35d5abe1-c0c7-410c-8ac5-8d1162987440", "comment": "Malware payload (Heodo)", "value": "d106a3034bc4e7305c788780e72bab8852028309168fcaba55ecc0a10878e942a3c584249139bb5d2c7a6e895c5b46d9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072531, "uuid": "94aa16d4-9d6e-4716-b233-c52542ec6241", "value": "T1999301DBD295DD7FF8E6D438E4B7A0B923328171C15C1E82628DDA48812D6C757FA2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072531, "uuid": "5225942d-a955-46b3-bd6f-a0f1d7dacb64", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbj:yIBQ3MYeGt9sLBrGrBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639072531, "uuid": "058210f8-8370-469e-9fc9-e4ecada2d1a1", "value": 90154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639072531, "uuid": "45b7cb0e-3499-45f5-a147-53d06267e8d6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072531, "uuid": "e73a7749-674b-4213-a214-56f372d2589d", "value": "emotet_e4_31f74ee846fd6f95ef9d7b418cfd87fbfeaaee7caacb1c306d8747f85fae3f25_2021-12-09__175457850279._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73f92e1-588d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639012622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012622, "uuid": "09ed087a-66ab-4c5e-a640-449c04f06be4", "comment": "Malware payload (Heodo)", "value": "2c72b1c7794864e4f9e8787f61d6ac31", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012622, "uuid": "9d38142c-14a3-4e00-b38a-73f12e6a810a", "comment": "Malware payload (Heodo)", "value": "33002fae56e3f2b88b42271b4680d606c58da5047cbe2ce3e44ff3e675c4fd26", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012622, "uuid": "fc21e40b-af3a-4c13-a0ce-3523eb5528da", "comment": "Malware payload (Heodo)", "value": "0288877b71b2bc3fb335403485a6d5045f0bcb0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012622, "uuid": "7a9dfb72-2247-40bf-af16-dc9c0bd64176", "comment": "Malware payload (Heodo)", "value": "1a6b8ec4e518130fe74f61b5362fdb05a53086e5e338170c8ee994b6a5f04c93febcfc51c57bdf73a7753b2416538f5f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012622, "uuid": "53b28395-acfb-48e3-86e9-aa9f68a96122", "value": "T16344BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012622, "uuid": "0ec1c7be-8196-4928-8ecc-e6d5d7032de9", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012622, "uuid": "e42189cf-966f-4816-a78a-8e38265386ea", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBI2ypv:6jIG/pjjuLbJLmGshoCUnWTIpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639012622, "uuid": "e0a39882-b781-4adf-a912-5dafdc235e2c", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639012622, "uuid": "394de187-7a31-40c9-a499-13a21c0fd637", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012622, "uuid": "5b99d44f-dc4a-4101-9037-bb7a7c5b12b6", "value": "emotet_exe_e4_33002fae56e3f2b88b42271b4680d606c58da5047cbe2ce3e44ff3e675c4fd26_2021-12-09__011658.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283f22c4-5909-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639065640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065640, "uuid": "dd37bcdd-411d-4f3f-95e3-0b63f193e231", "comment": "Malware payload (Formbook)", "value": "479e4ae1bf8a12c3e5ec2e5ce0917476", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065640, "uuid": "3117cabd-f73a-4f2b-967f-6cb56655e67e", "comment": "Malware payload (Formbook)", "value": "3320a541e54ae9bc45fb5bb50e6160474de81a093085262c0d3892117f4cd219", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065640, "uuid": "a6f5d3b2-2058-4faf-b244-bc5fc709cb46", "comment": "Malware payload (Formbook)", "value": "19075cf9e0b54cff653a67bea14eb6ce1d4d5f8c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065640, "uuid": "29ceb6b7-8b40-450c-85f2-0c97b735dd4b", "comment": "Malware payload (Formbook)", "value": "18cc5424abce77a4b7643467e806da523b3682ee093b2e9a674c4dbd2ded607f8857ed9dafce42624b806764f4e6045b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065640, "uuid": "2fc8b4a5-e7e4-4e41-852a-3416eb10bbec", "value": "T1BE341218F2BCC751F060A73148D0A488EA43DC165A9B86694DE93F7AFAFDC64325871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065640, "uuid": "fdb61228-e1ea-4d81-901c-1ed6c74e3b20", "value": "6144:XWYVTXh6ISjH80DhxfCQUbNLQ/sywohxQOYq9H:XzlbSLXfrURLQEWfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639065640, "uuid": "c2a3ae5d-d4ec-496d-aead-eba8ae8e1cf7", "value": 235032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639065640, "uuid": "9e521eca-5562-4ac3-aa69-1e736056fcdf", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065640, "uuid": "53e7d143-6d23-4b2c-9388-fb6ba8b750eb", "value": "RFQ 2110-0387 CI2110-0388 CL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117c2589-5936-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639084929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084929, "uuid": "74b3a3d6-ee34-4411-8d7c-1b079e8c7112", "comment": "Malware payload", "value": "ee7f1031c3dd9827f74c06bbd4e94ef0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084929, "uuid": "aae9eddf-5c34-41d3-82d5-f09f32333312", "comment": "Malware payload", "value": "33b4d727bb11d6c77d12d781846a0dfd666e6b531549a8a4eca4195c77f6cbc5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084929, "uuid": "55437414-f603-4ef5-b972-843a9a183770", "comment": "Malware payload", "value": "6d4995cf673663a96d4a44f92b9844a6794a25fd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084929, "uuid": "4c384b97-5162-45c2-8fc3-15a5e8d7d751", "comment": "Malware payload", "value": "03711ec8bffe89b8019cf7f5e76cdbe9f7fd45e6f0217bd671ff6d40594e83f575efe9577189b36ad0f0a517deb6198d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084929, "uuid": "2394d284-981c-4fb9-925c-9be62529ce63", "value": "T1F2457B2132C79B32D493127155AEA3611A3EEC704B718287729C7B9E2FB27C0673579B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084929, "uuid": "47559221-f63f-437d-87a1-57811517f050", "value": "24576:Blgq+3Nn7BjlpOu3LBCvAq23Nn7BjlpOu3dA9Zx:BlgJ3Nn7BxwubBCvAF3Nn7BxwutAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639084929, "uuid": "fcb276f4-56e1-4c2a-999c-26523c25c5f0", "value": 1169380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639084929, "uuid": "887ac113-0017-4dd6-9d0e-190b96c23c19", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084929, "uuid": "211597fe-8110-4e5b-9eaf-7edf3d24eba6", "value": "Deliveryinfo.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde2c101-58c2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639035451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035451, "uuid": "ec1856d8-1e52-4d19-9b5e-33c4e2e12a43", "comment": "Malware payload (Loki)", "value": "a1d24296cd79afb5613481df2d177227", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035451, "uuid": "924b3c07-b870-4741-9535-e85cb4985a74", "comment": "Malware payload (Loki)", "value": "348591c788c82b45acd472c5e00a3a919ebfb02b9b71402ed9c33fe08d577f44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035451, "uuid": "f53c5513-15a3-4604-a6f8-7f36ac1ab24a", "comment": "Malware payload (Loki)", "value": "091e1c885e939091e39788a94d7eaabd71ca1188", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035451, "uuid": "5b2e0859-3f76-4235-98fa-c73e55ea7dc6", "comment": "Malware payload (Loki)", "value": "367237e2c87537f3db3d921510a5265e8d2a1e638f31ddf611f302fe204d26e879368266adfeb1b10e9b8e5e640d5c8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035451, "uuid": "1988f7a6-765e-49b4-b9cc-c9f7e705d6ae", "value": "T12A54235ABFD4CC77D8A905B015F1BB3FD737C4A099080EDF0BAA1E22EA531779619012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035451, "uuid": "f17f5f10-0565-42af-b9c2-2ddf61743d55", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035451, "uuid": "de2c0a47-cc50-4659-9eba-affd1b95966c", "value": "6144:rGizr7mWvyazgfMTtoFiybgAQBcw0ai/+wBHKGtZm:riWKaaMTkbgfdFi2wBq+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639035451, "uuid": "9f630bf6-70cf-475d-aee5-f69a2d60b934", "value": 305297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639035451, "uuid": "0eaec39a-4353-4c2d-b98b-88568e4ecf70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035451, "uuid": "6d9fde77-e379-4292-b0cb-8da6f6820a28", "value": "a1d24296cd79afb5613481df2d177227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed07a121-58f3-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639056521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056521, "uuid": "9a4a0d70-4cfb-467b-850f-1e3a86e0ed0b", "comment": "Malware payload (AgentTesla)", "value": "012ef3b1dbfbfb271682c77788ef2dc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056521, "uuid": "9000f573-1725-4795-a42e-abe67fd5008d", "comment": "Malware payload (AgentTesla)", "value": "34c454f2bb30c1a9726f575bb2ccdbc1b248cb25dde1bcdae22bd53994d4e05c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056521, "uuid": "e7c1de40-c6f4-44a9-a4b8-360e2a30d7bd", "comment": "Malware payload (AgentTesla)", "value": "dd844ce20cdab86c83e6240228d533febde80875", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056521, "uuid": "f31e4e46-fe48-4f24-895d-dc0ecae3c9b5", "comment": "Malware payload (AgentTesla)", "value": "985e7a60d18699961da926d772f02d3d43592a557373c17267b00a563a50be92481b7ec8aca24ef8c6b7b9ca5122da41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056521, "uuid": "dfbb3b00-0a46-43bc-ae05-16dd2502a564", "value": "T1A845132515B1A46BD63997F2939B80308BF9F4172D72F2B56CD202FDAB34A459F02B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056521, "uuid": "56156f4b-a95c-4c76-8994-96d3daa8525e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056521, "uuid": "8ae575d6-a295-43b6-ad42-e29d42fb86f0", "value": "24576:ZUIKjy/SYCpj9vWB/i899C9LyY/H3fByAssi4ohH2bkePtS9ACNAxWH2KyXbg:MjASL8B/t9oL7ZyZLH+tSaxMLyXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639056521, "uuid": "37e20841-4fea-4f07-af41-bfdb369da171", "value": 1242624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639056521, "uuid": "3957cfab-cf13-4330-8e20-79fc7aa6291f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056521, "uuid": "73db6c86-97fd-43fd-8332-5ba2672b5adc", "value": "Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e08d81-5929-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639079548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079548, "uuid": "e622d645-c9de-41c9-85b7-624cd14b03af", "comment": "Malware payload (Formbook)", "value": "89ee747ad8489860408e052417da24f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079548, "uuid": "bfb0a988-e480-4332-aa63-32dfa6fe7c8c", "comment": "Malware payload (Formbook)", "value": "34fcac5d4cf2062249f369fda6ae1932ac41655890da91f02bc304afe3706e86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079548, "uuid": "ccc6e78f-1a7d-4a55-af18-9560734a227e", "comment": "Malware payload (Formbook)", "value": "e512b1fa927ceb74fc31f8066aafcc1ef4457d96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079548, "uuid": "50971426-f1b8-4912-813b-9c19749c4dbc", "comment": "Malware payload (Formbook)", "value": "ba6f2cc75d9204102f426dde6b1765a925701da38471102146019e4054aed5aefe298580f180484ed3e525637f4a4bf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079548, "uuid": "49b7f9fa-fda4-4803-9a20-d74db8fcf274", "value": "T1FE15AEA6D1E04D32C0AB05B89D4BABE865277D203D089C0A5FFC3D8D9F367A174195AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079548, "uuid": "abd331ce-2191-4119-a8a5-d3bc1c17936b", "value": "939d8f743f99c748d946de3c81bddd31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079548, "uuid": "e91399b2-7534-4727-a7c5-51c57a87a816", "value": "24576:muRQsAJcBdZF0bE25chN+QIk3c13TOqamxypnUXfGe:mL9JO08b+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639079548, "uuid": "653e2353-49bc-4490-b371-a1a8db1e1742", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639079548, "uuid": "c9154525-7a4b-435a-8735-782eff65fb77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079548, "uuid": "aefbdd22-6ffd-4976-b480-64a504dca6a3", "value": "PI209627515141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cd6f84-58bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639032457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032457, "uuid": "e13f5e69-12da-46bc-9f9e-9d40b14c06ba", "comment": "Malware payload (AgentTesla)", "value": "222a8979ee96566737b6d446f6272980", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032457, "uuid": "012f4805-cb15-41b7-84af-d4111b5fc311", "comment": "Malware payload (AgentTesla)", "value": "352c2c2385426785e241f0c212809565478f2cc8d92ab395e31c13d490b0552c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032457, "uuid": "7f0b3b1a-146d-4cd2-83b5-8fe1c409defc", "comment": "Malware payload (AgentTesla)", "value": "d5b38cca15fab02695ef16be2bcaf1afc6b31aa8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032457, "uuid": "5ee5d192-53e0-4ca7-b57a-8fefb7814a19", "comment": "Malware payload (AgentTesla)", "value": "b691d66f63a2b667f7b5a479231f49f2b1111b17acd5f0f43b7a18387b4f181afc911bc7fbeb7db6c4f587b15b3e844c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032457, "uuid": "e3508c14-3963-4993-98b3-620dffd03221", "value": "T19E350120997B915CE5A771F50F12BDA61E2BDEB8C012CA1623BEB129443D607CF623DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032457, "uuid": "e00a8edf-e5a8-4357-89fe-0f3dbe31139c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032457, "uuid": "5e7e76be-af05-404f-ac73-7dbf3aba5c05", "value": "24576:MgznGNkVVLeUxyRWQ7duBHQ6AlIArmtKKWOzW49RdsW+Wo:MgrGMLSRRMtfAlIqVKWOzW4PCWDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032457, "uuid": "bac17412-084c-4d47-b1e4-88a993e61f6a", "value": 1148928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032457, "uuid": "d085ba04-fb80-4502-a0f0-8ac64717d4dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032457, "uuid": "acb6d148-3e1f-4b5a-a980-75b3b6f2f43b", "value": "DHL STATEMENT OF ACCOUNT - 1003668600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4ddda6-5900-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matiex)", "timestamp": 1639061808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061808, "uuid": "e68c49e9-b607-4e72-b9da-fd64a699e565", "comment": "Malware payload (Matiex)", "value": "8e5e31f5dd73631eddc2cb57e0f48a9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061808, "uuid": "68078d06-b833-467f-8a9c-68075a15f57e", "comment": "Malware payload (Matiex)", "value": "356c38de132ad392f3155f48d11f97efbd7892a04499aea67dab5a76e85cb68d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061808, "uuid": "fd21905b-aa2c-4ed3-81ca-337724ab1645", "comment": "Malware payload (Matiex)", "value": "13bd3cf85edef10be8b60c96334eda4f30eda0ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061808, "uuid": "8b9f3437-38f0-4813-b659-e6711605e345", "comment": "Malware payload (Matiex)", "value": "a13051e8d98d9523f97b3bf9d863787cb8800d6c56cf03ea7d836dfc6d36da6a9475c91a9ef39d5957a1e79ab2e1c634", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061808, "uuid": "03e75aa5-2f0d-4c80-b115-95b711c5bddd", "value": "T17F75230D29B5A1BED1258BF1C667C0608F7EE0072D22E6754D9241FDBB78ACAD642B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061808, "uuid": "927d1040-8d51-4a8d-90f6-cd86d169896d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061808, "uuid": "7f5d207d-bc50-4ccd-a483-c687e4d4ecf6", "value": "24576:gIKjy/SYCpL0sVTQW2ouEhruMvoblyRocOH5UIqP2uEklGT4YOqn9znmjoGr:ejASHdQWlpSHsivc+uEklYOu9bmjoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061808, "uuid": "cd70b1ef-7b53-48e8-8544-9fa8b375095a", "value": 1592320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061808, "uuid": "34a8eddf-1a75-4204-8add-c8834e7391c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061808, "uuid": "373107fd-c8f7-426e-be07-3f810fd30b6f", "value": "8e5e31f5dd73631eddc2cb57e0f48a9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4671df19-58e3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639049370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049370, "uuid": "0f4c4e5b-73c3-4eec-96cb-46ad68cd77cf", "comment": "Malware payload (Formbook)", "value": "dadc5815d7e86bdefe66ee99decf7f1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049370, "uuid": "fcf16b53-76e5-4501-9b4b-ecb9bde12abf", "comment": "Malware payload (Formbook)", "value": "359dcc936ef46d8becf12ae075b1a31ffb812bfcee64b45d5bc01b2e8d7c4cec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049370, "uuid": "e52cdbb3-9442-4ee1-b89b-358284628733", "comment": "Malware payload (Formbook)", "value": "98656e68a7f0f420e6cc76fbfdb4764f63f19298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049370, "uuid": "620b0d84-8ff2-48c4-8080-f1537a649e95", "comment": "Malware payload (Formbook)", "value": "8e132325e470f2c72aa506813c5be996bc36febd127acf74481138d680bbf1eb67a7ada0e55361b616d11de58c077cb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639049370, "uuid": "82289753-40f0-40a7-9372-dbdee1f2cfb4", "value": "T14655121A3EBCD921E0A459B5E663D0856D74F0032E7EFFB65DE00A6C66FC2D3580A193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639049370, "uuid": "ccdbdd51-93de-4914-a80e-69a23fd97414", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639049370, "uuid": "bc26d51a-de31-485e-bb7c-2daef914b90e", "value": "24576:DIKjy/SYCp0L1tvKHn0FVHzAX1TDp8SZ3vIZ5HJbuhCD7:DjAS8LXvhHzAX9d/RQbH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639049370, "uuid": "33c48f31-cc33-4f24-abb3-2b38542b9afc", "value": 1381376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639049370, "uuid": "7c561353-6aa3-4453-a38d-adc8850458c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639049370, "uuid": "05da9d7e-f2ec-47d9-8022-572ee0bbcdec", "value": "SecuriteInfo.com.MSIL.Packed.19.415.32450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37173017-58dc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639046338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046338, "uuid": "99392ba1-3225-4efb-8461-81035070d0d2", "comment": "Malware payload (Heodo)", "value": "4f1932f265590119fe0b5927f3d3a179", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046338, "uuid": "1df7fb54-7072-4c63-9f49-badf4bf2044a", "comment": "Malware payload (Heodo)", "value": "3629112b0c8de27ccf294fa72f4e90f0b2d328433d49cde2d8ccfba417879891", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046338, "uuid": "069b009f-2c09-4b0f-b836-94ae0314c743", "comment": "Malware payload (Heodo)", "value": "727fe12ae69c9626b04518d92a4ac9ca8ffcade2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046338, "uuid": "fdf3fe87-3357-4adf-abbd-ab32855a5557", "comment": "Malware payload (Heodo)", "value": "3cf368e77b31dabb65a0f37a538252b65400fa277db170cd0e73250ae434880fb75ddfca1c6d6295ad4156f1f65fbfcf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046338, "uuid": "0019b633-2d8a-45b1-946b-6789920f6c2f", "value": "T10544BF10A181D036E5FF087A89FAD9BE466C76600B80DDDFA398187E4F6B6C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046338, "uuid": "4c62c275-cc4b-4b8d-af1b-4d96cf7b3f3e", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046338, "uuid": "9005b5b1-3d86-49dc-977a-c69c465817cb", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBFmgL/S:Wvef8+h61mRcHL+rF6l5EAQWTlL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639046338, "uuid": "a0384558-ad2b-4c0a-bc9a-059fdd59e415", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639046338, "uuid": "06381bc2-e04b-490d-b41e-fc0b692ac7d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046338, "uuid": "e64a2892-99de-45bf-9348-433086ecab07", "value": "pvaNDe0me6XaA5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec2c3bb-588d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639012608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012608, "uuid": "6f9666bd-5834-4ef0-91f0-2e41cbb22249", "comment": "Malware payload (Heodo)", "value": "6fb7123175315c26dad34852b1a4e849", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012608, "uuid": "cc92d08d-11c0-424e-bf1f-d9826d875be7", "comment": "Malware payload (Heodo)", "value": "36ff7b1059df89ef484b3d7fdfc6d3081c26e47065b3550dd2f2bf2008f49d23", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012608, "uuid": "425feb20-6465-458b-bd46-b3d1ee4a0f7c", "comment": "Malware payload (Heodo)", "value": "a323a793441be70f6bfbec8295addb278ad57184", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012608, "uuid": "19d08161-fb7b-406b-bda5-fd9e1bf7d0f9", "comment": "Malware payload (Heodo)", "value": "f3ace61953fdb45de76ee0ed6eb7529a260fe60c84ecaba33d68443032679d7da1256fd22d9b1ec0156ad4ec624f0207", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012608, "uuid": "fd8e6ee2-2cb2-4a28-8531-da98834a3142", "value": "T10A93F2DBD398EE6EE4E7D438D5BBA1E927728027C1685E8181CDCE8C852C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012608, "uuid": "7cdbb794-be7e-4018-82d7-934c9b8f425f", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySVN:Gp4Z3MYeGt9sLBrGrSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639012608, "uuid": "1f7af52f-855d-4f27-a9cf-4cc75ceb0bba", "value": 90143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639012608, "uuid": "c30f02cd-45d1-469d-b91a-1acf266e3f8f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012608, "uuid": "b2f3863e-d604-4d7d-8311-9c9df3484359", "value": "emotet_e4_36ff7b1059df89ef484b3d7fdfc6d3081c26e47065b3550dd2f2bf2008f49d23_2021-12-09__011636139963._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdee2d43-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (Adwind)", "timestamp": 1639054402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054402, "uuid": "81f36584-6268-4ecf-a40b-77e8a8b94194", "comment": "Malware payload (Adwind)", "value": "7e066335d7a03fc8f1006507b55b8c24", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054402, "uuid": "316c50da-19aa-4679-9df0-873446074ce6", "comment": "Malware payload (Adwind)", "value": "37a9f5e81a7e58984899a38197d0f4d66297c5ac2a07b540a9a018a4a3ddfdef", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054402, "uuid": "519b3cbb-dccd-4098-a406-00cd728b0546", "comment": "Malware payload (Adwind)", "value": "da65b0da89b216243d81e7a9600e9a935d6cc19f", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054402, "uuid": "59c85800-afdb-467e-9f17-ecceaaa47fae", "comment": "Malware payload (Adwind)", "value": "799439c97a001ae7cb8cedc20c758fde1f36b09e8cfa9cb76bfec038645a630836448391a917b412f0e610faa55de796", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054402, "uuid": "96de12ed-cd25-479c-b34f-ed5ef35084ac", "value": "T1F4D433588DDD45D5D482417C3328922181D14BE2B9FB6C1AEB86EC72FF8B5C076B8F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054402, "uuid": "f77ac536-f163-4e4e-bd44-478cc76e4184", "value": "12288:3Tewb2QBiIkfG+BSI5kSPuj9ahaGshkej8zoDYXH1+ZV7qLxqOuP9Xy:j1bL96BS8L2Rws2tzNH1+uFqOAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054402, "uuid": "c5e6830c-c4ca-480a-bcc1-f17e336e6c09", "value": 655707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054402, "uuid": "cb34d39a-813f-4354-8fd9-88658dbcdbe2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054402, "uuid": "7b4368cf-5d4d-4985-90c1-3a36b2ac7abd", "value": "7563992332.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364c82b8-5929-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639079408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079408, "uuid": "93ed9aed-1a91-4311-9071-c2c157454cd0", "comment": "Malware payload (Mirai)", "value": "a8e79a423fb00932e2b9d7510e38d74f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079408, "uuid": "e2f92b6c-5b56-4890-92a6-8375fd4b3ae6", "comment": "Malware payload (Mirai)", "value": "37cb731ffc8508909846dcb749564f449a0ab20c7dbd14721de8bf195268304c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079408, "uuid": "1f21191f-fbfb-4ad9-bad2-794a4b842630", "comment": "Malware payload (Mirai)", "value": "66dd3b61ef524aad16028c6fe42b1ab86a05ef92", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079408, "uuid": "8727901f-0709-4ec9-b777-a06e8ea065f6", "comment": "Malware payload (Mirai)", "value": "1dcfbc346d6d6c897b329e11032373ca6ac79fe6e865be88987120ab20dd3270d78d7a0bbd4a5061abf15e57606903a2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079408, "uuid": "ec175f49-46f7-4a5e-892c-744587b1bc42", "value": "T17DD2E0B818EB6971E1B15771DAE1CEC23303063ED46BFE3625110BD1DB8230E6ABE595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079408, "uuid": "e5c8e3ae-2746-481c-a115-604bc96b5ed4", "value": "768:VXQD3WV1wjry5HfJVih/y79gBKOzzzs3Uozc:GD381bHfWJyZgB9Pezc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639079408, "uuid": "accb9abc-cd8f-419c-9c2d-eaffd18e5cf8", "value": 29852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639079408, "uuid": "e338b946-a06a-46df-b5ba-8c1e20f25d14", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079408, "uuid": "0b688ff0-f47d-4161-9b0e-d9e2be96d653", "value": "trynagetmybinsufucker98575.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214f9d2e-589a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639017954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017954, "uuid": "f5da6a5f-a284-42ac-8448-f1023d6fcc15", "comment": "Malware payload", "value": "68b7b0fe85a66edd5f493583e17527be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017954, "uuid": "7eb60a81-f242-4623-96eb-cb202e3ece05", "comment": "Malware payload", "value": "385ecd4ff2b431ec21f42016ca43f5c3f66790ae6caba21caf7fb53268e3c9f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017954, "uuid": "d5e5e376-1553-4736-9192-9acfecc946b6", "comment": "Malware payload", "value": "defafd9976318692bb864363d767614fa396db93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017954, "uuid": "fd86e9a8-93b8-4fda-94dd-e92ddf8aa25a", "comment": "Malware payload", "value": "b3158dc2c0864fa1bba4e7c6cb87f2a157e1e14b3dfba6c36976cb6a9a51f2eaa21830c25f1331caf126c840ee6f576c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017954, "uuid": "d1a1a0e2-26fd-40f1-bfc9-efc38fc29a7a", "value": "T15CC3271276418471F70D0B304946FAE04AAA9D3D5AE4E48FFA7C7E7A29312C31A7725F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017954, "uuid": "167f2511-2563-4733-9b58-f3f91e45365a", "value": "d8130762549d8ab8e3c12e25d2f5f0e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017954, "uuid": "a17216c7-980a-445c-af73-4abe946158ab", "value": "768:4Ke6r0NVnxxS6vobyOlWUpN3RdO6jVTBR2r/A7izRGUR/lHJ/d2uoe5N1Eyw0tr2:b3aV2xblpbOUf2U7Y1P/dfLttrppS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639017954, "uuid": "da53eb4f-a2e5-4762-be87-d0749d02b592", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639017954, "uuid": "5a873770-6c0b-41cc-9d3b-a6b2d885f0eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017954, "uuid": "28efcc03-1188-4282-a67a-75dcf7ef2f7f", "value": "68b7b0fe85a66edd5f493583e17527be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d96eb7-5936-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639084985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084985, "uuid": "8f8d2b9c-a245-4810-bd7f-57c81abf818f", "comment": "Malware payload", "value": "6a960460da0366ae484e6f573fe92a93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084985, "uuid": "974fd1d9-af43-4cd4-9475-e233ef11668e", "comment": "Malware payload", "value": "39a20140cd2b42ea95a17ee14b5e60340c12b8ef6fc87faf0714fe7735f616bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084985, "uuid": "4236befb-ba41-473b-8b25-70b40d5ea361", "comment": "Malware payload", "value": "2c718082f38e5afb9beb9709b96aa685b045ca4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084985, "uuid": "7a490d62-b39f-4195-afd0-a4b627857dab", "comment": "Malware payload", "value": "e80bc5a01e62f0564a0224d590c3b7147eccf133001e21f0917fbd01493beecd67efda28024cc0ef9c9aa66139ba3a44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084985, "uuid": "bd6a2e3d-5d20-4189-b011-e91a015bb9d5", "value": "T13645120D25B4516BC67957F6D36B90608E79F0063DB3E3BA5C9242FF67386CE8602B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084985, "uuid": "a3c15986-91ed-4b7f-b60e-4516a03d07f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084985, "uuid": "7317540e-5f6d-40e1-b4a2-5f90e46f22a3", "value": "24576:JIKjy/SYCpI27X/fPCllqJG+/isI0Bdr/DL4l1+FVaTNBvKzHDUZWJ8:BjASQMXPyHSisI0BB/DL4zCaRsvUkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639084985, "uuid": "74f12ff4-19ae-480d-88b2-d3096144cc14", "value": 1244672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639084985, "uuid": "739a3509-0bf9-4894-a4aa-5e3e0bfcfa4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084985, "uuid": "52e3f113-918d-4fc5-9f3c-560296ae64da", "value": "MONEY TRANSFER_PAYMENT SWIFT COPY DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1d0031-588a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639011099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011099, "uuid": "c19b56c5-ef17-46a5-91fc-027d44834a8b", "comment": "Malware payload (Heodo)", "value": "68c600ad9320212de0313769bd641557", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011099, "uuid": "b27fc2b6-0206-4839-bcdb-983c83d269fa", "comment": "Malware payload (Heodo)", "value": "39bbb630edfddde9b9b2e7cca50cd2cfe3ea14f26c28136a340084d506f65136", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011099, "uuid": "be4b3ff7-3d56-464d-9490-29ba1ac845da", "comment": "Malware payload (Heodo)", "value": "d8474b8880667d5715b2893f1dcc7e72f04a28ec", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011099, "uuid": "ec0bc81d-86d8-4ed9-9a12-a89e0e620c57", "comment": "Malware payload (Heodo)", "value": "af372fe74f5e009d45c60d0c6be06d5caa403d877c3e5f76d5b871d1d6ba719b209f0273956c4d28833f14a77f306aa8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011099, "uuid": "82b1b197-6d18-4157-a44d-ea6704bbf0ee", "value": "T11993F1DBD294EE6EE4E7D438D5BBA1EA2762C027C1685EC181CDCE8C812C5C657F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011099, "uuid": "65d8e46f-17f9-482b-a510-c1989deb7c89", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySM:Gp4Z3MYeGt9sLBrGrSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639011099, "uuid": "16832245-4ee9-460a-b1dc-fec6df309250", "value": 90145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639011099, "uuid": "9e6ebae5-75d8-40a1-8c2f-aaaa75be4306", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011099, "uuid": "a9df6bfc-fb48-4c50-a754-c82a8bbcda93", "value": "emotet_e4_39bbb630edfddde9b9b2e7cca50cd2cfe3ea14f26c28136a340084d506f65136_2021-12-09__005126882984._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73a9d6c-588d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639012622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012622, "uuid": "d0c9bb08-b82b-4abb-b881-fb064861b209", "comment": "Malware payload (Heodo)", "value": "0abb64ca4b78fc9a4f916e2fc693b0b7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012622, "uuid": "055e6baa-1932-45f0-b36b-89f160c0d626", "comment": "Malware payload (Heodo)", "value": "39f6558266d3b2f4938c76cab9f09c6a0b394e101d12c7a3554df81fca695ca7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012622, "uuid": "56e360a2-4db6-4c93-bdb2-91175d45385c", "comment": "Malware payload (Heodo)", "value": "a2ceab6c20f6e4db6a45e995532a6c19ce1934e3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012622, "uuid": "dd55b357-9058-4983-9bd2-1eea963eeb17", "comment": "Malware payload (Heodo)", "value": "bac84857bf5c73c785db62e0577e24755c30e926baeac168229f54dfc2066c8e89eda2ddd02c131268f372772d68721c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012622, "uuid": "19c9a957-51ed-4408-ba2f-21440026d4eb", "value": "T14F44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012622, "uuid": "0be3ef38-fcee-41e2-85be-7ec1578a22a8", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012622, "uuid": "b1e1b442-3d16-4b25-9955-b59f7a973644", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBV2ypv:6jIG/pjjuLbJLmGshoCUnWTHpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639012622, "uuid": "20b3d09b-2753-4070-8bb2-91969cd8b073", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639012622, "uuid": "5352ddb1-18f0-4002-ad05-5579022bc04d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012622, "uuid": "c9919c31-c248-41f9-8190-649d6bcb4da6", "value": "emotet_exe_e4_39f6558266d3b2f4938c76cab9f09c6a0b394e101d12c7a3554df81fca695ca7_2021-12-09__011657.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10e5287-5949-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639093331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639093331, "uuid": "3f70c1d4-bdf2-4262-bafe-8e7331f949af", "comment": "Malware payload (Quakbot)", "value": "272f8079dbc02016e93a556f1b1e2fc8", "object_relation": "md5", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639093331, "uuid": "932d4952-6beb-456f-89fd-deab5646a36c", "comment": "Malware payload (Quakbot)", "value": "3a3fe1a5a53777edc0bcb8503ab67ca5faeda2fb3de126be00256b5f84e6e306", "object_relation": "sha256", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639093331, "uuid": "ca867cf0-03fa-48c2-a8c4-28c1407fba47", "comment": "Malware payload (Quakbot)", "value": "bc55eec1d31329ca842d9ee6a5de2e9555b8c073", "object_relation": "sha1", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639093331, "uuid": "68a77ad7-ab34-418a-ba66-3a78b2811408", "comment": "Malware payload (Quakbot)", "value": "d4429fb4a2c9614b295d00a387798e795f399a3ad34dfd4e409e0326b13cd6457ffe836716bac450b8e98b5e456bdb58", "object_relation": "sha3-384", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639093331, "uuid": "c3713546-b190-4ad3-8649-22f53c55f5f4", "value": "T1CD24F10DA83CE89EC72B1431C708AFEB851B5061EDC2B82E65C9394D5955EEB7BCD18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639093331, "uuid": "263be351-c2f1-4d70-a6e7-10baa9cc7c99", "value": "3072:1MIcfEIz6t8weEGc33rk590Du99wpFlUz7o8NXKRlzpG7/UQXIqdtKcmIDYPIZEo:1vcfEw6R9537k5WSOeME6rGj/m/58DDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639093331, "uuid": "d0bef768-6307-4e2f-ae77-b694cc122451", "value": 214792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639093331, "uuid": "4721272e-49e5-466c-ad6a-d4ad32561d72", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639093331, "uuid": "c52ca498-d732-4c2d-9121-08daf3331bff", "value": "signal-1526633982.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef628f0-58bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1639032178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032178, "uuid": "ac67cab3-4b57-45d6-9cf8-e9c54c26b9b8", "comment": "Malware payload (AZORult)", "value": "b4d9089119d41f0acacee4786484eda2", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032178, "uuid": "ecbeb6c8-3059-44ec-84d3-249d3b933dd4", "comment": "Malware payload (AZORult)", "value": "3a65c9e7b7b246273e781db83f3744cbf7584a28ae8647c77626f8fa6a8eddda", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032178, "uuid": "d193d176-dd5a-46a1-92eb-a8cadc40d7ce", "comment": "Malware payload (AZORult)", "value": "946eb89aad12b124f0b24dd1413dff04a844d755", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032178, "uuid": "ee4a87a0-ff02-4c72-905b-5847bcd3bf11", "comment": "Malware payload (AZORult)", "value": "b23604de6058686da5e71ab5283b1999c41be25e9e571ac914f191bd87490378aa4d8e38d72106d820bcc7a09bc71273", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032178, "uuid": "87c3f5d5-8557-4ed7-b8a5-75229fc2a3ff", "value": "T10F3412F1326DA516E1D5AA3BE8213FA03966EFC0F64B707531123B0DA97F82474A460F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032178, "uuid": "6561a047-3d86-4dfe-8be3-ddd3acc11125", "value": "6144:uLjQa+WE7RV179fy3jyaExbrqpMRCMTxvV8YJ:uQmE7R/9fyZExR1TrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032178, "uuid": "d1ffb0cb-6052-4519-8d82-e4f0fd11a14b", "value": 234648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032178, "uuid": "428a357f-891f-4416-b365-2a57678d9181", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032178, "uuid": "fd917365-57a2-44e3-be74-0611b7adf87e", "value": "AWB DEC2021 Waybill No. 9877482301.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae74c20-58d9-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1639045002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045002, "uuid": "c5423f7f-fb48-4f1f-b850-ff928de3f2e9", "comment": "Malware payload (NanoCore)", "value": "af016d53a604eb7d49917e949ae2d9fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045002, "uuid": "25c71aa2-6963-4b9e-8056-3e76aa5706d0", "comment": "Malware payload (NanoCore)", "value": "3b40820ac6affc279a2819ce418a1c7cdc895d8f79ad9835be63e463a2be01a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045002, "uuid": "dfca5115-97f4-496e-bccb-fba9b0529ec0", "comment": "Malware payload (NanoCore)", "value": "f35d13f0be9d6e39933a0c1e6b6256e566bbf55a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045002, "uuid": "5d7afe4d-77ad-4227-995f-8d266e2d2158", "comment": "Malware payload (NanoCore)", "value": "802c43ea93ad34b7910a541452595b053a79d946d8f77b872e80f975944856ac2522478e82939266a53405451bd213b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045002, "uuid": "31462093-6dba-4509-9121-559425d5a0dc", "value": "T103656A5C317025AFE83A853145541F379EF12C3D866B53CE731734AB8ABE5868F242EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045002, "uuid": "f23de055-d42a-4d6d-b6af-2a0812c61244", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045002, "uuid": "4b9dde13-a301-41aa-970e-5887232b3a1e", "value": "24576:tuhkm8c1LL3yruec8LMfB/g46oI2N1Kgo8zmTilLRGqtOX4v:BaLku38sg4fro86il9H0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639045002, "uuid": "cc03501b-f86c-474e-b3e8-8bf896429b24", "value": 1412608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639045002, "uuid": "b6fb472f-c5f5-4e5f-b460-9101b68e6afb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045002, "uuid": "8832975c-af6d-4967-9c04-f598a7b28940", "value": "af016d53a604eb7d49917e949ae2d9fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcb2097-5900-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639061784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061784, "uuid": "5c558592-a112-421a-b877-9edef9eef006", "comment": "Malware payload (AgentTesla)", "value": "99a42470f152615b8a98edc0d7c1da3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061784, "uuid": "60fcfd23-c347-4b7a-b1fb-05daffebf25a", "comment": "Malware payload (AgentTesla)", "value": "3b8103d9e6d6cb728edd9b55c9b9f2ca51099bc107c197b6c4dca1956743a1b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061784, "uuid": "949465b0-aeae-41fb-b1ce-c6f0e0d94297", "comment": "Malware payload (AgentTesla)", "value": "ba7f56f9fdcc21c17f9282ef5b22e96f1e6f0501", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061784, "uuid": "3c49a5ad-b81a-4291-8bcb-118d5a1f9712", "comment": "Malware payload (AgentTesla)", "value": "12f8e3c5284cdf5794a5ad362c35557c1587f091374c41f3743ca87b0380d96894c4fd08296ff3a1945077496bc44abb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061784, "uuid": "1aefc9ba-59de-4b5a-b29f-374601becfb0", "value": "T1E4C423143368C7E5C37E5A3185A46A055BBC7B813510D31C3AE8A0AD4ED7BCAB71C6EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061784, "uuid": "b61d67b3-d4f5-4e5b-9437-e4d66c3c7a26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061784, "uuid": "503f5db7-3f26-45c2-8e74-11e4711a4252", "value": "12288:lpYcrq3cPNCYmVbS5EkzKdHC+nJIBf2fiPH:lpYcrbAYmN8EkyHZnJ0efkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061784, "uuid": "680c1036-124c-44ba-8f5a-e5e0a750c826", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061784, "uuid": "c14054a0-0053-4ddf-a05a-2c42d9ee1357", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061784, "uuid": "76e43f89-26d7-4fe6-a8c4-5b56267080b7", "value": "99a42470f152615b8a98edc0d7c1da3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4422d5ae-58e7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639051084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639051084, "uuid": "bea315b5-2d0d-417e-bf52-f52852b3951e", "comment": "Malware payload (Heodo)", "value": "6aef8b5a057989b22c30708e89fb5c34", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639051084, "uuid": "e10590f4-1ac5-468f-9e50-2a5627a05f6b", "comment": "Malware payload (Heodo)", "value": "3b8b1b6d67f96e2a8ffe58449d0360eb577a46dcedb376d01d0f925c3e6fe857", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639051084, "uuid": "c328a060-a185-4416-8f13-759764e3c064", "comment": "Malware payload (Heodo)", "value": "926a238c95555764fe2aff12095fdc7cffd38818", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639051084, "uuid": "3ad80b93-4e7e-4457-b9b5-5eedf88984a8", "comment": "Malware payload (Heodo)", "value": "ce132262503e22151a7ee0f9984c472ef7ed5ab7d6c691f1768e58581c421a63e965b243e79dc9e542458d987182f0bc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639051084, "uuid": "d7aedad6-f1d2-419a-8cef-95fe367d5ddc", "value": "T1719301CAD6A5DE7EE4E6D038E4BBA1B97723C036C0581D82918DCAC8812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639051084, "uuid": "176ea9ea-26f2-4581-b56b-f6a2ce4a8224", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3fT:psXZ3MYeGt9sLBrGrQfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639051084, "uuid": "a11a2685-576d-4bd5-9aeb-86285d35ee88", "value": 90147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639051084, "uuid": "02acd06b-1fb9-426e-8e16-abfb120feefb", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639051084, "uuid": "97759bfa-a9f7-4b66-b416-06c9bd610daa", "value": "emotet_e4_3b8b1b6d67f96e2a8ffe58449d0360eb577a46dcedb376d01d0f925c3e6fe857_2021-12-09__115739119570._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1af3168-58cd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639040208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040208, "uuid": "0de20499-fea0-4e2b-a71d-f897b8f86d5a", "comment": "Malware payload (Formbook)", "value": "1cc5211697e67186e57b531f390f35c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040208, "uuid": "2fa19eec-5d3a-4843-b396-31b9005cba13", "comment": "Malware payload (Formbook)", "value": "3bd295861354bdf3fe47d5cbefb72a8c75bd14aab6036a9071dda01cfc1505e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040208, "uuid": "6b579523-5ac3-4693-ae2d-f58534d72bcc", "comment": "Malware payload (Formbook)", "value": "6306fb641f579ca942e4f050427c01bc114cdb9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040208, "uuid": "d145a1b7-a6b3-4b96-a6a7-80564588d1e2", "comment": "Malware payload (Formbook)", "value": "685f44ea7d826fbfbf4d9f02678ccbb8f8a9188396af8754a4737326a0e065979a9ea701f1d85138d9da672688021fa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040208, "uuid": "193513ea-cd38-4194-9fc2-82a5d0296820", "value": "T1CF641257B6D148E6DDF60AB208719EA7A1FA1DAC41E0511F97813F2B3FB3193094AC0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040208, "uuid": "4a0b9974-a888-4ce9-a12f-a98037ea8ff7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040208, "uuid": "3a53f0ca-378c-49b3-94c2-794305405e74", "value": "6144:LGi4zy1TUZP1g/jEKAqNJncZndI0dsuUGucqtW4j/bz/x2ImkJCxA6GI:Gy1omwWdapsBGucp8bz/sJkY+RI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639040208, "uuid": "7508ab98-51a8-4fe2-8b0e-50b74cf08404", "value": 328150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639040208, "uuid": "89223d96-0075-4cb0-9f0b-86525773a1ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040208, "uuid": "d6a7ad0c-494f-4b2f-b40c-ab9c1f87cd46", "value": "Godisgood.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d63c30-58ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639052622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052622, "uuid": "e5b42f91-b237-4767-9855-f688e0165257", "comment": "Malware payload (Heodo)", "value": "b2ff52c287292d2f104925752609135f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052622, "uuid": "318fc567-83f0-411b-a736-efa54c129d6b", "comment": "Malware payload (Heodo)", "value": "3c65ae4188a5b36ac41d0ddbef708df0d445b62a182d304a7e2f081f7194e6b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052622, "uuid": "461db9d5-c576-42f7-9e1b-e3739e53a2ef", "comment": "Malware payload (Heodo)", "value": "05963e44e2d619da4047c3eda6683ae42f83a152", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052622, "uuid": "e5d94d2c-4e9e-4a7e-93a7-a6011eef077a", "comment": "Malware payload (Heodo)", "value": "03994cf4d3135246682a19d676295ee13becb56b5edbd50acc7c4e72ec6d95709c55ef49535f05196f5234ebb8f62aca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052622, "uuid": "d9f242e8-25a9-4688-b6a7-18d8c2be5086", "value": "T1D444BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052622, "uuid": "f4ca13df-c3aa-41ec-9423-6bee2542cc9c", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052622, "uuid": "d75cb1c9-4484-4fc6-adf3-ecc432a8c15e", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBi2ypv:6jIG/pjjuLbJLmGshoCUnWTOpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052622, "uuid": "8c474816-caab-4c60-8fa4-9b937ed4405d", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052622, "uuid": "e0c7af81-bcaa-4596-93df-30de1b0b5fea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052622, "uuid": "ae435b42-435e-4ac5-a697-2057b52eb3bd", "value": "b2ff52c287292d2f104925752609135f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625c62f2-58f0-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639055000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055000, "uuid": "e1469e23-4d74-4881-ac5c-0f8687083476", "comment": "Malware payload (AveMariaRAT)", "value": "2b47ad2f8845599531e6a49f53febf7c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055000, "uuid": "f2440fdd-4b17-4c50-a831-3c02bcc7f06d", "comment": "Malware payload (AveMariaRAT)", "value": "3d3b5e62409ada36c603e4688ff7ffe581a55d4227645f679401784ebc2cfdd7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055000, "uuid": "910ecd12-ef4c-44d4-9588-7a94d9f55153", "comment": "Malware payload (AveMariaRAT)", "value": "c21978e5dbd431af9b7a6957dc77aba18231d1cb", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055000, "uuid": "9b3a276a-1398-4fdd-bca8-deb9bd80c7cb", "comment": "Malware payload (AveMariaRAT)", "value": "24acd28917062e820e0b2f79a59da462b6380890815a87e6a3df183ca43763b76c1d77cafb04cef0cf1707ef597befcd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055000, "uuid": "01f1e97a-9e1d-480c-ba72-4a61f1caefb7", "value": "T1AC84FC51912E3C6FF62FE81C1593E1C8386EA57AA4F0056C939EF014DE259EAED8C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055000, "uuid": "c100581a-d805-4986-bfb2-2b2109ac3713", "value": "1536:iSDjpDDDDDDDJ8vn+21MvssBkWo02ftBUtBXZpmN7hKfedzFz76mAg5eeVhMDw5T:iUDDDDDDDivjPdzFtr5RDAw5wfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639055000, "uuid": "7b5bb2be-b8d3-48ca-aefe-72428f427c3a", "value": 392657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639055000, "uuid": "c5537da6-bbc0-456b-b32e-e98e0200e85f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055000, "uuid": "f9820eba-72bb-465c-9a5d-dac7c2efcef8", "value": "RICOSTA Schuhfabriken GmbH_MATERIAL ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40542c7e-5946-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639091880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091880, "uuid": "69ad71f6-2b1f-4ce7-a0e2-bf550a52f5cc", "comment": "Malware payload", "value": "aea5d3cced6725f37e2c3797735e6467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091880, "uuid": "caca425b-8db6-42e9-a9f9-446d9c2118b0", "comment": "Malware payload", "value": "3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091880, "uuid": "5e93bf83-a586-41b4-aace-2092be341cd4", "comment": "Malware payload", "value": "087497940a41d96e4e907b6dc92f75f4a38d861a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091880, "uuid": "e042689b-aac9-400d-b40e-323a3bd4b745", "comment": "Malware payload", "value": "5a94307d2a63f32b9a0724372217094674072a9f824c930f028579af17c4066711db94fba601cea8124d42dbe2950690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091880, "uuid": "f8667c4d-a967-444a-9d9d-e1d85c8c72aa", "value": "T121B57C45F66391FDCD672930301EB23BE7301919421E9FA7EBED9D60FB2EB011909A19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091880, "uuid": "6e862620-7a2f-4c79-ae62-64fa33edd9c1", "value": "2c3e267ae163c15bfc251e74ea5319b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091880, "uuid": "d69e8873-89b2-4396-84fb-e559dff14e69", "value": "49152:BEqvaaAjc2hdKjb8WXqE1PiEbE/TKMt3/RgaJ2wW:BbyaALKjwWXV1P9oVvwwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639091880, "uuid": "bf82d9f4-9034-44a7-8158-0d0d0ca7f64e", "value": 2281472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639091880, "uuid": "77754fca-61d9-4c2e-83ed-a24fe892a1a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091880, "uuid": "83a2b8ed-fcae-4906-b631-ff5ac72e5c70", "value": "3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58570cc-58f7-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1639058173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058173, "uuid": "d0e4f5ba-08e1-4a13-a4bb-d5d6201ab196", "comment": "Malware payload (TrickBot)", "value": "1417151ea6ccb36b9aebab3c63e63b76", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058173, "uuid": "33f6ae65-676a-4407-bc41-32fcc68b865e", "comment": "Malware payload (TrickBot)", "value": "3e0b749221c4c89bf82741c97594f8b27d75a322e8428e694a28e1d3e654a2c9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058173, "uuid": "1621d0e1-9a3d-40a3-ac1a-83f471de1d45", "comment": "Malware payload (TrickBot)", "value": "3e9c7b5a45c356ff5fc1e99b5d644b8f5e378a5d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058173, "uuid": "2f1abd1f-8dab-4f2b-8502-2140c85be958", "comment": "Malware payload (TrickBot)", "value": "907eb4769cdde20958d74af75c243bfe6af996bf50ba6eadbd5fb8846306d6d421208e637bc9598aa20b72e40b676ea4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058173, "uuid": "9e9ba814-7b91-4fcc-af88-590f77a4de70", "value": "T1F98535F1DBDA8B5FACCC986163020A7A51CA07678D45879AD0BC53FC787D982CC6BC52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058173, "uuid": "a7937241-de82-4742-8eb0-44b98bc9fab5", "value": "c131e7ab95b6cc6ff4c2379d5b0fc4ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058173, "uuid": "a0f6a5b8-fc53-4779-b139-9c88ab7a5833", "value": "1536:sjkUHInOKVU9vFhgD6wK1LhsfAWs/g9UhwtV/IeQ/HQljEqt:sjFiDgL+C/3hwXfuwJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058173, "uuid": "65935176-a47d-4d5b-8613-4aa1cebb654a", "value": 1821184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058173, "uuid": "0b7378d6-b2bd-427e-b88c-539513f54298", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058173, "uuid": "65c5acbd-1a3a-4189-bc72-5e70aa60b05a", "value": "yellowtank.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce062ca-58e3-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639049569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049569, "uuid": "380fa654-b866-4e43-9762-5ff3763d84ec", "comment": "Malware payload (RedLineStealer)", "value": "5c901fceaae4e0ec9288d480beb1fbc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049569, "uuid": "a3dfe2dc-b8e8-457b-ba73-189b8fbbf1d2", "comment": "Malware payload (RedLineStealer)", "value": "3e0ff5048861fba41cf1cd778ccaf095c3e5c13c9bbcdc9cc318c92e3271e465", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049569, "uuid": "3ed62366-2c43-45b2-aa6f-69470e88157b", "comment": "Malware payload (RedLineStealer)", "value": "049990b858a574fbd6f4c2a42f3431c11779bac3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049569, "uuid": "f953458b-096b-4ec7-9bd2-df9b9ea53442", "comment": "Malware payload (RedLineStealer)", "value": "b240ca39e6a5db5e673260d22484d51ca898ceea625b5412deddbb801cf9fad8d7345679758ff04a0137cb4c9de5bf7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639049569, "uuid": "e42e89d3-d8a7-4179-8222-dc01ed4e6c35", "value": "T10B25F18B5B6B16D7C003417174350903A7F06D221AD89ABF2D88F51E0F767E9DE88E7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639049569, "uuid": "58ad09af-bd11-41b2-baaa-816c6b530ded", "value": "c4d858b72e927e9434db8ea0d9d5f5c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639049569, "uuid": "5eba8628-874e-442e-a8e5-7858f56a5335", "value": "24576:x7z0PxQsnS20VwZUoIUUvw+Iu/TwO63Nxz//VuWTg:RzEx9SJwZUoIUUIZu6Pgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639049569, "uuid": "00dbdee5-da17-4128-be44-710fb240c27d", "value": 1007536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639049569, "uuid": "83efb63c-d631-43fc-be59-74459539b1a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639049569, "uuid": "297cc561-5830-4191-82bc-319e65c9bb4e", "value": "5c901fceaae4e0ec9288d480beb1fbc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7134e9f0-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639054166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054166, "uuid": "ee1b219b-fbba-4a91-ada5-05158c5d042c", "comment": "Malware payload (Formbook)", "value": "856cc391e6b194c819e45906bee0f070", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054166, "uuid": "5f276689-572d-4f2e-bd80-9dc181b80d5a", "comment": "Malware payload (Formbook)", "value": "3e48a68c053fea3013ad19b044071c37f5a4324cc4c8335fa0a0ba3dffad25b2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054166, "uuid": "ecc59a7c-0c7e-4a78-a6d3-76ec4b9b2ead", "comment": "Malware payload (Formbook)", "value": "49d388b396e1ac9ec82631a17fc7177f7495a2ae", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054166, "uuid": "f6066693-766a-4cad-b3df-b115b13c0de2", "comment": "Malware payload (Formbook)", "value": "22978631deb628c0640cb8804de96e9842504bfb8ef75f1326eaef749582d44649db4efd8bf732722e90849a3ddfe4f2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054166, "uuid": "14743592-5804-4bcc-b1f9-b9061fb3313a", "value": "T18734121B3D3EA0D4E243D6F4EBE944801474EF8FA913AD4662697B881CF18DB39E3564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054166, "uuid": "5c67ae22-1023-49c8-a409-754382f86306", "value": "3072:PpA0MevFvKGLwAYIxtei/fXxndDmuidQReRm80+xw4B8sEtLiWi1z2UYUTWCQAJu:fc+tei/fHDxiGRMfqOWi1zFWpOVqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054166, "uuid": "9e79a40e-0530-4389-af38-565875686b68", "value": 234376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054166, "uuid": "fc90ad94-0d6c-45fd-82ff-5aeeedbc65bf", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054166, "uuid": "e6643a06-9f96-4167-9177-8df2efa8818f", "value": "Order 221753 & 85205.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2425cdcc-591a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639072935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072935, "uuid": "55036a84-d004-4339-a50e-d4f95c76c8ae", "comment": "Malware payload (Mirai)", "value": "8a5256d66b21ef61b616f1effb823bbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072935, "uuid": "44cb17e9-e9e0-4a4f-9bfe-40b0e308ac96", "comment": "Malware payload (Mirai)", "value": "3f1a0b3475d5afc0d3f57cee1ee679d592717e3ff307ac2570359a60c3dfb263", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072935, "uuid": "6e82144f-fceb-447f-bb21-203e2472e2f8", "comment": "Malware payload (Mirai)", "value": "923814d8df1e96122f8a8e33ec9683e4617fcd9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072935, "uuid": "c4efe4a0-5fe2-468a-9d10-b232069ac705", "comment": "Malware payload (Mirai)", "value": "a10b6cb3dba92636fada2d8105b4696cba5ef7f48003d24d150b25286c8d9c82b41a8df613c0a99ba3c251f8da6c8046", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072935, "uuid": "6b7d3f8e-9162-437b-943e-22a759abcccd", "value": "T1E3F2E152238655B2B73228F2FC41CAC72B160AB4908E21E1DA453959CBC93D16FEDF0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072935, "uuid": "dde63d6d-55d6-441c-b9e3-c93e88bf001a", "value": "768:02WTfRwfxSTjnCRl246UA2Qz4pZyZfCW25J7pVEhEe49q3UELxJ:mTfhnL4hbQzaZianpiLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639072935, "uuid": "1a95f604-59fe-44cf-8c2d-2b85dddc2c1b", "value": 34584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639072935, "uuid": "5afc5485-8cb9-44fd-bb44-3391b3879792", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072935, "uuid": "2f84cfc8-68ea-4aa7-92d6-1a1eaa159970", "value": "8a5256d66b21ef61b616f1effb823bbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac05043-58ed-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639053967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053967, "uuid": "6dec0a67-493f-411d-bfa7-2d9e5b3781f0", "comment": "Malware payload (ArkeiStealer)", "value": "e933dcf63f654533f12e100d77e9e068", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053967, "uuid": "3aef869d-fed1-4fad-b902-b06bd441f8f4", "comment": "Malware payload (ArkeiStealer)", "value": "3f5e239dd557d1a61623ceb9e4020a5f11de4dd2235f6bd6209bd8332813ad91", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053967, "uuid": "317ed1b5-dc50-494a-a8f1-f6d208b6595c", "comment": "Malware payload (ArkeiStealer)", "value": "c9f2f420cdfc042dc36da59f4757b82c90f6acd3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053967, "uuid": "02bd2f4b-510e-4095-a90d-9dc0fafada69", "comment": "Malware payload (ArkeiStealer)", "value": "7e842d79d79527d47101583593ad7cfb1f75d5302146f6a97c5ec0bef29b3f9128504a57aab624fa5eb496853807309b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053967, "uuid": "1ae7fb66-b0dd-45c2-b7d8-1d81f5fd701f", "value": "T102748D00BBA0D435F5B712F45AB5A3B9A52E7EA16B3890CF12D526EE1B345D0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053967, "uuid": "8c8e26c7-e590-48c9-b76b-774adb7698c9", "value": "d9d9fc0ee02596fca6336fbe79f431ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053967, "uuid": "26ef331f-229f-4582-b089-f7114842bc41", "value": "6144:xHGqCVRfh3yjhx2AbrovJ4YLoHTf7yY1W3ASf:xqVthijh0AbsvJ4YuTfh1fS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053967, "uuid": "b75b69a6-b17f-42f4-a789-b09bcd02fe87", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053967, "uuid": "0a0c06ce-59a5-4abc-b7ad-b1c4c6a36dbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053967, "uuid": "39dff0bd-4c53-4ead-8a63-a45f8103cf75", "value": "e933dcf63f654533f12e100d77e9e068.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1381525e-5946-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639091805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091805, "uuid": "a43da2fd-be06-4439-925b-a1a3ebadc84b", "comment": "Malware payload (DCRat)", "value": "210306975090eeae8b5e4e1124ecb943", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091805, "uuid": "1f6eba96-7e16-4a68-98a6-222515ad0834", "comment": "Malware payload (DCRat)", "value": "3fcd2b5e3bd59d6eb0810bcecd768482aea0d4ea59ad082389e09a82d64b2de0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091805, "uuid": "886c5b97-e2d1-46b0-b64e-304ccfd18e03", "comment": "Malware payload (DCRat)", "value": "89f466f7554b18906d346aee6803398b579ffce3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091805, "uuid": "7c3a8a43-3183-4ec8-852c-398bf78ba332", "comment": "Malware payload (DCRat)", "value": "55fb2e90d0476674affd8d4d8b93b0bbaf0dec4d8fabd813ccda04d37e3d44bcb1351a8857424054ad4545bb79d2a20c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091805, "uuid": "d6657776-9f5b-4961-ad51-a57cd39191f6", "value": "T180C4BF09B6949583E605913232F7EA3440378FFB9C8A1AB1B5E26D1BF2E05C1D417F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091805, "uuid": "76238759-9caf-42df-9db9-9109321691a7", "value": "31a0d8a10004949d8bfcc62a3a182b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091805, "uuid": "6745800b-2467-4fa0-a31d-9b2b025a55f6", "value": "12288:hzXoS5SDvI3YgyNTFffkfTB096pw1GxzqgbUstD84ppOOVNFFZXu:hzXoS5SDvI3YgyNT50096q1IDYstD/pg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639091805, "uuid": "f5908120-f35d-4531-b623-4f1fb84a0bb8", "value": 586208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639091805, "uuid": "1dd5d4e3-d3e2-4114-9d24-1bd6d25f7ce8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091805, "uuid": "4c974623-3b30-4bef-8014-0217a7e2f0df", "value": "3fcd2b5e3bd59d6eb0810bcecd768482aea0d4ea59ad0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01bc614f-58b7-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639030357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639030357, "uuid": "dfa46308-07c5-4d70-93f7-01281c93ea91", "comment": "Malware payload (AgentTesla)", "value": "44bbdd1db7b24471f8c5c71e101db522", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639030357, "uuid": "d1dc8d95-ea66-43d9-bed6-11b5c5b4ce12", "comment": "Malware payload (AgentTesla)", "value": "40171c5a20bd5db9979a7bd8cc9b0b20c51ad71e38dd9333eda4597a69c03ddd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639030357, "uuid": "4d0217c7-95f1-4cfe-acaf-183cef220488", "comment": "Malware payload (AgentTesla)", "value": "453623ba56dcccc0b5e794423069e6fc2e190d6f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639030357, "uuid": "6481cbb0-88e0-4ce3-a0aa-9808a68ed151", "comment": "Malware payload (AgentTesla)", "value": "16f0cb5a90045ba695dbd81e550a9a8d6e5b1a88eaef6a4de63531c736f0800e301d3bfbc5a4d63e8c5aee3a3a9580ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639030357, "uuid": "50e30c69-7cd8-4405-b097-67ecad14a07b", "value": "T1C62533CCF25E56A739B101CE680E1C0A42B3BB292757934A37209F55FAC2C9FB714939", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639030357, "uuid": "0fdd2238-22d6-4d7f-9f3a-8fa00a903ee5", "value": "24576:8tTqLNSZvW3zCcGWT+T+85FgJUHGg/pMEDTE4A:8t+pS1+fGJ+85s5gyHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639030357, "uuid": "810fd0c6-e30f-4577-b45a-4f64d748e427", "value": 1047513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639030357, "uuid": "028803d7-eff2-4821-bad2-8f41a4e4c652", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639030357, "uuid": "93142b1b-b819-4cc4-925c-a5307cbc1167", "value": "BL-INVOICE SHIPPING DOCS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979cb736-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639054231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054231, "uuid": "cc7747f5-8fab-477f-824e-31bf0df6a275", "comment": "Malware payload (Heodo)", "value": "55fcb65030523d6ecee57d39c17910a9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054231, "uuid": "7d0e8930-4385-4a5b-aeec-e5dcbbcc5cdc", "comment": "Malware payload (Heodo)", "value": "422cdaf95ec5f430f907c9acf9538f9b76473c10d984ea3370753d2bd8a5d7fa", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054231, "uuid": "408a25fd-57fa-4c28-82bc-422029562043", "comment": "Malware payload (Heodo)", "value": "a46b85e85538f420c4b798fbe6d9cf5cf815c0eb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054231, "uuid": "b6624aa0-cf9b-4a78-8f1a-db590161ed3d", "comment": "Malware payload (Heodo)", "value": "090cc850afed97cf3f4bd3a4c4261c967d2e5a24c467cb5cc452aece01a1d475f1c9033702fc906a64f03fb536071bf1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054231, "uuid": "d97e830b-85c5-4666-b7b7-77f27e747059", "value": "T1009301DAD295D97FF8E6D438E4B7A0B92732C071C15C1E82628DDA4C812D5C757FA2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054231, "uuid": "0defc76d-d7c5-48d8-bb32-841c96360b03", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nb6:yIBQ3MYeGt9sLBrGrB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054231, "uuid": "f9a48590-b481-497d-a1c3-06d9c5e0109e", "value": 90157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054231, "uuid": "d82e9545-6c2d-4c2b-811a-06dc753ed8a9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054231, "uuid": "d6f75940-a766-4f21-ae56-94a727337f4a", "value": "emotet_e4_422cdaf95ec5f430f907c9acf9538f9b76473c10d984ea3370753d2bd8a5d7fa_2021-12-09__125001307853._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372175dd-5900-11ec-96a4-42010a9c0029", "comment": "Malware payload (BluStealer)", "timestamp": 1639061800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061800, "uuid": "a72473eb-2e8e-403e-a2a5-1067e70815a0", "comment": "Malware payload (BluStealer)", "value": "b0b0cadf27d14fb3d85959e614249fe1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061800, "uuid": "d22b1c3c-dc81-475f-bc55-862850517eb8", "comment": "Malware payload (BluStealer)", "value": "4279f3c6d9905ece46194696d89297c816553a62b4b74f2a7bd8a4e4af3dedf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061800, "uuid": "482f6471-dd26-473b-af80-dc9e32c3b23c", "comment": "Malware payload (BluStealer)", "value": "84e64a7b45572e4487f59243387d6120e380456e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061800, "uuid": "d61506b3-cbda-4be1-a19f-9959428a92a5", "comment": "Malware payload (BluStealer)", "value": "68e0f9c7e307c3314374792f9cd72c2fd0230f3157e27afaae3fabefbf2c13b76e4a73b23196fa46b0f111ec22be1ef9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061800, "uuid": "d492e9bb-26e8-444e-8b64-1a3fb3bf8393", "value": "T105C50B8A7E46EDDEDCF85271594DAD33ED223E0E391A2515F385B7AFBA360123901438", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061800, "uuid": "fd3358b4-b62c-43c7-ab68-30dc827a2652", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061800, "uuid": "07c7cdae-5c01-499e-b229-15d2bc745986", "value": "12288:G3hcJ42/RB5WMnujFK0CYV6PLn+47JnZ5iNPMa1lhGliIAopBf7DN09crWoE5Ucv:UI0vXVw+47JnfohlsAIAog9crWo/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061800, "uuid": "216b6b1e-9d0a-486d-bb1c-93941feab18b", "value": 2619392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061800, "uuid": "956580ec-a864-492e-bfdb-036902ef2746", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061800, "uuid": "3eec3711-5385-4aca-8f2a-b0ab10c18cdf", "value": "b0b0cadf27d14fb3d85959e614249fe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e535f679-58c9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639038469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038469, "uuid": "4aef294e-11e8-4702-8ba9-da0f67e8ba9d", "comment": "Malware payload (Formbook)", "value": "86ed2f1a82cabf8119fb0074ecd46e34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038469, "uuid": "6f0894fc-62fb-48f5-964b-942aab82015c", "comment": "Malware payload (Formbook)", "value": "4313ad81ca56f714cd21473a99d100a545dd1bd79ee5f767570ab4944c81326e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038469, "uuid": "ede837cf-1469-43fe-926a-17095382352d", "comment": "Malware payload (Formbook)", "value": "c0d1f831360d05948916c4d180add4f149a0ffa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038469, "uuid": "1225597a-81a2-474d-b941-f7b46cb2a4cc", "comment": "Malware payload (Formbook)", "value": "da1cbedcbdf66ae9dda1b941f7c75ae2f61c260acc83fe865277c81eeb0312b2f2f1e324c6ea6f2ed4e0b1fc3fd58cb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038469, "uuid": "751b0c9c-7d36-42ad-882d-2da9983b64c6", "value": "T1FB350128A97B810CE45B31F41F16BE421E6F9E79C002861623BEF654187E667CF227DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038469, "uuid": "f209003b-1aca-456c-ae1c-9a1e626b9c79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038469, "uuid": "56d29753-9fe9-4229-979d-2c34cfb406a5", "value": "24576:6KPxCCrQzJDH0fEn3fbw+KOGzwieqhcLvZyYLT:6KACrQz6sn3fE+O8ithK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038469, "uuid": "179d67ef-46ec-46ec-bf65-af9871245aa6", "value": 1084416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038469, "uuid": "83e864e9-63aa-4655-b25d-109e7c7c99b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038469, "uuid": "09b31d69-9a9d-4d67-afe7-3ba5e7bf717b", "value": "(RFQ) - ATTIQ 10230-2413.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed96840c-58d9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639045355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045355, "uuid": "97475a6a-0d50-42d3-b375-ee9162669aa9", "comment": "Malware payload (Heodo)", "value": "c2479718b40faf32a9bc515047c5910c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045355, "uuid": "5352b32d-ffbd-4f06-a54b-b7009a06a371", "comment": "Malware payload (Heodo)", "value": "432f46caef1c57fcba7f2de3ddfb215a25f0c4e488158953d499b97a7813e808", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045355, "uuid": "7c1c5220-e067-4ade-9522-170e7656314f", "comment": "Malware payload (Heodo)", "value": "fadf774a3761af10700e99415c8f810ee65efa0c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045355, "uuid": "f67be38f-70ce-4577-adee-a449fdbcded5", "comment": "Malware payload (Heodo)", "value": "9af7d688edc29796b2d74c2ca638cd62549270c56260c47e532dd80194c3eedb1fa492cad66f0b5f708c8bee832759e1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045355, "uuid": "def4c577-31ea-4c97-97b7-0c6c824cba90", "value": "T1B09301DAD6A5DE7EF4E6D038E4BBA1B97723C037C0581E82918DCAC8802D5C657F61C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045355, "uuid": "0cca3ac0-2504-4301-9591-67ac6fc45ef4", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3+:psXZ3MYeGt9sLBrGrQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639045355, "uuid": "078c5554-3787-4b1e-82af-de182c63cc7e", "value": 90149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639045355, "uuid": "d0c4fb20-bb4b-4408-bc46-802576e8367f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045355, "uuid": "2d22a979-666e-4434-b3f3-8f46f0847501", "value": "emotet_e4_432f46caef1c57fcba7f2de3ddfb215a25f0c4e488158953d499b97a7813e808_2021-12-09__102213740646._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51daae6b-58ac-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639025767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639025767, "uuid": "c1a45586-a784-4151-8d10-2a7128f58b18", "comment": "Malware payload (DCRat)", "value": "a9413f74ccb0bf539092494896581b68", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639025767, "uuid": "bf900c15-2f89-4dff-a659-79ae9c985462", "comment": "Malware payload (DCRat)", "value": "4343547fe4a47bdda3b6c36702dbb5870d501c8b31b9fed671cd24ba307b196c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639025767, "uuid": "147c567e-e3de-49f4-aa53-1e0c39102067", "comment": "Malware payload (DCRat)", "value": "67ae6fbc46e4adc1962f7139d41e03b9f0b9c247", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639025767, "uuid": "a0af86b8-ce9f-4cd2-98a8-94b61b24df50", "comment": "Malware payload (DCRat)", "value": "ce972b73376a9c1887a4ff3a0afc4c8ff66fc4a423b09ec63ff366b6d0135e48f368b46dbfc72c7d0d1e0520bce0275a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639025767, "uuid": "916666fd-171a-4421-a5e4-9dfea7831357", "value": "T17F1528223A44CD12D269163BC9EF405447BCED417A62DB1B7EAF33AD28513A71E0D1EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639025767, "uuid": "f65efc8f-9555-4e65-a730-d76a5bfff870", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639025767, "uuid": "83ca4a42-c4a5-4614-88e9-1e8933ffbc0c", "value": "12288:37OlpWhwtMZfK9fifeng3KNXloog8n2LPaINqCIsqn4:rO/WSMZC8fcgaNXloo6rqk+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639025767, "uuid": "39184916-a3b4-4414-9c9b-48a0e979d626", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639025767, "uuid": "71f00f62-8ff6-4332-8b9d-4df578283ad0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639025767, "uuid": "0051cf08-8658-400a-a22a-40b5aa50f107", "value": "a9413f74ccb0bf539092494896581b68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78f6841-58e9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639052217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052217, "uuid": "6f831082-6f9e-4262-9b4c-f6ab12d2200f", "comment": "Malware payload (Heodo)", "value": "f1ccfd11c7a2770f4f91b73d56f93649", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052217, "uuid": "2cb7e329-cf74-41d4-bec6-0f8d1a8e6a35", "comment": "Malware payload (Heodo)", "value": "4362a471529593c06ade73a2be4dbf3ff6c4957bfe3c8ce6eaba18a065da8383", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052217, "uuid": "7f6f88ad-23f2-4e4b-90c6-3da201c4481e", "comment": "Malware payload (Heodo)", "value": "e7328f165ed3e2981afc420fc5af43aa692e4c4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052217, "uuid": "7fd62fc1-e263-4291-b035-0e4170389746", "comment": "Malware payload (Heodo)", "value": "65d58f327fbf681956bbf55c6dd4027dec6a0a68eaa6939ffa490fef7952ab5a5761f8a9899cfb6b20d25b8b90ab53b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052217, "uuid": "4bb3c4a4-e906-4d93-af04-a42dbbb0a54e", "value": "T1FB44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052217, "uuid": "e0a56747-439f-4c8c-9391-8ce989304347", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052217, "uuid": "3eb441d2-70fa-4c3b-af2b-7e5ccf68bfa8", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBc2ypv:6jIG/pjjuLbJLmGshoCUnWTcpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052217, "uuid": "e5cb100f-7e62-4042-a655-d46f4bdd7ec0", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052217, "uuid": "ab69877b-cad5-46f4-b183-9a0931cec468", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052217, "uuid": "69a7efc9-94b9-4658-9aff-e49844eda238", "value": "f1ccfd11c7a2770f4f91b73d56f93649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e82d9b-58b1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639027894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027894, "uuid": "4121e106-f10d-44fb-8080-3e81ee89582e", "comment": "Malware payload (Loki)", "value": "77cd0809ec784c310b2fda307f7fd3d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027894, "uuid": "0f4e94e9-ff8c-48cf-845b-0ed5d663d60e", "comment": "Malware payload (Loki)", "value": "43f20c5f9ee608b582ef3e5c7f8847a57788a0a0529c97c6306b55598c703f61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027894, "uuid": "7868ed1b-999a-4bf7-aa25-d4038a1aa2e3", "comment": "Malware payload (Loki)", "value": "a1014810afbc803a846c361ec72724c77c7a1a77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027894, "uuid": "c34a2a0a-b285-4dfc-aa7f-e42032e15603", "comment": "Malware payload (Loki)", "value": "af1ed4ef7c3ba53084fbb6f8fee91a8ff97ad6e8a3b6f4b18c418b4fc55bf27e7809e08a920221cc37db88809e4abd61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027894, "uuid": "789fd6e2-7afe-48df-9a1c-d4ff517c6cd4", "value": "T1ED25F0249A7B850CE85332F44F66BD921EABDE79C012991A237EF254453E213CF227DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027894, "uuid": "2c7d6c03-2688-4a4c-a787-2aa6cc76bb7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027894, "uuid": "9e5e418a-5a16-4978-8a05-4ad0fab19c69", "value": "24576:nhbAVKKLvhrOaqxgEHo8qb+MD+nZBNbA:hURJrdq6MqqMS/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639027894, "uuid": "0eb420c9-f240-47ac-896f-f6190ad9a324", "value": 1022976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639027894, "uuid": "94edcb85-0daa-4b0f-9f64-aff59c9c0652", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027894, "uuid": "68f4f427-ff3e-4d75-9224-a499200d684a", "value": "DI094472.COM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7cf6b4-591d-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639074564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074564, "uuid": "6254a770-bef0-4f1b-a000-3a00f2940e1b", "comment": "Malware payload (AgentTesla)", "value": "710a108c1e2d6b9371e9864b56af07d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074564, "uuid": "0367eeba-acb9-4f7c-96da-177149ace9d3", "comment": "Malware payload (AgentTesla)", "value": "44d01ded739a426409eae459b7d756a3db93ebb4a662ad59aa3393fa7f1b5572", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074564, "uuid": "20afd8d9-d367-41af-a46c-672734494fae", "comment": "Malware payload (AgentTesla)", "value": "f5b0774516d8fbe123858f58e2f12a7c354d423f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074564, "uuid": "e03fba7e-93d5-4b36-8540-95621c886550", "comment": "Malware payload (AgentTesla)", "value": "9d48b7a6fc1aa9c8dfbd36a96d5e9e15e0af6d63a0e26410edc27bbaed1b219243faf5fa3ed345bc97b3496e4c4d8db4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074564, "uuid": "5b6c7afa-f2cc-45df-8395-54bf53abea08", "value": "T11055221E39B0B56FE27D5BB2D28780604AB9F0073D73F6B56C9102EDBA34AC99502743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074564, "uuid": "cffb6869-1da1-4678-8506-56920b97bfee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074564, "uuid": "506b84b9-799f-4438-b79c-c39eb7f9ffab", "value": "24576:RIKjy/SYCp3ctHg/UkFSI5iskcLvylOgsDTHij1ocOGY5rwaWxud0EA8dph8ckJy:JjASPcmJFis1X/DEocOGm0aW2jG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639074564, "uuid": "745c599b-06b4-4399-be71-df49cca15f4a", "value": 1318912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639074564, "uuid": "60a6c76d-53f9-4a8e-9777-2f8780ae7b42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074564, "uuid": "53e805cc-2995-4a69-861e-a7b5bf8c2029", "value": "Building Plan 9028AWT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2af663-5924-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639077463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077463, "uuid": "918cbc04-856f-4df2-8b58-16d4cd6edd53", "comment": "Malware payload", "value": "fc04c092989b2b86863c18979b04e1c3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077463, "uuid": "3da62c31-5893-4abd-a676-f508f6b33713", "comment": "Malware payload", "value": "4524b17b0596fc6bb80fed231fe53ca854f2319878c0c1e2805b3b5710bb64e8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077463, "uuid": "b089a7dd-ee74-438f-93cc-28a82c825592", "comment": "Malware payload", "value": "3619e13c299ca621e348a9a57f03f6500d23429a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077463, "uuid": "f7c6ac7a-c9a2-47be-a6e6-6cfcd1702def", "comment": "Malware payload", "value": "398e9fe5e24ab6fd9f5bd18564d11021fb5b033a06e5ce4e72a047cd03e0aa2cb10f30c8eab8a46561c410af49e88731", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077463, "uuid": "80a384f8-1259-4e7d-ba1b-4ca35ac7dae4", "value": "T14F7260ACC09745E88F856BB4271F9F44058D722EF3A9A23376B89B3427E1DB6401783C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077463, "uuid": "7c49a4d2-35f2-4dc1-8e6f-bc0dadd86636", "value": "384:9etJrtb9UoXXVvzxeD1kfxA9QypJxUhasIUjt:s3tb9UwFvzxeDafxA9QyprS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639077463, "uuid": "8fd9f9fb-3158-426c-93d9-1afc99bad6c2", "value": 16636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639077463, "uuid": "6a3611bd-8b61-4d85-a27d-93c63a1fa5f1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077463, "uuid": "6fd10559-13f7-4588-8985-b48b45069644", "value": "Scan00938.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074e1a91-58d4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639042822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042822, "uuid": "05154d3b-f54d-4530-83eb-2472f3ed059f", "comment": "Malware payload (AgentTesla)", "value": "c6e0c0a016709470a57e96fb59552490", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042822, "uuid": "27bf6a98-b9c4-469e-b08a-9c3ab2fd28b9", "comment": "Malware payload (AgentTesla)", "value": "452644e0c542a010a16fbfff7d7ec3a4cb2c85d0ec7a3941333d8c2936307b7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042822, "uuid": "a33fba81-76e3-4c42-a83e-8b3554489ab0", "comment": "Malware payload (AgentTesla)", "value": "df18ecc4f1d3ca7dd4fb78d1c7da90dfe30bea5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042822, "uuid": "e890581e-f5fa-4d23-958d-9cafe067a315", "comment": "Malware payload (AgentTesla)", "value": "74ad36967bcb51c41c4e0a9e534116f89cb5ddecf7e7c0d36f5fd06c5f0c5f82113caf32d1406ca9871067378f5412a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042822, "uuid": "809019be-8912-4926-945b-39e63e4b877a", "value": "T19C350124A96B850CE85336F14F157D920E5F9EB8E4028A1A277FB658193E613CF323DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042822, "uuid": "f47ca8be-8734-4bb9-8134-70816482a33b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042822, "uuid": "29582984-5513-4e67-b7ca-f5a20f758c1f", "value": "24576:n2mZmyFDtV5FCI6S7eLzyeK9pZ/crEB8HSFCD2QLd1VX4iQ:n2mYeZrFCq7eLFVHS4KaX4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639042822, "uuid": "7d96d681-9ceb-4826-8167-26298e26537e", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639042822, "uuid": "64038504-51f7-4efa-9fde-3b4a8e3b69ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042822, "uuid": "23931a31-3943-4d17-8da4-ef482debe286", "value": "Shipping Documents_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441cff3a-58be-11ec-96a4-42010a9c0029", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1639033475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033475, "uuid": "44d1ea4c-6152-454f-9b97-aad516252f63", "comment": "Malware payload (ParallaxRAT)", "value": "c46bfdcee95bb995c627283835c746e3", "object_relation": "md5", "Tag": [ { "name": "Affairs-case s.r.o.", "colour": "#5BDCCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033475, "uuid": "b218f823-9d8d-4144-bf4a-4462254a80f2", "comment": "Malware payload (ParallaxRAT)", "value": "452e41c2ea90d817a0a293c1a1b5f79e8e8f52ac9c74bf9c6e34a896de1408b6", "object_relation": "sha256", "Tag": [ { "name": "Affairs-case s.r.o.", "colour": "#5BDCCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033475, "uuid": "17025bf5-fecb-4c67-8f2c-36fa15cc7a5d", "comment": "Malware payload (ParallaxRAT)", "value": "1d61f1843b9d0a2779c2d522fa6755b55627b4f1", "object_relation": "sha1", "Tag": [ { "name": "Affairs-case s.r.o.", "colour": "#5BDCCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033475, "uuid": "58c2dcfa-6aff-41d4-904b-afc35cc99b78", "comment": "Malware payload (ParallaxRAT)", "value": "ae9a31bdaaa85c471962eeae5e6f53439677c6791d786e308c5dfea3bb46f305366073f0a140cfa6897cd13bda37901a", "object_relation": "sha3-384", "Tag": [ { "name": "Affairs-case s.r.o.", "colour": "#5BDCCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639033475, "uuid": "a02edfdc-20f0-48b2-a406-f1e975db60d9", "value": "T143F55A727D8B40E6C51312318ECAFAB6A7BD7D703B3741CB52947B78AB722E1091851B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639033475, "uuid": "bb0f28cb-e14b-4ac4-b700-e406e83e7e5a", "value": "2e0ddf2088cb6d1f82916ae63f984e3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639033475, "uuid": "92e50694-4170-4e43-a77f-4e230a2ef9ac", "value": "98304:+4qkxl0DeFkyOir3u3ujmAwd2Y2aD020UyDS+DyeL:dPlkAr3HxwwUyDS+Dym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639033475, "uuid": "5f1b1ff0-a211-4a05-8873-cd39613e4e1d", "value": 3442864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639033475, "uuid": "42580024-bc95-4f3b-8ae0-63d51ec51ed9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639033475, "uuid": "8f57d2ac-7e91-45b4-ba92-75cb61ae3aa7", "value": "452e41c2ea90d817a0a293c1a1b5f79e8e8f52ac9c74bf9c6e34a896de1408b6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc77b27-58ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639052630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052630, "uuid": "4e430594-1891-4c27-840b-18d108c4c50c", "comment": "Malware payload (Heodo)", "value": "9460f8a552aa211a534e561ab084f494", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052630, "uuid": "6d202d3e-f5ea-45e3-98e4-be96b6832cc3", "comment": "Malware payload (Heodo)", "value": "459a7b09ce2cb66d070818e57dc6bc038a854dc4ba7906091a6791aaa4140491", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052630, "uuid": "75654183-f034-4c4d-9f14-eefbd109ced8", "comment": "Malware payload (Heodo)", "value": "c84493dc246d1fd22642024920f8d15550c69535", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052630, "uuid": "7dcc79e0-acdb-4f02-8175-8a959cb4c06e", "comment": "Malware payload (Heodo)", "value": "aa00b91b3e3ce0040d19437889cf3e32a419e226c4bdbb7ad57128c25ac71d7896648ba7b1c902d2a37ae3ddae750515", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052630, "uuid": "3584c834-b31c-4544-b1f3-1a89c9480456", "value": "T16F44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052630, "uuid": "1177f441-8fcf-40e6-92dd-eaa58e3f0ece", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052630, "uuid": "d2b72c8a-a11c-4e38-b69e-9ac90bc7cf82", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBc2ypv:6jIG/pjjuLbJLmGshoCUnWTQpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052630, "uuid": "3f460388-6a92-4c73-8b8e-692e20d1a23a", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052630, "uuid": "9505226f-2813-46de-8482-32b4ed163d9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052630, "uuid": "147f60f2-cecc-4d16-a91d-6b337d82cf78", "value": "9460f8a552aa211a534e561ab084f494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff8b835-58fa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639059184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059184, "uuid": "15f4a6fe-f8cf-4f3d-becc-18de0eab39b5", "comment": "Malware payload (Formbook)", "value": "b9c4352a1f3fca2a7099dabe11ca0236", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059184, "uuid": "2bd5e5b4-5916-40b4-8fc6-7fd015e44215", "comment": "Malware payload (Formbook)", "value": "45df8cea19c2e61209635263beed0231686818f1282c164d30b37de675d5ee23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059184, "uuid": "7eb643a7-6e13-4f7e-8c86-0ccdb807db04", "comment": "Malware payload (Formbook)", "value": "7252d00c2e14e95b7a6ab9916de9162c07be0824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059184, "uuid": "94715151-2cbc-424a-8dea-1472d0a4af17", "comment": "Malware payload (Formbook)", "value": "48ff6d3d2f180286259ba3b0cc58b57d476713bb94035a07e7cbe38fefb41873ce6a333e4f7dd1ac34b3a436a9f77e76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059184, "uuid": "90ae16d1-f124-4125-897a-c1ad571663f6", "value": "T17064237632E1763FDCD7183866716BF873B2E29C507759434B900FC97E2688A945E423", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059184, "uuid": "054b154a-cab3-46bc-a051-799bb9c8ed63", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059184, "uuid": "83116cb3-4079-4f8a-902f-d30b1b7ac0b5", "value": "6144:rGiyw1vhn6RXpWZg4te706OrfE+0UfYLXNcf7lwI8GhXf5yFCemEUxmlD:+w+FpWA701LECYLXNczmI8GdqCEU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639059184, "uuid": "e8dc77d8-0ca8-49ad-acc2-9d593bc6cf5a", "value": 318647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639059184, "uuid": "14c481a7-6c7e-477c-8375-3cd1713a66b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059184, "uuid": "459aafa2-b5ca-428c-9b70-9cfc91cf3c95", "value": "b9c4352a1f3fca2a7099dabe11ca0236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7293a086-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639054168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054168, "uuid": "f9b453a1-5319-4899-9e5e-0a69d301d6ca", "comment": "Malware payload (Loki)", "value": "74522b47aec73a39cf5c5008fab1bb11", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054168, "uuid": "14a551a7-7c6c-4323-ba77-f7b89172c01b", "comment": "Malware payload (Loki)", "value": "46037a1a507f51aa78fe8fd898f5ae731ba8d8ca1da2cdfa20b4590df6a6207f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054168, "uuid": "161ac132-c620-42c6-bf43-4c24966785ba", "comment": "Malware payload (Loki)", "value": "bb58a7848e5ea1f4628e8c5adcb7acbba5c657a2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054168, "uuid": "e915f4e8-5119-4b5f-bcff-dd283163492b", "comment": "Malware payload (Loki)", "value": "d058271b39506157edb59bd12419bed2c2bd850d463faa01f2352cfecd78b4ad7bef55a1201ac8264e34f0f47c6e3473", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054168, "uuid": "ab81d853-ea95-4e05-9764-713175f963e6", "value": "T1343412B47199BFD7D0D465374AAA0032157AFC5A44293B2AA8A135CFD33D6FD20E8723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054168, "uuid": "c646fb15-d002-4477-8644-5ac127d15b0a", "value": "3072:iLHZXYvTV1UVWqYW0suCNnaH5mejx2PBR2cc3i1jc2bAeAFjV2HPKikvss9gTpW4:SZXYsWWrfeErjc3ihFbApOFmss9epW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054168, "uuid": "e5f30531-6120-4d81-a39e-4c9d992e257a", "value": 234376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054168, "uuid": "5586b490-dfe4-41e2-b83c-892bc6664bc0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054168, "uuid": "2d9f7ff9-0933-4981-87f3-553604b5984a", "value": "PO-21JI0081.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08366bba-5889-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639010611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639010611, "uuid": "380142cf-e56d-418d-87c9-0d5d7a4b372e", "comment": "Malware payload (Heodo)", "value": "26e59759c3bf065bc33d8b2ffa4cecee", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639010611, "uuid": "a0da7715-86da-4691-9c66-77cec7a3ddfa", "comment": "Malware payload (Heodo)", "value": "46083cb9cdeebdfa3c713a5f7eacd4e580c50530eac15c4f9b5e80f8b9ee34c9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639010611, "uuid": "2a9caa9a-7c73-4a4b-8f90-8d457ca08ae0", "comment": "Malware payload (Heodo)", "value": "c1f05912216fbd83c01fb9873a6e41c69ca6533d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639010611, "uuid": "7bfa9434-219f-4e61-b033-e3d062c5a9bd", "comment": "Malware payload (Heodo)", "value": "0e304dc3c246ef743798313f28f8295cb0e5f5012f82052532340d75d559be3482604caec97fedfe3a7168a90cf10974", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639010611, "uuid": "7078aae2-1871-479c-bfd9-22933cdc2419", "value": "T10D93F1DBD294EE6EE5E7D438D5BBA0E927728026C1685EC181CDCE8C812C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639010611, "uuid": "5617029b-d2c0-42b8-a16b-68ed14744d8b", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySQ:Gp4Z3MYeGt9sLBrGrSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639010611, "uuid": "58ca0e29-1e56-4849-80c0-25263751c050", "value": 90141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639010611, "uuid": "c3ffce5a-85d3-4a03-b919-eaff8489fbea", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639010611, "uuid": "27425b62-4ea1-41a3-bd3e-244b8105b980", "value": "emotet_e4_46083cb9cdeebdfa3c713a5f7eacd4e580c50530eac15c4f9b5e80f8b9ee34c9_2021-12-09__004319207393._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a43dcf3-58d1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639041645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041645, "uuid": "9569f9b1-2656-4c9d-b4f2-f76320565981", "comment": "Malware payload (Heodo)", "value": "1daf951f1c170a23c5fa03290fa11d01", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041645, "uuid": "c1f488b0-f77c-43c5-b392-9829ddf1aef3", "comment": "Malware payload (Heodo)", "value": "46d3270920be10e8b16199ea9093ab8badaa221f293e9cb6d22ef63daa518625", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041645, "uuid": "04058551-0728-4050-a959-8415f63e9a4f", "comment": "Malware payload (Heodo)", "value": "0378cb5ad625b770f0829502ec1aa59840a952bd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041645, "uuid": "d04f8daa-20aa-485f-a81d-f826091ac92a", "comment": "Malware payload (Heodo)", "value": "09c00d1893466ac95a1b22c2918046c44c089fd4e599505a0b74aa958ed35b0e38557354f86bb83ebb05ebee9406a560", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041645, "uuid": "dcb6debd-0d2b-43fc-af42-7571604fc0fa", "value": "T1AA9302CAD6A5DE7EF4E6D038E4B7A1B97723C037C0581E82918DCAC8812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041645, "uuid": "16af6eea-a723-43c3-88b6-88378b63ce80", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3d:psXZ3MYeGt9sLBrGrQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639041645, "uuid": "bcb7ed0e-8ea2-4f58-98c7-852c53287fd4", "value": 90151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639041645, "uuid": "24025582-7a67-49d3-91d6-0387890d800b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041645, "uuid": "a03d6d6c-748d-49ff-abbf-d5e584a040a2", "value": "emotet_e4_46d3270920be10e8b16199ea9093ab8badaa221f293e9cb6d22ef63daa518625_2021-12-09__092022932282._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803c439c-5918-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639072230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072230, "uuid": "2d63a431-04d8-4eb4-9f1e-e44f4028fe66", "comment": "Malware payload (Heodo)", "value": "ebbeb7075bf5f6169495f440fbec3d33", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072230, "uuid": "e2c22512-a790-4582-8c1b-9f3a93f0c679", "comment": "Malware payload (Heodo)", "value": "471d38656568ac1c23387d4369b08e4743eb971d371038285f110cf18ea1fe50", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072230, "uuid": "5d4586b9-3399-49bd-b7de-d411b6126140", "comment": "Malware payload (Heodo)", "value": "2d86ad1c0847481f934e68166fdb793cb98f1ea5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072230, "uuid": "11a2273f-8f02-43c5-a59a-1a5c2d94dcc0", "comment": "Malware payload (Heodo)", "value": "4e2b88c8eb9ecf72909af604cc44d51affca761616a1a78282c1f317f2d6a6543115f81773399cfe1afd8ca4c35d53f7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072230, "uuid": "04c06e3c-655b-41ff-ac6e-589a1d97d521", "value": "T12744BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072230, "uuid": "7392a88a-8852-41c1-acd4-b465cc7cb950", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072230, "uuid": "780e08fc-d223-4614-88a0-770ee1b5f358", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBL2ypv:6jIG/pjjuLbJLmGshoCUnWTxpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639072230, "uuid": "c59a6735-9e7b-4562-bfab-574c9242e0c4", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639072230, "uuid": "89880757-1ce5-4781-b8e3-77ea193a57b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072230, "uuid": "c51c75b2-6f90-4556-a7bd-193a4408ed49", "value": "rLr0sPwKyxI.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f191429-5884-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639008716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008716, "uuid": "2e60ed3b-1f6e-44bc-b77d-9a8df87babab", "comment": "Malware payload (Heodo)", "value": "ece37ba9fd36e0a9d39f753e9c2ef292", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008716, "uuid": "5f7a59ee-18bf-444b-9c19-0cb291cf2401", "comment": "Malware payload (Heodo)", "value": "47680b354b7d288e6305af2f54ebaa5b202b744a46a666186d33a50c7149a614", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008716, "uuid": "2edd2cf0-a618-4b43-89c3-acc8232393e1", "comment": "Malware payload (Heodo)", "value": "86c3c1e6b330f6534e0282a344ed7c2ffdf33709", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008716, "uuid": "94c55538-5868-4717-893d-ab97668f1af0", "comment": "Malware payload (Heodo)", "value": "cb6be0d5ab4d81031e3b5ceaf42d337e7351eac41e7c55158b8a6e94e2902a184e046518afc3670cdf4474dd4157d3da", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008716, "uuid": "c01e6217-ca42-4137-9b91-4bcc569f5c52", "value": "T15693F2DBD394EE6DE4E7D438D5BBA1E92B728027C1685E8181CDCE8C812C5C657F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008716, "uuid": "fc40f49b-1cb9-4ffd-bcf0-8dab73b41551", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySK+:Gp4Z3MYeGt9sLBrGrSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639008716, "uuid": "36209c82-c25f-4635-958d-a77b3690fc6f", "value": 90143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639008716, "uuid": "2b5060f7-aac8-494c-9306-56b3c479cdfd", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008716, "uuid": "aa95ca2a-ab25-4b45-8f09-71860126f824", "value": "emotet_e4_47680b354b7d288e6305af2f54ebaa5b202b744a46a666186d33a50c7149a614.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb52c0d5-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639054371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054371, "uuid": "3ad5936f-0f1a-4684-aa60-5cdc1ef5183a", "comment": "Malware payload (SnakeKeylogger)", "value": "d6b2d40e9e71b204130f527619b47f7d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054371, "uuid": "fd246425-d695-498c-97bd-bf0a01059f5c", "comment": "Malware payload (SnakeKeylogger)", "value": "47afa640b4d70224b3a37e4c06e3abe3f6aa7fb618cb0abd38a32b9c8e7fae90", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054371, "uuid": "ba4ca93f-b2fa-44f6-910f-85638a4b6e4f", "comment": "Malware payload (SnakeKeylogger)", "value": "d56cf955b97b4203bce62bf64054370a33b608c2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054371, "uuid": "ff266732-9cd0-457f-b76b-3464223f6a64", "comment": "Malware payload (SnakeKeylogger)", "value": "97c7389af2adaf76c0ec7ff88997612e10c35320c76722c4b507d23123eca439ace6ce2220e4d1c6dee038599d063b0d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054371, "uuid": "068859b0-e7ab-4731-8436-dd0e773fbdc7", "value": "T1543522191AF0A42FE52D47B5C797C0618F7DF00B2D62F376588221FDB63998AA903B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054371, "uuid": "6206dccd-27a6-46bb-b2b4-2a9ed6e450e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054371, "uuid": "88ef6409-81b8-4f5f-a941-fa1954166505", "value": "24576:KIKjy/SYCpJzljkEyIdet8BtPPAp5pVAp8zHEdW/FAzet7aFjeO6:YjASRiEyIQYPQO+DEdWSJEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054371, "uuid": "2c3e1138-73c0-4184-a056-8328b3a05a65", "value": 1151488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054371, "uuid": "a0de620b-ab02-4e6b-a890-f0ce2a7c200d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054371, "uuid": "2acd56da-dbc4-4973-bc3e-e232470198f7", "value": "DHL DOC 74653898.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d80825a-58ca-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639038564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038564, "uuid": "ca3cae49-1074-4336-a087-a88853ee629b", "comment": "Malware payload", "value": "f145e181a2d08af5ede2e722732e0648", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038564, "uuid": "bc77f43a-00c7-4699-854d-7ca52e87698c", "comment": "Malware payload", "value": "49295679ed4ec1998dac9dba9840de0b3968dfc2d4bd8289af6f6bb36d576127", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038564, "uuid": "52877c02-fc2a-4b8b-baeb-444e5198a4bf", "comment": "Malware payload", "value": "893501df25390ae7744aca5d4b151dcd11b017ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038564, "uuid": "0627a980-00ca-43c1-afb1-490834e209f8", "comment": "Malware payload", "value": "9884bc1a9d8b859976500c2e087a14c964a430dfad12c65f9eab50b2716c4d5db70d79f617a06168193aee16ef066224", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038564, "uuid": "9ebad0ab-b81b-405f-89d3-5090eac0b6a4", "value": "T1EC75003BEB55B0F3CEC5527098B74E04C553983F54CE96BA12DDBC92CBE210126DD2AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038564, "uuid": "324cc0b5-b825-46b7-be42-aa44e68509b9", "value": "d42a2b0512bb67a6bb3716000ffd4890", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038564, "uuid": "22f22d93-183c-4e03-8d74-4fdcf595d3f0", "value": "24576:Ola+R0xuvJdAwT+6N77ywdnR66QQIHu7Gibt57P3RF3RB4LvpJebMY62b:ODrPAwTn7+wVR9UMt/hsL7cH62b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038564, "uuid": "1e62b8f5-3bf6-4b9c-b82c-7303f087c14f", "value": 1608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038564, "uuid": "20898b44-fe38-425d-bbe2-0e4aca1705d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038564, "uuid": "f8a80263-d8a6-4f85-a119-a3272c3128a4", "value": "f145e181a2d08af5ede2e722732e0648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6686de-591a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639072952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072952, "uuid": "4f001743-d7ab-45b8-b93e-68e877db0809", "comment": "Malware payload (Mirai)", "value": "1b62083907d6851681c0d93a6895a1c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072952, "uuid": "36e85e17-68f6-4aea-aa07-699ea0ad2d67", "comment": "Malware payload (Mirai)", "value": "499843cc604ff293397a60b3a0c219941182a0732b14518a08ce244e4bd2bd87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072952, "uuid": "689163db-e571-4bca-9f93-c11290982845", "comment": "Malware payload (Mirai)", "value": "43e1925f0cc5eccccbfb91a58bb5b7ce854360ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072952, "uuid": "55cd8d27-31b4-4aff-87c5-2d5159859be9", "comment": "Malware payload (Mirai)", "value": "0f85ba6953d7b2c5d5ffcbf3aa3a92cbc50c528bc24e83563387cbbf03c3fb26a1627c380c8726ba9b6d919e50cf0224", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072952, "uuid": "fb82475c-1698-4082-b1a5-502015fc1ff5", "value": "T188D2D025C02D8D76EEAEBF760D9BF6C777909E1E731468910AF0EF026247A90360C6D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072952, "uuid": "56f62474-9205-4235-aa0e-593c178c74cf", "value": "768:m5GBlUiZZy1MAzd5CvQNNMG1EJ9lVKpsOk7t/sA4uVcqgw09I:8G/UizLAzzN71EJMCH7tr4u+qgw09I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639072952, "uuid": "4de70f7c-8e0b-40bf-91bc-c686553f3bf2", "value": 28828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639072952, "uuid": "450ff0b5-be18-4ad4-9a62-bf81b1a42590", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072952, "uuid": "f41c4385-d8f0-4a9d-acae-517b6b0f6fc7", "value": "1b62083907d6851681c0d93a6895a1c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb64a8a9-58ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639052653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052653, "uuid": "63834fec-6c5f-45ef-b4b6-03e0a01deae1", "comment": "Malware payload (Heodo)", "value": "f8f2b3b67ea01763660e2bc1c281636f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052653, "uuid": "4ff854a2-aa12-444e-afbe-78390e7436e6", "comment": "Malware payload (Heodo)", "value": "4a80d176cc2b238c48b8343736a6a62a69498103aab75b53b995aec40af683c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052653, "uuid": "69556910-ed0d-4d0c-b273-af66d7bf8b36", "comment": "Malware payload (Heodo)", "value": "42a32188bb5f0fa3305344b89981a5a90e77311a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052653, "uuid": "6e828e63-502c-4f0e-8f07-beea66c98785", "comment": "Malware payload (Heodo)", "value": "5ad2390eb82eba71e9a9a1215d789defe63a2298bb2fa9c1a4243eff4036442b1c2397ecce1d39ac8e04e3dd4b53274b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052653, "uuid": "8d22d162-4489-4d30-842e-a99b526b2713", "value": "T10044BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052653, "uuid": "68e12061-a617-4374-b7ce-3aea9df469f9", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052653, "uuid": "1e15da24-2d21-4e14-9a4f-23a905a24a63", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBE2ypv:6jIG/pjjuLbJLmGshoCUnWT8pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052653, "uuid": "271a8b79-6eb0-4b7d-956c-1066d420ffbb", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052653, "uuid": "58d5cb04-85d1-4428-9027-0b7a53abfd09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052653, "uuid": "33205ab6-a5f1-4c2d-a8a8-bc0a92861034", "value": "f8f2b3b67ea01763660e2bc1c281636f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774c2989-58e5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639050311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050311, "uuid": "7bdbc31f-c305-49a6-8f65-2d06012465db", "comment": "Malware payload (Heodo)", "value": "623024838e3aec178ffb8b50a3321fae", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050311, "uuid": "b941742c-013e-40bc-84b2-07a00934a17d", "comment": "Malware payload (Heodo)", "value": "4aec6177778f357b4014f543abadd7fec5b5ac8df13e8a4c7c9dcfe1f4458aa1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050311, "uuid": "ea0b10de-9060-4278-a750-c35b3abb6967", "comment": "Malware payload (Heodo)", "value": "c19f49d67f8c780cc348a6246043c9f365919aef", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050311, "uuid": "1c45aa2e-9caa-40f4-8541-9c23ac5cb063", "comment": "Malware payload (Heodo)", "value": "7ed52a25e726b9cb7e234c1c57849369af6b409ee425cc5fda9ef21bce200b82d25c228db4e061287c1e01eb8f347de2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639050311, "uuid": "1546702f-5d7e-4f03-9186-7fd0fac6215b", "value": "T1799301CAD6A5DE7EF4E69038E4BBA1B97333C036C0485E82914DDACC812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639050311, "uuid": "93d3641b-611f-4edb-ad9a-019ccce2055e", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3Z:psXZ3MYeGt9sLBrGrQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639050311, "uuid": "37394a7b-d42c-4a6a-87c0-fd54b588458c", "value": 90154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639050311, "uuid": "f6969cb3-90e1-44f5-850a-c6f0cfa40e86", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639050311, "uuid": "47cc2236-158b-45fc-8d30-1a86388975c0", "value": "emotet_e4_4aec6177778f357b4014f543abadd7fec5b5ac8df13e8a4c7c9dcfe1f4458aa1_2021-12-09__114443687086._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a397a8fc-5895-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639016025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639016025, "uuid": "93385474-bc8e-4ee8-a98f-82514e47020b", "comment": "Malware payload (RemcosRAT)", "value": "ea6d32c5476ad734ccc736eb0eab8768", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639016025, "uuid": "6c799639-11c7-4c16-941f-b6ab7667ed22", "comment": "Malware payload (RemcosRAT)", "value": "4b0e8354f35a2a9b4a8b3da18f36090417f9fd03e4d9d5e28b490bca3a55f9ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639016025, "uuid": "004a99ec-9fac-44f1-8082-32e881e77ce4", "comment": "Malware payload (RemcosRAT)", "value": "e2bf2b055ed2ac27da3b786ea3e3ed4ca8313cda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639016025, "uuid": "7ee8cf59-75d3-49a8-afb6-20231faca588", "comment": "Malware payload (RemcosRAT)", "value": "f8db664992ca5cf4b6de62498a98730bc32fc0e82384d0952cc231896fa1581fc7868e1cfbf4c7b6a023e5bb07a41de3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639016025, "uuid": "04a89841-9e81-47d3-a9e9-3311946fbb11", "value": "T1A565028875D476DFC867C4728EA83D78AA56387B930B4D12AC1B14AC991C847CF358FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639016025, "uuid": "accf4fad-0afd-4636-bf64-1041394095eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639016025, "uuid": "373d3567-ba25-40ae-93ce-972fa7f4f0be", "value": "24576:A0E0xuPOsvtHc2RRML3/r9KJO3WHPzzfDKKq/Gg1ChTs/SyZKGtC45RF:A0lxurFlnMLvr9KlPHDKdp0VhyTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639016025, "uuid": "cfa75277-4e8f-49cc-9442-2b1ab9348982", "value": 1466880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639016025, "uuid": "8195845e-a16e-47af-b564-9eff67e7cc4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639016025, "uuid": "a796f571-859c-4ede-be79-30357236c37a", "value": "ea6d32c5476ad734ccc736eb0eab8768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bdb8f34-592a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639079981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079981, "uuid": "8a2ac464-f065-4088-9ea6-8133f839d356", "comment": "Malware payload", "value": "057e58e9004e00bf1810d17f14e47c36", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079981, "uuid": "7b5d8a1f-af8c-4e50-9c9f-f9a8d9e591ab", "comment": "Malware payload", "value": "4b88762a26c962cc6ccb777bfcc10aefeb82ff82db18c707ae308857ca16c267", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079981, "uuid": "01dc30e8-46e0-4300-9748-99571fa8f3d9", "comment": "Malware payload", "value": "ec7973a56b1a2659a781500ef26c68c1dbbf8303", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079981, "uuid": "d003c157-6c81-4373-8440-8350e8538e9d", "comment": "Malware payload", "value": "8da9cc3ae04fd7696f4a2632cffa40411e88cba9fb6d25b952223388df1430d6cf67024e55d32223726d663fdb9409aa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079981, "uuid": "d6337266-45dc-4648-bedf-92b884dcc23b", "value": "T1A1955A85AA73DA4BCFD95820E333D63948BA21262D1A03B385D9E59C5C3FDD2CAD7131", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079981, "uuid": "cce3d83f-632a-4073-bca9-6f0b1019e585", "value": "9a242c3f2a6a5326096a83352fc74cfc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079981, "uuid": "1d63d667-5158-4f73-944b-170b6cfc207d", "value": "12288:K+It8evAH540pakZ1p/bQkojcsCMSGzrbpNxBZY+yPbZGOV1Y2sIlBFYIc7AlWhi:5ys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639079981, "uuid": "f99e80e1-c92d-477b-8674-46162c67e297", "value": 2023424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639079981, "uuid": "e174441d-2070-457f-a8d0-6f84a9c97243", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079981, "uuid": "42965a57-fea0-4c98-b15f-14191c126909", "value": "panther.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3796ab55-58f8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Stop)", "timestamp": 1639058364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058364, "uuid": "dd5e9f0d-deb8-415e-a333-404975ae783a", "comment": "Malware payload (Stop)", "value": "e7341ec2930cbc22b482724702b30f54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058364, "uuid": "3ee483ad-2086-4783-a5b0-d106aece5ea4", "comment": "Malware payload (Stop)", "value": "4bef75aae931f4dec589397a013befac963cd48a8b1f1fd4958bd52ca3c6a52e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058364, "uuid": "ea86cf3a-7b1e-43a2-93ac-a364f417f64e", "comment": "Malware payload (Stop)", "value": "4fe0ad7f27317443550b9fbea68d86e119dd76f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058364, "uuid": "ed621e4d-6a41-49d9-996b-ac919f70d218", "comment": "Malware payload (Stop)", "value": "a79a0f5c6c343fbf486539ab89c76464e31c72676d7e5fd3c13d933cd2617aa3283a13429af789dfdabf047d2449a692", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058364, "uuid": "c2cde863-a057-436f-9579-ab4e20a291fd", "value": "T19C846B11B980C030E1A302B68E7DBB6245BEBD614B255ACBBBCC0D5D0B74AD1AB37757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058364, "uuid": "e892f0e8-241f-4fb3-a56e-95a939941076", "value": "2ab1d333b32a5ddcb5666272478c2d94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058364, "uuid": "4bf37869-53e6-4a86-a498-118df2b72473", "value": "6144:30TB+M5xLHIjSKlK1Yt6W+a03f1ZaPnqzHxzGvO2uuAGqxr:30TB+VSKlK+t6fayuPchT2vqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058364, "uuid": "9dcc654f-f81d-462e-9152-0ce039498ea0", "value": 388096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058364, "uuid": "d12fa701-a071-485e-9bcf-446b1548160d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058364, "uuid": "001c781d-e6ad-4bd6-be84-253d87c14875", "value": "4bef75aae931f4dec589397a013befac963cd48a8b1f1fd4958bd52ca3c6a52e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5a628e-58cb-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639039314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039314, "uuid": "fa33a0a2-4fcd-4e23-b43f-e7dd10c6e05c", "comment": "Malware payload (RedLineStealer)", "value": "ac558d9c7aa82b913e804e4ea52a089a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039314, "uuid": "a129706a-a81a-4bf0-a933-e17cd2285da1", "comment": "Malware payload (RedLineStealer)", "value": "4c5f33dfc5b678dec5c24fa30988d70edcbca5285708d53856fc219f24370973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039314, "uuid": "b44ef9c0-8592-43ff-b011-cd56fab3bdff", "comment": "Malware payload (RedLineStealer)", "value": "0597a87ca381b096cd2f0445f2058b154e966346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039314, "uuid": "436ebd86-f1c3-4cb5-9014-5e086fe634a1", "comment": "Malware payload (RedLineStealer)", "value": "067543d09718e194de46308d91ab05424af9432cf873cae1a94e23d7f69a0c9db17c30b6ab4a7b022b0b2a1681e64af3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039314, "uuid": "9cb5b594-3cb5-4b51-8b9b-ccc2162cdc62", "value": "T14E65338142EB9F5FC326AEF45C226593427FDE1B2421E5039B971257B268C47FA0E13E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039314, "uuid": "afb412db-2d59-474c-9bf4-87e40ce0f7bb", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039314, "uuid": "8716bb5e-911c-4a37-882e-22975e607d45", "value": "24576:exqch+1x+2Jakxk3SUoozaLVvz/ueHMydTsybIbkEaHNYK3XwFcgJORUu:exphix+EakoorJcyxdIbNaGWRUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639039314, "uuid": "79f4b196-56a6-44c0-9c60-5d54364d2520", "value": 1496576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639039314, "uuid": "ea083939-b84f-48da-b194-b1b24b5a05f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039314, "uuid": "af34b483-e2c2-48e3-b336-7a1c178a9a72", "value": "ac558d9c7aa82b913e804e4ea52a089a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10b5166-588c-11ec-96a4-42010a9c0029", "comment": "Malware payload (1ms0rryMiner)", "timestamp": 1639012236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012236, "uuid": "53a529c1-2b10-4aad-9a2d-914fa8db6504", "comment": "Malware payload (1ms0rryMiner)", "value": "a37bb6cf5c9e586e7febd35a04f40885", "object_relation": "md5", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012236, "uuid": "44b392a6-3c17-4800-a49e-c5955a2bbc79", "comment": "Malware payload (1ms0rryMiner)", "value": "4e1a1db6d3dc39b67666d1e0304a7477fac814e1fbb7068560abc5eab2168c20", "object_relation": "sha256", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012236, "uuid": "abd3211f-9c7b-454e-9acf-5ae17f1b60b9", "comment": "Malware payload (1ms0rryMiner)", "value": "f0fa49ecec870e4932fd763c104571221a32ab17", "object_relation": "sha1", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012236, "uuid": "922ebd32-ec19-4afe-8c72-a9155217a23a", "comment": "Malware payload (1ms0rryMiner)", "value": "df6cd65fea7a9d7bd9f9459ad21e7abf569a4c6ec8c1318d67c353e0dcd908b4a354857b6f6e9ba4c4c56391c7013a63", "object_relation": "sha3-384", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012236, "uuid": "95ba44c4-4439-420e-af9a-0079043f13c4", "value": "T18A1733BE115B3600E7585130790FA316E8EF2A2736536B92A2B7E3FE577462201777B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012236, "uuid": "cfd3fb6f-e7e6-429a-b618-fd7001b5f2a8", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012236, "uuid": "05ddaa56-877f-49cd-bb74-da3825ec5b8b", "value": "393216:JII/JiYLRRdpwG3iCG8LWndob9l7tRnsCDkyY7L7BB5m0:JID64DEA2bP7zs7yY/7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639012236, "uuid": "5b25d8c7-1d51-4e43-a98a-5382fab3dd20", "value": 19086475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639012236, "uuid": "c46d50fe-d874-49d6-a0df-8c62b78f1298", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012236, "uuid": "a0f5142f-3507-4d47-b03d-c1d313c41b4b", "value": "a37bb6cf5c9e586e7febd35a04f40885.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c375c00d-5916-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639071484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639071484, "uuid": "430c4ff0-baf0-4da0-a054-ff41a8d44519", "comment": "Malware payload (Heodo)", "value": "4f74e5d80fd3dcf89a96e870020a38b9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639071484, "uuid": "f35f42f5-d285-4db1-9019-50b994bf817c", "comment": "Malware payload (Heodo)", "value": "4e3c2a99198c29669026c373ba3cff9a3238271504a0a89cf52a7f8c8579cdc1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639071484, "uuid": "b966e959-4280-4516-9249-38a65ace38da", "comment": "Malware payload (Heodo)", "value": "a328f807266c479bc44cc64c5d35cadf25a82e38", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639071484, "uuid": "31578e59-9254-4e1d-8bce-901445f10857", "comment": "Malware payload (Heodo)", "value": "5f84ee60240f20e8571d17d2f2fbb7dbdc5713562c8fab3ba17af054030ce35b8c0bb2f618d41b25893e7012398e0554", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639071484, "uuid": "bfc797f2-dec9-493f-b38e-6b03f635916d", "value": "T1DA9301DBD295DD7EF8E6D438E4B7A0B92332C031C15C1E82628DDA48812D5C797FA2C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639071484, "uuid": "5826c8ae-b770-47c9-b033-23a9b3862659", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbf:yIBQ3MYeGt9sLBrGrBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639071484, "uuid": "f609857a-2aea-4b04-80e8-a21084696514", "value": 90154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639071484, "uuid": "8084f07b-d218-4c80-a4d2-10d9c5e5b1d6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639071484, "uuid": "08b46f06-ef4f-4882-a311-db3ed09107e7", "value": "emotet_e4_4e3c2a99198c29669026c373ba3cff9a3238271504a0a89cf52a7f8c8579cdc1_2021-12-09__173738091402._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a3e49f-590e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639068058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068058, "uuid": "68d165fd-213d-42fe-898b-729ee977c49d", "comment": "Malware payload (Heodo)", "value": "71c8c87d0f9121676b164e201331d618", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068058, "uuid": "4c72acfe-7fe5-43d4-a83a-06446dcb158b", "comment": "Malware payload (Heodo)", "value": "4f44ffd049b3a76216c9ce38ece3241e925a214381ca202ead5b666272965d63", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068058, "uuid": "51bc45e8-a55c-4ade-b0e1-b9e5a47c6c42", "comment": "Malware payload (Heodo)", "value": "75e9d4f4485a02b216ef84aa61dcc05b4dbd2ea7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068058, "uuid": "f30a1b6d-8d16-4559-8a03-c2c71b2c32c6", "comment": "Malware payload (Heodo)", "value": "0117dffe4eb96156dda3caffe707586b8c147752c4c9b7fb37d4c259006d48d1bbe14d88911884ea94ee88b9f693ab09", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068058, "uuid": "df593f70-991b-4b28-8cb2-0f0c29aa9190", "value": "T10D9301DBD295DD7EF8E6D438E4B7A0B82372C031C15C1E82628DDA48812D5C797FA2C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068058, "uuid": "d4785562-5f6f-4522-bfd7-f4c0f161647a", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbsh:yIBQ3MYeGt9sLBrGrBsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639068058, "uuid": "11ff51cf-9562-4d93-aa91-71ed14010b24", "value": 90158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639068058, "uuid": "9083afe2-2d8b-45b0-9604-d77964aeca59", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068058, "uuid": "94131916-280b-44aa-8e56-452173f7f083", "value": "emotet_e4_4f44ffd049b3a76216c9ce38ece3241e925a214381ca202ead5b666272965d63_2021-12-09__164028157779._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc54bf3-58de-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639047238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047238, "uuid": "35e19b96-7b03-48b0-93c9-1645695afb4a", "comment": "Malware payload (Heodo)", "value": "8dfa566fc4071b7aa0147ebf459eafec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047238, "uuid": "90f374b2-f09d-47a2-bcb1-fb2e5953491c", "comment": "Malware payload (Heodo)", "value": "4f75084719fb13cb3c60878e4f587d39f48cca8588f2e10f2cf928b9b89030e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047238, "uuid": "d76285ca-1a58-4518-b7f4-a86a51bd8ff1", "comment": "Malware payload (Heodo)", "value": "83feb461c7e83e328bacefedad5c6c2cf1410058", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047238, "uuid": "ba324220-7950-4e19-b8c8-bc5f328a0119", "comment": "Malware payload (Heodo)", "value": "76996c375d90e9dd284fa5b9b64cf125685b2d7811ef61caabf91f83da0e701be8bebf97e2552fda00ccdff9602f1b0c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047238, "uuid": "5b867fe7-ffa4-4288-baac-e285983c427e", "value": "T19144BF10A181D036E5FF087A89FAD9BE466C76600B80DDDFA398187E4F6B6C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047238, "uuid": "13f2833b-02a7-4775-a170-51a13de7cb57", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047238, "uuid": "c2fc68f8-1e2a-42e3-9e8c-28f38ddb645c", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBMmgL/S:Wvef8+h61mRcHL+rF6l5EAQWTkL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639047238, "uuid": "d9804db4-5057-48cd-9aad-8c9260825205", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639047238, "uuid": "5f4c76d2-c5d5-4339-ad67-52b536a807f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047238, "uuid": "a7c62cbc-142b-430c-b928-4c3e1de254e7", "value": "4pRiTOBGtplAOCKy.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7214909e-58c6-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639036988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036988, "uuid": "d0a9e04f-6b6f-41c2-a642-f4057a008d9a", "comment": "Malware payload (AgentTesla)", "value": "5e23d6bd403ac2f1590d601039470cf0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036988, "uuid": "5f7cc7ed-cc81-4ac7-addf-57a737127bf7", "comment": "Malware payload (AgentTesla)", "value": "4f7e2f28d55a874ee9b71640a4d806ceb347b2028706037ddd37918ec8f864a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036988, "uuid": "c19513d0-209e-40a9-9b73-b3325a1cce7e", "comment": "Malware payload (AgentTesla)", "value": "3f8494d76fe6c208beaed7f340391f8f68868526", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036988, "uuid": "ef9d3d81-e586-4114-babf-594b68b0d965", "comment": "Malware payload (AgentTesla)", "value": "3587cc7115de374dd748ad70e0f2e1ec4a5965bdd94814a6814e4f6463e9b258a83cb2d6b995745a49eb66893748b44a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639036988, "uuid": "61b1e02a-b48a-42d1-b3fb-3938943b9761", "value": "T1612533D2BD7F0244EE54D962FCFCAAC774F0B561A2BEA8C7DE50198D630D320DA94825", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639036988, "uuid": "71196a9d-2ad6-49a8-9291-eb1674def9a4", "value": "24576:9R+bdp25S0fXv4ZELVmD0sMYcYf8SUI43WLsp7OWh9Rq8daN7d:9kf2Rf4ZkUD0/G+/9iwRq8dMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639036988, "uuid": "a96913f1-46d6-48bb-92f0-d427827c294a", "value": 1035259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639036988, "uuid": "afb55029-2fd9-4909-a810-f548db880d62", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639036988, "uuid": "be25b653-055f-4b1f-a015-c7b88e0405ac", "value": "SHIPMENT ARRIVAL NOTICEHAWB R129724.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93800687-58f6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639057660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057660, "uuid": "11fcd75d-dc2d-4da0-8f67-df158534308f", "comment": "Malware payload", "value": "e98fd3d6628962e3bb629f6f1b7f0261", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057660, "uuid": "33535c3a-9282-4363-b4b1-7bccd65a0277", "comment": "Malware payload", "value": "4f8e92e5f0fac4afd0b88785ca81c1ac939c27efd933852414069eedf9b56b70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057660, "uuid": "7d07c02f-44f2-4ce9-bfa8-59ec36374544", "comment": "Malware payload", "value": "a87d0a0a87cafbb5b0bda8e7ad6cc03549cc74e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057660, "uuid": "135422fc-b319-46e9-8f82-f6bd300304d4", "comment": "Malware payload", "value": "4d99a13e7a429a9076c2b8a217ecdfef3b9a85ea624ae98cb15580373c2d5a23ef62a77f7cd300c0678e0ed6d25b5937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057660, "uuid": "66b67e57-972f-419c-8ce9-a5d0cbc3158b", "value": "T160945B5D176C9F32C3AF46B6E0D0990AC3F4909797CAFB4DAC89D8F024467A7B4540AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057660, "uuid": "af501ef1-9953-4806-bf37-0cec1aee1d0b", "value": "6144:XCstw8Ofr0E9mLL1l1HDLzYEmXcXLvlzaP0fet757wqjyheYfEZBL6o:Ss+0LeE9BzaPm657wqehcZBL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639057660, "uuid": "80c1f2f4-f479-41db-8bb8-3d38a8110a20", "value": 446665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639057660, "uuid": "857513fd-e2e0-4030-b9c3-cda0e9fc9eec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057660, "uuid": "c014a871-367c-45dc-9126-5b313bab01e9", "value": "e98fd3d6628962e3bb629f6f1b7f0261.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f729358b-5924-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639077584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077584, "uuid": "0ce9e30b-2340-4a0e-8481-2ff1ece2a1b0", "comment": "Malware payload", "value": "6bab3adb086553b7c3a952d1b739c03c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077584, "uuid": "1e0c9d90-e53a-4c3f-875d-8a19583fd3c2", "comment": "Malware payload", "value": "503c2f39c7b1e5f5e599d58723a086b17b85283bff362197799d33494bbc1b75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077584, "uuid": "8578d494-5d37-4b26-8e74-358ae627c7df", "comment": "Malware payload", "value": "ee6dcf25fe936aeb9504dbb36336435a33739e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077584, "uuid": "728df439-2600-40d4-b81c-d6d95c157ebb", "comment": "Malware payload", "value": "71a7bad0b051b51e2da459cfaf674f584f1720e1f0c468802729092c9788aad528034eba22c29b4c3f894d27468abd9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077584, "uuid": "c295308e-5457-4fcb-af9b-956988016c43", "value": "T11F35020BF3868B21D7D82975C1DF053907F59ECB1A32E3897F09269D6E91327AD84788", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077584, "uuid": "1e7d2307-b43a-4b63-9d1c-6e3da04a62a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077584, "uuid": "95623683-ce80-43e3-b6c3-2015c8bb5a72", "value": "24576:lzTZywyTpLMUxPix5g51QkoPUy3nXhDNV4qjKxfc:l9y/FLMyPib21QVBKxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639077584, "uuid": "48ca682a-27b8-4a17-8a16-6883462e9049", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639077584, "uuid": "e3366d3f-398c-4aaa-a78a-d8076ebf3ec6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077584, "uuid": "e038205d-8ab0-48d6-8ba1-d80922364260", "value": "OMICRON UPDATE PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166daa65-58d4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639042847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042847, "uuid": "08a7abfb-5436-419a-97ba-8acfa8ef771c", "comment": "Malware payload (Heodo)", "value": "5425ad1d8e8154f0d9fe43f87a20082e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042847, "uuid": "287169ee-dfb6-4053-9ff4-265b1dce63d8", "comment": "Malware payload (Heodo)", "value": "5048cc58830b44039d55971bfa5314a0809511010d571ff1763ce09019c23c45", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042847, "uuid": "64f8edb9-c974-47e6-9f80-1d2857a2c74b", "comment": "Malware payload (Heodo)", "value": "e4f4736df0ee3531eb64ceb2c1da5bac7820aa63", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042847, "uuid": "c0282c6d-b9dd-4ac6-8054-f55a27bd7789", "comment": "Malware payload (Heodo)", "value": "3e4e30fc7042d3b24ca32af5d96f255cd0446d9e0eed428c652e4fd7ea2429313772d064eb3e479f8ece45a9ae002ba1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042847, "uuid": "e3948122-0263-48d3-94c1-e47769d8ed0b", "value": "T12D9301DAD2A5DA7EE4E69478E4BBA1B96333C036C0581D42918DCEC8802D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042847, "uuid": "d61e2cb9-61fe-4a5a-a8c6-c284242e9399", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3h:psXZ3MYeGt9sLBrGrQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639042847, "uuid": "104c796b-bcfb-409c-b61d-90aedafbb382", "value": 90151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639042847, "uuid": "0c806d4b-e684-45c9-8e9b-58b68e7340ec", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042847, "uuid": "3f99071b-1956-463f-b24a-8f958145bd27", "value": "emotet_e4_5048cc58830b44039d55971bfa5314a0809511010d571ff1763ce09019c23c45_2021-12-09__094026033016._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b517ff23-58ed-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639053851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053851, "uuid": "6884d4be-192e-4942-8bec-61d19be58b07", "comment": "Malware payload (ArkeiStealer)", "value": "6bc5422016c476a75ba5d0900c5f5831", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053851, "uuid": "376d0e3c-b9ff-4e94-b8ed-ba490b18b655", "comment": "Malware payload (ArkeiStealer)", "value": "509140b1542d083ce4f7700fe6996ccb4be6b67526c7b1892661205aa1a04edb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053851, "uuid": "887fdc02-6b67-4589-bd7f-2f7801a8e2d1", "comment": "Malware payload (ArkeiStealer)", "value": "1c7e5664326f755fdcc1719630f15c397717647a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053851, "uuid": "6432d75e-fd86-4b71-bfa5-bb8217b1b9e4", "comment": "Malware payload (ArkeiStealer)", "value": "2cc12b6ce4f7ce85f0a1ef453ebd0426e5733ce7ce585f8151523db5d3e4238217bc6ed970f76ca51b864ecd29431141", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053851, "uuid": "75a542de-3fa0-4818-b23c-e44333f61402", "value": "T19464AE00B7E0C434F1B712F559BAA3BD7A3E7AA26B2491CB22D526EA17346D0DD70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053851, "uuid": "f91e7f51-d339-4e9f-9060-fff3feccc75f", "value": "1e7f53cbc09c74d2d76a753a16b82f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053851, "uuid": "c783c348-31e7-41b7-8e5a-fe299d11a7c3", "value": "3072:5j0wfyfy03nAuDoGYVgKRZIwPB/x84fq8No1E1zFypBzB0hzhfg9FsGLUiADdywu:IYG0RPxfqJ8z0pRgzhfknib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053851, "uuid": "02d908a6-7a1d-4391-be32-25f00bb33594", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053851, "uuid": "3168c20b-0cef-420f-b4ec-320c37a07426", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053851, "uuid": "a5b826f6-f9b6-42a0-b0d2-7756e06ead74", "value": "6bc5422016c476a75ba5d0900c5f5831.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a4afb0-5936-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639084982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084982, "uuid": "479e453e-6d10-4d2a-938e-af76571746cf", "comment": "Malware payload", "value": "84f0d89c41aa198450c551b715eeec1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084982, "uuid": "41e4b184-6862-4698-8fb7-5dad017d2206", "comment": "Malware payload", "value": "50e40b11c1d866597929f9b8020a644cc0bdbeb7ca12de0cff68ce78d018a50d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084982, "uuid": "a8501cd3-c2cf-411d-9159-1a856f30af0a", "comment": "Malware payload", "value": "a6eb13901ebe55192a224c7ef170892d2f932f79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084982, "uuid": "4aa6ed0f-a1e2-436e-a6d0-cf24b6c66e82", "comment": "Malware payload", "value": "33d6f2cba698a543162e9e0930a409ac7080e5f4a35bcbd3268b7146d143881f9b6883f8b4b420e7f08a8ca75492eba5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084982, "uuid": "2df2f75f-40e8-47e7-80dc-dbc3387b44a6", "value": "T12845BE2337666FA8E53F037150AA44008BF6F66BE730CB9FBED551CD1A91B518627A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084982, "uuid": "57a45952-8841-4597-858d-f095415792df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084982, "uuid": "d0ad17bf-5562-4668-b994-fbc90f596c3e", "value": "24576:fO/uJa4rQYPIIoCtsdcW6+DqI/Fh34flXBY4gJ:cQKCudA+uSAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639084982, "uuid": "93df5404-d691-4da7-90c2-a93bb9fa33c2", "value": 1223168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639084982, "uuid": "52f2b74b-0b54-41ba-8133-aafb987922fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084982, "uuid": "0acac3b3-2013-409b-9735-972cc1262015", "value": "img-098765678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e85ce92-58af-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639027050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027050, "uuid": "f073bda3-3ff0-498a-9934-0d067e7aa8c2", "comment": "Malware payload (AgentTesla)", "value": "2eb5e6d611012539416c1894027ae49c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027050, "uuid": "c82ad553-7536-409a-825f-5632a38f6280", "comment": "Malware payload (AgentTesla)", "value": "5128ece176a7e7751d3f691c40a0d64ef0c0c71226367edc352c7a91b41382c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027050, "uuid": "9fbc6347-4fdc-440b-b424-a43971076944", "comment": "Malware payload (AgentTesla)", "value": "9ab819e2ab3169f6c32bd32effa3c50275f525c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027050, "uuid": "bd8ff80a-68c8-4b58-a543-947b9562871b", "comment": "Malware payload (AgentTesla)", "value": "cca16d206fd17a582ed25565ec6cfb5ddd164bec0f759fa750d953992708108ab7ecbe693c5bfd80bf7eddf3a305e6c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027050, "uuid": "48961cdc-6fce-4b26-bce0-3eb1fb2da5cb", "value": "T1FA35F034EA6B450CE45B32F50F15AD921E2BDEB9C001864A23BEF219457E61BCF227DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027050, "uuid": "def696a2-017d-481b-be74-cb02ed6f8216", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027050, "uuid": "e4178f0f-19b7-45b5-b367-b2649f8a18be", "value": "24576:8drzf1Poa4IUZPb1DtgnfJQKAMMOVOgLszOlizgEGHQx+oF:8Jf12IO3gnuDxOOGizVsoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639027050, "uuid": "85ec99cf-36be-4535-8f9e-9c2368d9369b", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639027050, "uuid": "07ccc31a-2aaf-489f-abb5-b3fba85cced8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027050, "uuid": "3926987b-f4ac-40bc-8f0c-7cbc2ae5a7a5", "value": "060114-2020_001_06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b99522-58e4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639049854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049854, "uuid": "16a41958-007b-4482-ae38-1514375dc8e9", "comment": "Malware payload (Heodo)", "value": "d67f06c787a2d2e014f5e0571024b696", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049854, "uuid": "01d129cb-0645-430e-bf60-7238a30aab38", "comment": "Malware payload (Heodo)", "value": "51d5b7b3141cc6a727d7dec0bff69a5e7d551d279656b92eea68fea27b7cad69", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049854, "uuid": "1e3ad02a-73bc-405f-bb2e-af3df1b312f1", "comment": "Malware payload (Heodo)", "value": "01250c3e5bc47c1024289f85c3ce5f35c123d951", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049854, "uuid": "33ed2dff-2901-40d8-a50a-5e821d38d572", "comment": "Malware payload (Heodo)", "value": "f1b18dbb76a9f3fb5457d68c8762a41fd23fccbbcba0717d4c81710c36d3792395b8710279babb90536292a85223165e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639049854, "uuid": "b43acbdd-eda9-4154-8b3b-73c8d2bde72a", "value": "T1AD9301DAD6A5DA7EF4E69038E4BBA1B97323C037C0581E42A14DCAC8811D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639049854, "uuid": "7b9b8c8a-59b7-4ac7-8863-8cf73b4090da", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3c:psXZ3MYeGt9sLBrGrQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639049854, "uuid": "15107119-5bb2-4d17-a7d3-a6228fca2e7e", "value": 90151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639049854, "uuid": "be083e64-c89c-4795-8c61-1e924f3c3c25", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639049854, "uuid": "9bdc1891-ffca-4d0c-9076-d2252628c178", "value": "emotet_e4_51d5b7b3141cc6a727d7dec0bff69a5e7d551d279656b92eea68fea27b7cad69_2021-12-09__113707145158._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f793cb8-589a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639017951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017951, "uuid": "01b814d3-24d6-415e-92db-1d91f7e39494", "comment": "Malware payload", "value": "920e0710da9bae6384427b33f237792b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017951, "uuid": "4c01727f-8bc1-4213-80d3-6606e1d78ec6", "comment": "Malware payload", "value": "521b4bb91484e4d32a9f34d14677bf54374fe4ac19acb3901f2bcaea36ecc14a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017951, "uuid": "50e8e75f-4dfa-41c6-982e-c5f4d5d3ad61", "comment": "Malware payload", "value": "e8cad7a70d2d79409def70ece857b0e7c6823ecd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017951, "uuid": "4decc758-f8a8-4a3d-a88f-d7d49543019e", "comment": "Malware payload", "value": "4675b1eca928c1c029e5accfadb8eab7ec75f122e54804092a22c42d56830a2cfddee2aa5a03ae947efb1787436114e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017951, "uuid": "e1def805-7f7e-4b0f-a707-ed1446af9b3b", "value": "T1BAC3271276418471F70D0B304946FAE04AAA9D3D5AE4E48FFA7C7E7A29312C31A7725F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017951, "uuid": "9eaf8e5a-9869-41ba-a173-889ffc18de32", "value": "d8130762549d8ab8e3c12e25d2f5f0e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017951, "uuid": "99ae675f-d528-49be-8aa6-72bf1655442a", "value": "768:4Ke6r0NVnxxS6vobyOlWUpN3RdO6jVTBR2r/A7izRGUR/lHJ/d2uoe5N1Eyw0tr7:b3aV2xblpbOUf2U7Y1P/dfLttrIpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639017951, "uuid": "e17a0733-07a5-4101-9637-3f4589bc51b9", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639017951, "uuid": "382037b1-c40e-4316-be05-8878479dc633", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017951, "uuid": "84de40ce-3b1f-4526-984d-c6721dcf111d", "value": "920e0710da9bae6384427b33f237792b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6810fd90-5894-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639015496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015496, "uuid": "8860bd57-b1db-4e69-b052-1a3a55d253a5", "comment": "Malware payload (Heodo)", "value": "57c58df6d68a644209df09e14d40ef1d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015496, "uuid": "8af4cb17-6636-41ed-9324-cdd4fc80de86", "comment": "Malware payload (Heodo)", "value": "5379b89ba605d2f75b84414168c0716ce76d733946fd98ef3b724aaf7df2f6e8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015496, "uuid": "48903f4d-a1c5-41ba-a6e9-28fa3073ddfd", "comment": "Malware payload (Heodo)", "value": "d1f46b65918693f6e4fccf4c925cbdb89cfddc3f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015496, "uuid": "365738bc-9d9a-4cf5-b89e-0dcd0379b6a1", "comment": "Malware payload (Heodo)", "value": "b407fc403623d14c85f1cf05a963f2c2d68d78c6e53bd2ec2559864d2957a663cc8a70e2d8a75bd40826c7e18f7c080b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015496, "uuid": "348c1852-6aed-4e01-9112-5e7a591a6e7a", "value": "T1A093F1DBD294EE6EE4E7D438D5BBA1EA27328027C1685EC1818DCE8C812C5C657F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015496, "uuid": "b543c46b-3c5e-412c-ac30-189078bc12df", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySN:Gp4Z3MYeGt9sLBrGrSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639015496, "uuid": "fe138386-57dd-4d3e-84bc-16867ce7ec0b", "value": 90142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639015496, "uuid": "0b8098c7-84c9-4312-9b27-f3b63c14b768", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015496, "uuid": "8758c4ad-f0b7-4e54-8221-3e330d21dfdf", "value": "emotet_e4_5379b89ba605d2f75b84414168c0716ce76d733946fd98ef3b724aaf7df2f6e8_2021-12-09__020445051620._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163b2120-58ed-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639053584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053584, "uuid": "c52c4fad-f61a-41ff-a6ea-3799f37a28be", "comment": "Malware payload (Heodo)", "value": "435a44020eb5cd2ca825976dcf6fd83d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053584, "uuid": "82c114a7-0338-424d-b974-ecf408f161df", "comment": "Malware payload (Heodo)", "value": "54450694083b6b9c2fc8c86d6398811f2c4ac6dab3e87faafd892813c9a23a01", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053584, "uuid": "90bea620-a36f-47f5-8b44-4af1d895199d", "comment": "Malware payload (Heodo)", "value": "ead4b81beacad3509e16b368143a5c6dcc88fe38", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053584, "uuid": "c89f0374-56e5-4766-8494-064b93b65807", "comment": "Malware payload (Heodo)", "value": "140972536c9ee81be747122293f20efc99dfa1391a4d969ef01ac7f3e6c081dee185fb129215b5e129cf6ca8dfbc3357", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053584, "uuid": "25798b92-67af-44ba-ad93-e937d6bd9871", "value": "T18093F1DAD2A5DE7EF4E69038E4BBA1B973338037C0585E82914DCAC8812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053584, "uuid": "810a7618-d579-4822-a061-dbb4cd347d44", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3A:psXZ3MYeGt9sLBrGrQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053584, "uuid": "6ae77164-4410-4b73-8ba8-ba89bb41485d", "value": 90150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053584, "uuid": "81740939-de20-444e-889f-3bb1668ffaed", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053584, "uuid": "531ee8f2-f3b1-4c7f-8059-3ba97dfea438", "value": "emotet_e4_54450694083b6b9c2fc8c86d6398811f2c4ac6dab3e87faafd892813c9a23a01_2021-12-09__123916157996._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa088489-58f8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639058691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058691, "uuid": "a9ba0726-f6a3-4c1c-9a6b-67fabe2382ec", "comment": "Malware payload (Formbook)", "value": "3874ddb2eb365e25f05abc9a4d7c4490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058691, "uuid": "7dab89e0-7b09-4945-94e6-e74f6d651f99", "comment": "Malware payload (Formbook)", "value": "54562896613b429de9564f501b6d277537a57dc5d0a9bbaa5260e3ffc055a543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058691, "uuid": "655ff68a-116a-4b8c-a70c-06246329edc8", "comment": "Malware payload (Formbook)", "value": "9eac34cc6b155ffaeb9d31d52b33e9f8b2806ebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058691, "uuid": "466e60ff-a533-42cd-8c08-153268b22e9b", "comment": "Malware payload (Formbook)", "value": "8ca0ddd9c80da8768ea515a5aa9ca4286189960f6807b3f5326a1a8e19f7bd2c46df7cfffafca7192e8fb7929c609ee4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058691, "uuid": "00b43cf3-f327-4207-9ca7-a8ad7909e9d8", "value": "T1BC55233A19E0A56FD4399BF5C3D7D0208B7DF0066D53F335A8E301EE6E38A896542B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058691, "uuid": "f49a8aeb-fdfb-4488-9d61-7ded41df0647", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058691, "uuid": "3a2cca4a-1f0b-4e6b-913c-64909dbf78d6", "value": "24576:+IKjy/SYCpXjY3pLGW8+VMtob91egtQCT36GJjVsD7vNIeB2vbSGG:sjASfjUBGWPmm1egxT3UFIeq2GG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058691, "uuid": "bbb79544-ac8a-4e98-83a0-b5a26023c1e8", "value": 1293312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058691, "uuid": "7d330204-82e5-48bf-8d02-1190d4fa3662", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058691, "uuid": "b1984cca-6b82-4d52-8448-be5d8d90fbc9", "value": "3874ddb2eb365e25f05abc9a4d7c4490.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88125e25-58d7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639044326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044326, "uuid": "70ac33c3-4b3e-4f54-a011-2914ab2f720f", "comment": "Malware payload (Mirai)", "value": "e4d3492cfe60e8bee044c4a5215a89b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044326, "uuid": "6d55419d-2316-491c-94ad-c5de53b29972", "comment": "Malware payload (Mirai)", "value": "547d34e5280d3883c50e2f88916dc9955f2d52ea15f074990ec584119372d66e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044326, "uuid": "369457f5-5367-4e7b-bad0-7bfdd89cad38", "comment": "Malware payload (Mirai)", "value": "49afdf99470c6587674ac7cf5057ec1c47a7e03b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044326, "uuid": "364dc918-544b-4c04-9a38-3f51c2b3b81d", "comment": "Malware payload (Mirai)", "value": "af59736c3c8f72c3fbd10e51ab70ad30e2f3c7d7319ec0fe5b8fee74d4a8036f27173473d16a46007e34fa6a40c721c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639044326, "uuid": "611d939f-d70f-4a02-ba96-28cbd9e1a8c6", "value": "T1CBC2E0DFB49A7985CC1C5CBC218C5AD116B9A2C3234B9F0837503DCDA67605EF4AC8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639044326, "uuid": "b33f5517-f2da-4b34-a271-05eebf970c23", "value": "768:McCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBmWP:3CrJgHiOJrfwmQrctr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639044326, "uuid": "ba06245b-ffcf-43bd-8087-6f2fdf8f0946", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639044326, "uuid": "8433f4d7-7467-4ff7-b0c6-b66f61e6e0bc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639044326, "uuid": "ba73cd6c-eb76-41d7-ac24-8cc73fcd5aa4", "value": "e4d3492cfe60e8bee044c4a5215a89b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2365663a-5907-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639064773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064773, "uuid": "612ca14a-26bb-4f1a-aeb7-009793be5ca4", "comment": "Malware payload (Mirai)", "value": "a0620d14b2e40ab5d089c868276ba0ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064773, "uuid": "dee0b323-ab9a-4f93-9589-007fe1fa159d", "comment": "Malware payload (Mirai)", "value": "5489315cffabbd6cbc60218bb11b91f07fdf821340a96b8d93253347845a8036", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064773, "uuid": "722babfd-d1fb-41b0-a1cd-12e0d357b1c3", "comment": "Malware payload (Mirai)", "value": "f4f6d9e06af6df5270f5f33bdef5b5b48f22bd6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064773, "uuid": "22706a96-b4fa-4da8-9717-4fd50fe564bf", "comment": "Malware payload (Mirai)", "value": "1329713e37bedfb2cbafe7ea0c8d02fcc81a35a7484fa4813bb29c06b2dda4613e4e2f0bc0b62ccd5e78a3f134b6bb66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064773, "uuid": "f85656b1-2889-4ca0-b67c-18952e0f8615", "value": "T166735B24A93A2F26C1D4A17E62FBC321F1F6230E25B4961C3CB60F8EFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064773, "uuid": "bc1a7151-f705-42be-a626-7f82fcc9e0a8", "value": "1536:ubHmkTSo3BOIqS5aq+Dc035R9QuEk6vNNicKzfLFx8:kmcjaq+Dcc5J+vN4FzfL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639064773, "uuid": "d7da4f6e-7987-4ba8-b591-1dfc8c00ed81", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639064773, "uuid": "283bea86-edb1-4651-8b5e-ae2cd443bd9b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064773, "uuid": "7af30dc1-1f8a-425e-992d-09fa9f54eb0d", "value": "a0620d14b2e40ab5d089c868276ba0ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda16326-58d3-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639042778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042778, "uuid": "a3d026c5-7539-4ae3-9af3-848ce87d1da4", "comment": "Malware payload (AgentTesla)", "value": "38420076a842acf77403ae67a15d5649", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042778, "uuid": "5efd3c04-fe76-44d0-8f54-6b4982d62f5a", "comment": "Malware payload (AgentTesla)", "value": "548f0d280806abf706270666789bd6a4b426a09de6688925cee51945e5e886ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042778, "uuid": "50ccd007-7918-4c7c-b64b-48d6e7aaa118", "comment": "Malware payload (AgentTesla)", "value": "2446503cc13ff1a28a697141620cbb88b6064c0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042778, "uuid": "0580c3f0-4fc1-475a-97f1-e401cb8b9871", "comment": "Malware payload (AgentTesla)", "value": "9ec9b568a60a70ff9e205bd98db0335dc3edb7f57bcf8a1e7047c7fbd857e0d002c0b4a48b23e86bd426f05db2f47aed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042778, "uuid": "8557a947-f02c-473a-afe3-1edf37dc4972", "value": "T151350124EAB7854CE46731F40F267D560E2B9EBAD001925A2B7EF254187E607CF227CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042778, "uuid": "5ed0377a-da4a-479b-8c41-b393987767c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042778, "uuid": "b294f616-44c8-4cd7-96c9-3698ac1cd7bf", "value": "24576:w/yYYzBgSwAF7aSJKRri4dBCgmVCvIeUS8gYt6yZ:wKYYdg6+SWndSCeLRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639042778, "uuid": "7611e1c1-1eb3-4767-85fa-67a848c7c393", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639042778, "uuid": "9f59072e-69bf-4b09-981b-c5e8a9813208", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042778, "uuid": "1087da69-7165-41ca-8c3d-cce315067a4e", "value": "PO21571345240826FIRST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab62358b-5924-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639077457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077457, "uuid": "3e44d30b-2f4c-4f7b-885f-dfcafcd2dbb7", "comment": "Malware payload (Quakbot)", "value": "5abb09ba779fc5ced6d44f6d114c38ab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077457, "uuid": "f340e72d-c05c-4f13-aa01-a9be70636941", "comment": "Malware payload (Quakbot)", "value": "55b388ed29c82924c4a014ae1966624d67867c231649cd44f5b207644c4732a0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077457, "uuid": "6cf0eaf4-741f-494d-8377-9ccf76373bb0", "comment": "Malware payload (Quakbot)", "value": "cd68ea1f6acddb14df6106043e29d396315b4457", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077457, "uuid": "c06e43f3-6a2b-48ed-a252-46e408ba2c19", "comment": "Malware payload (Quakbot)", "value": "59f401f3f1c173037def75b8632af4a493eb8a384155721620dc19e4b60bbe99eec3a1e32c9ec6af49c445c0960d436f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077457, "uuid": "494c4f6a-fcdd-4019-9e44-e038c371bb67", "value": "T1B453D05C1119A84EC325583DE60C2EE2D90A2193B412B51E29D9BA542BF72C77FCF1BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077457, "uuid": "647bd902-3bc8-4886-a6a0-9d074a541516", "value": "1536:krwsjZ91vqVmxJGME2Ghdf52lZP3u1AOgeM:w71yVmut2Ght5I+m/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639077457, "uuid": "03e24d75-9e72-4dc6-b123-794416d7dcbf", "value": 62326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639077457, "uuid": "aa8af7ec-2a2d-466e-a17a-819fd342775a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077457, "uuid": "35537136-987b-4541-8275-594c9b4c4d26", "value": "5abb09ba779fc5ced6d44f6d114c38ab.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66bf1e4-58c2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639035438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035438, "uuid": "8f1e3f45-dcca-4866-8559-734e8411b5e8", "comment": "Malware payload (Loki)", "value": "f55cadfd2c9b5f5ec8a0ceb8159f4b2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035438, "uuid": "42aee484-0b2f-4026-b0e2-f04b24d04b2d", "comment": "Malware payload (Loki)", "value": "55b9366bb1a859556942e1779d383ba248d20cfc38c22e65303856ef673fadb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035438, "uuid": "c437373d-03d8-4ba4-821b-a111a3c1127f", "comment": "Malware payload (Loki)", "value": "9f16330a8aab1624fdd6631dc42b6dc71f48964f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035438, "uuid": "79318dab-6f92-4173-8e4f-cc5e136e70c1", "comment": "Malware payload (Loki)", "value": "078990990a25b14a44a93b0ce731ea4c6228d98caabf9b42c6dd3b789258159c91017529f0664070a89641effba37363", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035438, "uuid": "38c05d9a-6a31-4448-a92c-15f657e4c80f", "value": "T16525F130987B844CE49B71F94F11BD520EABDDB9D01296262B7EB229117E207CF227DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035438, "uuid": "2a094f60-b5aa-411f-936f-11552fd1e112", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035438, "uuid": "d57c7a2a-d21e-4ada-b95b-24765965ebc1", "value": "12288:Q38A2q1aJ3OJO8E81U4CJuPI5DWFdlQeKElKdyyrKHktsmWk9UpPHqg6SU72Wg4S:QyjhYnCyyrKHz5pCo4IvmEJW3NY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639035438, "uuid": "61f137d4-6f97-4b2c-b9fc-d2ab4dd532e3", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639035438, "uuid": "594878ea-e58c-48bc-b090-dfb666f2d05d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035438, "uuid": "06be993f-0ef5-4ba1-9f9b-f7191bf35348", "value": "f55cadfd2c9b5f5ec8a0ceb8159f4b2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf11847-593a-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639086989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639086989, "uuid": "7ca7c522-4bec-4d73-8ab3-396cc3ff2de8", "comment": "Malware payload (RedLineStealer)", "value": "033bd23a236b70e2fe45c57a9b9a1155", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639086989, "uuid": "e3bfff68-04e1-497d-9dd4-57dd06dc3015", "comment": "Malware payload (RedLineStealer)", "value": "56125010c5571fa10c9eb077f5620108f9dae9d5aea04880bfe8ee2a112c3c13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639086989, "uuid": "7b8e7b94-be0c-405e-bdba-2e8076c2fc8f", "comment": "Malware payload (RedLineStealer)", "value": "cf55475105cf32e3fb63d70dda18b7cb8d794041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639086989, "uuid": "5d9f264c-8900-4346-95e6-cb8b1483853b", "comment": "Malware payload (RedLineStealer)", "value": "b451687ba4ba96a705f9b61373deb5fa35e9ddbe02213a6bd2eae295b226aacf93a59ff87fcc89ade50c0ed4f4ea34ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639086989, "uuid": "9b5af657-3c83-4212-acba-055ca4c09099", "value": "T16225AE24AE1090A9D4370DF898E9B5A3CA283D2013F595DBAFF93D291B747F18638747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639086989, "uuid": "dfc4cf36-4a82-4916-849b-fb145c9cfeef", "value": "9f1127f86499f6cda40cf38ebb837b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639086989, "uuid": "1c97a0f8-af52-47fd-9e84-eae3b92b60a0", "value": "24576:6LtokH5b1+MjP0xr4n45uLegeRAllZd1icyXHiizrIE:5u1+MjYv5uGCAHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639086989, "uuid": "977c186f-1f48-46cb-b1d1-0be1e04c1f67", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639086989, "uuid": "71058b93-a89d-4ccb-95e9-ba79af591609", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639086989, "uuid": "c9fc5f50-8962-490c-9130-638da671d451", "value": "033bd23a236b70e2fe45c57a9b9a1155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acca609-58cf-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639040922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040922, "uuid": "6c099928-8fae-4daf-ab48-af30bf848901", "comment": "Malware payload (Heodo)", "value": "f22b715e56824cb2a1b5793e43ebba45", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040922, "uuid": "82842184-b11d-4b82-9ab5-5d4aa6d0f476", "comment": "Malware payload (Heodo)", "value": "56ed63196edb02c3a0378e3806f481a2dea73ebf30edb11681474182a7732298", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040922, "uuid": "986dba42-4c2f-49a1-9f7b-d74667268109", "comment": "Malware payload (Heodo)", "value": "45eba1eb105d2e5485bbe6262abac1d62b5a2800", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040922, "uuid": "2a4f1f46-70a6-4fb8-b844-91031527c7df", "comment": "Malware payload (Heodo)", "value": "16ddb143cef5e99d303bc317952f63ded4bdf49c0dc19179c333c07b95915b7d88c68bc8cc84f58baa00d4c206c491b2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040922, "uuid": "a7d70615-02d5-4d7b-8a8e-f79994fc90c4", "value": "T1759301DAD2A5DE7EF4E69438E4BBA1B97323C036C04C1E82914DCEC8812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040922, "uuid": "da80dfed-b9e6-45a5-9b7c-80cde3acfcb7", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3U:psXZ3MYeGt9sLBrGrQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639040922, "uuid": "b31a23d1-e590-4288-bc66-9300567a7155", "value": 90152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639040922, "uuid": "ae3e8e8a-0e34-4e0f-bbe9-c8988eb9ff84", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040922, "uuid": "896d0c2c-f951-4882-8a93-554b008904f9", "value": "emotet_e4_56ed63196edb02c3a0378e3806f481a2dea73ebf30edb11681474182a7732298_2021-12-09__090830058706._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a9615f-58eb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639053103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053103, "uuid": "46ce8539-aef4-415c-a5d8-136900090615", "comment": "Malware payload (Formbook)", "value": "c37b42d5f74fb1e7e1252f9243734539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053103, "uuid": "373548d9-d78d-495a-9fbc-2b9afeea177a", "comment": "Malware payload (Formbook)", "value": "570739eb4eabb01d3d7c22c895a5a86153ceef2b54d32a651a12869b33b78015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053103, "uuid": "ede35f0a-1796-40d4-8acc-96ee6852bce0", "comment": "Malware payload (Formbook)", "value": "329618a40af23cdaff5aff3178b90bd43faaeed4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053103, "uuid": "3abd91eb-29d7-4276-aa18-942aa60b06b8", "comment": "Malware payload (Formbook)", "value": "fe819dbf2f1c578e6de5c375fd477e39b4385d437b4eafa9bae592031618c0dfdc644a1d4f56a08aa8eea4da40d64eed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053103, "uuid": "ddaa3b6b-86ff-421a-9d7f-17cba9682228", "value": "T1F845131D29A0E67FD47907F1C797C0A08EB9F0172EB6F7765C9101EDA778AC89602A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053103, "uuid": "7a048caf-4846-4cb6-aeb9-b3031aa2d2eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053103, "uuid": "bb8f7b73-1d4d-4a0c-bd78-86fa9206dfee", "value": "24576:3IKjy/SYCpRNJNZu9mkqE59oa/jB3nnsdLbuFEh7Y/wajWs1mMY/:HjAS5XbuTd59jjdnnsdLae+Iajrq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053103, "uuid": "01f4782e-4529-4279-b297-6760ac1e9046", "value": 1209344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053103, "uuid": "93b4ced0-f0d0-4fdc-b4ae-3ce2456830b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053103, "uuid": "28b69391-9ace-4574-bd4b-0c58fbb8fa5d", "value": "TELEX BI FOR SHIPMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddcf785-5949-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639093272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639093272, "uuid": "67682f74-83e9-4e2c-b6e9-168fe9017c6f", "comment": "Malware payload (Quakbot)", "value": "4435b75a49ae49b7b86209cbaa437ab1", "object_relation": "md5", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639093272, "uuid": "25c1c326-3e5f-404f-96e9-4878668ee571", "comment": "Malware payload (Quakbot)", "value": "58a777a710434061910e4488c781918fc298bbe766d7301f151568e291100666", "object_relation": "sha256", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639093272, "uuid": "86f8a0f0-b27a-468d-812f-d0ad72066007", "comment": "Malware payload (Quakbot)", "value": "a29e1262138c0a44e96074b2768d54f2d1f8e3be", "object_relation": "sha1", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639093272, "uuid": "78a325db-5084-45df-865c-ca084664e8a6", "comment": "Malware payload (Quakbot)", "value": "dff032310924d22ce76d394d7e17e88446694e89d398c796ddb5164b3d72e1c6e7c7838f1d6fb89331c521a414ad5691", "object_relation": "sha3-384", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639093272, "uuid": "38778e70-a667-421e-bc0f-96f95a79aede", "value": "T14124F10DA83CE89EC72B1431C708AFEB851B5061EDC2B82E65C9394D5955EEB7BCD18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639093272, "uuid": "e8d8d23d-0948-4a83-8f79-405352daa1c1", "value": "3072:1cIcfEIz6t8weEGc33rk590Du99wpFlUz7o8NXKRlzpG7/UQXIqdtKcmIDYPIZEo:1/cfEw6R9537k5WSOeME6rGj/m/58DDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639093272, "uuid": "ee44b6e9-b96c-4d4a-bbbc-dac619bbbef2", "value": 214792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639093272, "uuid": "0090c2ec-0523-4f8d-ad63-9693a6bec32b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639093272, "uuid": "b3e52194-1361-4825-86f4-5973e8f55b0c", "value": "signal-750717482.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55c1372-58d1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639041906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041906, "uuid": "6d830fdc-f10d-4379-b39c-36a29c92a7e5", "comment": "Malware payload (Heodo)", "value": "fba1c809cf4dbbd59b87ed9a64898549", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041906, "uuid": "822be8a0-9758-4f39-a091-2fd002c43f79", "comment": "Malware payload (Heodo)", "value": "5920ca2ab5ee241574d3641947dfd38c87a83b03bc732ae8b7b4dce707d62958", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041906, "uuid": "0739414f-90c0-4fd1-9d97-dbb887f387db", "comment": "Malware payload (Heodo)", "value": "5e552c45fc0f6e204f772519ca383f1c5a6ea8f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041906, "uuid": "340c7427-a0f2-4787-8e13-99a486d4378f", "comment": "Malware payload (Heodo)", "value": "90f103d6e075bce8689e3740820fab59366f746dd9b7b57d8d1f3dd34caab6e6e8cba7674957a94f555453b923eb6a28", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041906, "uuid": "841eb0b5-066b-4ad5-8836-297b485573ad", "value": "T1C544BF10A181D036E5FF087A89FAD9BE466C76600B80DDDFA398187E4F6B6C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041906, "uuid": "f9401d01-4708-4ac6-8f0a-3f0b70665eb5", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041906, "uuid": "3f1cea2e-a381-474f-8043-0c92e8beaf9c", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBgmgL/S:Wvef8+h61mRcHL+rF6l5EAQWTUL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639041906, "uuid": "960ae826-1185-45bd-a220-6c81dfe3d8b0", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639041906, "uuid": "9897c146-3064-4430-b5a5-f2c1aa62feee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041906, "uuid": "56941e5c-a074-4ec8-8f56-9fbf1fa8253a", "value": "MnyOVhqNr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23c43e6-590c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639067241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067241, "uuid": "32c44e92-c8f4-42d4-8ea8-33c3a17532b3", "comment": "Malware payload (Heodo)", "value": "052a722ab1e477118a4c98263cf9ad8b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067241, "uuid": "3529c8a1-3dfe-46f1-ac62-7badf4d50b16", "comment": "Malware payload (Heodo)", "value": "59ae43997778b1ad0ed18ed3ee0bbae13c39ab3bb5625520e994132569dab239", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067241, "uuid": "d9c816d8-a1f4-4f03-9059-48a53fd18f60", "comment": "Malware payload (Heodo)", "value": "c7ce58d8a9c4a8ecb1bd7b6b4fb374c620d94e90", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067241, "uuid": "2480f616-059c-44a8-8d39-a636f5f2a24a", "comment": "Malware payload (Heodo)", "value": "934603dc3e0cc9460b36024db5400865d91e7c32edb4b3fa940a6bd65fdf28cea95d948096e9f7b3d5f711e10307691b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067241, "uuid": "499d30e8-a875-40fe-918f-4c4c1a885c35", "value": "T10344BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067241, "uuid": "49586645-e9d9-4cd4-9f37-ed937981a834", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067241, "uuid": "5849e1c9-e72a-4f8c-ae5b-e158db53cc17", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBo2ypv:6jIG/pjjuLbJLmGshoCUnWTYpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639067241, "uuid": "535eb09e-4f85-4419-8051-987653c4d3b7", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639067241, "uuid": "069bb440-11e4-40e6-94d9-72762584a502", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067241, "uuid": "f0ee492e-0c7c-4d6e-aa68-e46a810964f1", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869dd6d0-5895-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639015977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015977, "uuid": "eb0adff3-cce2-4604-8843-d21aa2f82ec7", "comment": "Malware payload (Heodo)", "value": "3b25d1918e91d77917202e9ea6bc56b1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015977, "uuid": "ea852649-282a-4982-b724-3c8b0d7c6bc0", "comment": "Malware payload (Heodo)", "value": "59b2d3031b08465bf98f55d0744f4ece332d09bb6b4cb53b636793e4152378a2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015977, "uuid": "8163888f-f538-4355-8822-1c51b804d776", "comment": "Malware payload (Heodo)", "value": "35aa5fb136327626aae393c1be3c83cc9d350794", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015977, "uuid": "4ca92607-75c1-4a1e-8dc8-a2afc769e325", "comment": "Malware payload (Heodo)", "value": "37ad52bb1ee0aaceb282ca75f0241c9295fe9608cf8d79386619a7182846f15b50dc8fa7aedb65a051b4fc8951a47bef", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015977, "uuid": "a00bd24e-6f76-461a-930e-fe75770a10e2", "value": "T15293F1DBD295EE6EE5E7D438D5BBA0EA27728027C1685EC181CDCE8C812C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015977, "uuid": "766685d2-0442-4093-9bd4-90271b99e3e3", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySXR:Gp4Z3MYeGt9sLBrGrSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639015977, "uuid": "719de834-82f7-4470-991f-d475f65a43dc", "value": 90142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639015977, "uuid": "ed7ea323-76f1-4a85-a982-8cb2325dbc26", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015977, "uuid": "6ea5210c-749b-4327-9baa-435d1909f5a1", "value": "emotet_e4_59b2d3031b08465bf98f55d0744f4ece332d09bb6b4cb53b636793e4152378a2_2021-12-09__021242618970._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f1e5e0-588b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639011547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011547, "uuid": "89bbc3a0-ff3e-4923-a555-f402b3b043c5", "comment": "Malware payload (Heodo)", "value": "5a1a0037d5ebf191f7503a76083ebb53", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011547, "uuid": "25cee0ef-9011-4da4-b99d-35d6050097bd", "comment": "Malware payload (Heodo)", "value": "59f2eb7ce653823df04080b4b6209138b91b56cfa583f346d7e899717173e5e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011547, "uuid": "614517f2-4e0f-4033-96c4-b450c946234f", "comment": "Malware payload (Heodo)", "value": "2dd355d00bca685bd2331ea4bb7bf5f77d721d6f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011547, "uuid": "c4c6d6c4-da46-4c4b-ad0a-9d5db69c14bf", "comment": "Malware payload (Heodo)", "value": "d48666e471cb840b505ffc389763a150f2c3969558311080dfbc008f2ed504305c7b5652e9ba09dbc2edbbacbc104b94", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011547, "uuid": "95a1f26b-2956-4eda-b550-7114f20ed2ce", "value": "T1E744BF10A181D036E5FF087A89FAD9BE466C76600B80DDDFA398187E4F6B6C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011547, "uuid": "41ced304-cd83-41ee-850a-b7ccb53f3d18", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011547, "uuid": "0d3692fb-6868-4ee3-b390-198e790af965", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBzmgL/S:Wvef8+h61mRcHL+rF6l5EAQWTbL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639011547, "uuid": "16253352-3ca4-4e83-bcd8-2e265ea05d77", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639011547, "uuid": "3397f5fa-8b59-43cd-8fea-cddcda5d0403", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011547, "uuid": "1d06659c-dafc-45ad-8837-4db2e5401a3c", "value": "emotet_exe_e4_59f2eb7ce653823df04080b4b6209138b91b56cfa583f346d7e899717173e5e5_2021-12-09__005902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9486ec3d-58e3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639049501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049501, "uuid": "b1b9e638-7887-4c72-a9ed-0255df92ea9d", "comment": "Malware payload (Heodo)", "value": "5853383853b7f4dad5d68a8acb79db35", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049501, "uuid": "1740ffdd-e441-41b8-a47c-c3b157224316", "comment": "Malware payload (Heodo)", "value": "5a020c775495fd172147770c6d358ebee40450aa5a0d04d4cdff89a358c27fff", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049501, "uuid": "3e59bf2e-eb92-4237-8f55-ada3cbeb95ee", "comment": "Malware payload (Heodo)", "value": "d2e92e9ddf001154345ed44bcd09565ae28cf413", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639049501, "uuid": "69144c68-f5f6-4d5b-8356-28111cd6df63", "comment": "Malware payload (Heodo)", "value": "64b0d690a8625eec375e308d6495333d3c4bc8048d987f9f58095713bfb6ff0f0f634b455cbe4aadb5bd7c0e02df1a13", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639049501, "uuid": "dcef3283-8793-45d0-b17e-827e55135d5b", "value": "T1689302CAD2A5DE7EF4E6D438E4BBA1B97723C037C0581E82914DCAC8812C5C657FA1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639049501, "uuid": "97b03c7a-8b6c-49c4-96e1-e6251b636051", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3n:psXZ3MYeGt9sLBrGrQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639049501, "uuid": "1f73a2fd-d40a-493a-8dc2-79e92c424ff7", "value": 90151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639049501, "uuid": "4fa025cf-5de0-4845-adc3-c8636a9b3d42", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639049501, "uuid": "440e082c-4bdb-4332-846b-e326d92ab00d", "value": "emotet_e4_5a020c775495fd172147770c6d358ebee40450aa5a0d04d4cdff89a358c27fff_2021-12-09__113115507434._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2204a861-5883-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639008077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "12a8c70e-ca29-4f32-9f83-35546d745136", "comment": "Malware payload (Heodo)", "value": "eaede735a0b4ae1e0d464dc6ff548662", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "6b05c2ea-fa4e-4607-b1a1-6b688aedbff8", "comment": "Malware payload (Heodo)", "value": "5a2c289de24c798901d2913f057ab9dca2287b21f66f76890fc04ddbb10c898f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "d3a60db2-269c-486d-8acf-d2fa160c2aa2", "comment": "Malware payload (Heodo)", "value": "62f587341fe39f9900a295c714a03020f4f73263", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "dfab7129-e635-4337-aa6e-f1737e6da323", "comment": "Malware payload (Heodo)", "value": "19b00bf9395ab3dd0b55649a22912d763fe4c3b89751712f4c932da801bf0e4ebb8d6b38384fb102798f472178a734f5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "31eda163-e348-4df6-a63a-32840e65780b", "value": "T1C144BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "9ab8fd6f-e604-4957-a479-3ef6369d32fa", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "3d6a0761-f7da-4057-a07d-77c8a2a6e175", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBi2ypv:6jIG/pjjuLbJLmGshoCUnWT6pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639008077, "uuid": "09467b59-9a11-4add-8ac6-7757d68163fe", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639008077, "uuid": "9c0cbc89-25a7-4409-832c-a8877b82f894", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "3e75eed9-660b-4092-989d-f24d2413e409", "value": "emotet_exe_e5_5a2c289de24c798901d2913f057ab9dca2287b21f66f76890fc04ddbb10c898f_2021-12-09__000113.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ec2cce-58f6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639057637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057637, "uuid": "2321ab4a-2a5c-4c47-b829-4000d976be60", "comment": "Malware payload (Heodo)", "value": "7cf291581a7fef8d1f05cd93f3c49846", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057637, "uuid": "bd64c733-6f58-40f7-9e7e-6011e2145ed5", "comment": "Malware payload (Heodo)", "value": "5a98d20d9bde10572af84cbbce36ffb251d3fd1f4cfddf141320c14b942af8eb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057637, "uuid": "834945d9-2ef1-4273-94c1-470297c14f9c", "comment": "Malware payload (Heodo)", "value": "0dad8d67db359d9521aaa7420e4af601102bc15f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057637, "uuid": "5119ef88-5433-447b-a725-9507baadd0fe", "comment": "Malware payload (Heodo)", "value": "8f05402946199056a7457eba580c1ba6ccdf6ad3ca70cbed127d4908549ce60171c9672353f167713ff8ec79bc462bbd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057637, "uuid": "d8460056-1fb9-4a4a-bb28-6dd105d5efa8", "value": "T1F144BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057637, "uuid": "2ecda631-edc2-4428-b50a-f4ec3c140810", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057637, "uuid": "dc137acb-98c5-49a8-b2c2-c5981a386876", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBO2ypv:6jIG/pjjuLbJLmGshoCUnWTGpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639057637, "uuid": "1742f5c6-abb8-432b-88ab-23f328f596f9", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639057637, "uuid": "c7851c7f-2ba4-40d1-90fb-da67ae5e03b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057637, "uuid": "4727e74f-e9c8-48aa-9d46-b92a6c01e7b8", "value": "ia4G3BQFaMf2FVUd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb408bc-5903-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639063071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063071, "uuid": "fb4cdc98-f1c3-4217-bd44-1c6658a3fa29", "comment": "Malware payload (Heodo)", "value": "3375f4ade7c283ba474a069e626d3d6c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063071, "uuid": "06bac7c1-8bd4-431f-ad76-36caa3f94214", "comment": "Malware payload (Heodo)", "value": "5aee37b45c0c6370d6c4b8046356675ddbe62d8cb42dfcc602bc350600df64e8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063071, "uuid": "6c5ea030-8e8d-4c3e-9b06-22496abd1b35", "comment": "Malware payload (Heodo)", "value": "b42345fe4f326ec4a22b226da0cac65cfa797029", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063071, "uuid": "1bce6e7d-7dff-422a-832e-fc4dd2728125", "comment": "Malware payload (Heodo)", "value": "9029d812d6b4adc335200fad4625308c9380a02fd79811a9beb222f23e85832548b07019ce24103452edbd0893b8fc48", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063071, "uuid": "a5c9faef-e0c0-4b9a-a4c5-cde8134f3f56", "value": "T1659301DBD295DD7EF8E6D438E4B7A0B823728031C1581E82628EDA4C812D5C757FA2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063071, "uuid": "dc80ee00-dbc9-462b-8dac-a0fe40d0000d", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbC:yIBQ3MYeGt9sLBrGrBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639063071, "uuid": "f1053d56-d844-44a9-93d5-7acc666d4928", "value": 90157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639063071, "uuid": "75fa0461-98cf-4b52-beae-c6b3b58359e2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063071, "uuid": "60f80a08-780e-4ceb-a565-da2a36322c99", "value": "emotet_e4_5aee37b45c0c6370d6c4b8046356675ddbe62d8cb42dfcc602bc350600df64e8_2021-12-09__151722676605._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c529767-590a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639066184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066184, "uuid": "7f431848-a762-4c70-9a7e-24c169d9737d", "comment": "Malware payload (Heodo)", "value": "67ddb73769ef322c3fa0133b49c2d3ac", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066184, "uuid": "07cb0aa1-556c-45ea-94d3-5b77ba217dec", "comment": "Malware payload (Heodo)", "value": "5b0eadb028eafbc9bb1285c63f7a0fc68a235c037f04e81324474972367ccfe1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066184, "uuid": "17a149a8-0b46-4e78-b9ad-518865bf59a4", "comment": "Malware payload (Heodo)", "value": "c71538c674a96f645dd76b6a0aaf5b5618564c40", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066184, "uuid": "8566c9a9-5eca-4bcf-ac93-b94941dd421b", "comment": "Malware payload (Heodo)", "value": "c4a0036661a2458d1bd266aca42855490a3fca02fc6a1e9b6b5f835c13ab01c12608491256ce248d12902b52a6d34bec", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066184, "uuid": "9ec36bba-6c3e-4449-bab8-ce75b79fdedc", "value": "T14A9301DBD295DD7FF8E6D438E4B7A0B92372C071C15C1E82628EDA48812D5C657FA2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066184, "uuid": "f6f49c3c-92cf-41e2-9039-dc6b3b87927f", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbh3:yIBQ3MYeGt9sLBrGrBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639066184, "uuid": "426f540c-071f-4e0e-9660-0ddcd0d1bbf6", "value": 90156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639066184, "uuid": "b4f08b74-416c-4806-89c7-2fa10dd534db", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066184, "uuid": "bb9be614-6d79-4efb-bdd7-acc1fdc0b172", "value": "emotet_e4_5b0eadb028eafbc9bb1285c63f7a0fc68a235c037f04e81324474972367ccfe1_2021-12-09__160916339213._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8329b6b2-58d0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639041311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041311, "uuid": "6530604e-f6af-4aa4-bf37-0f88248ec68f", "comment": "Malware payload (Quakbot)", "value": "f36ec621441114f266f03aa1388588b1", "object_relation": "md5", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041311, "uuid": "194eefea-d8c7-4df8-a4fb-5684e5c7f775", "comment": "Malware payload (Quakbot)", "value": "5b0edd0a4ba6f55dc9e1d5f47c91028579996ff2b0d51d89065c9a5cc13feeb6", "object_relation": "sha256", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041311, "uuid": "ad625e8b-2d53-44b3-ae97-71264acabb9e", "comment": "Malware payload (Quakbot)", "value": "5d0d3fa00d8b8dff44992e7d1bbbb03848a7ce56", "object_relation": "sha1", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041311, "uuid": "7067bb9a-7557-4c0e-ab88-ad4e807a02fb", "comment": "Malware payload (Quakbot)", "value": "005e4c1dd3c5d4ed8d3bf50a05b67909635a4352f1cd797862260d25e1fd64505346d9f06be63ed9c88ac613cd5d76fe", "object_relation": "sha3-384", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041311, "uuid": "f928fa49-6028-40c1-af14-833ec2e963fa", "value": "T178A3BF2AB219900AC217543C921755B0E0D4BFA2E70CA5EB68D3AF533F3D9D35BBE845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041311, "uuid": "a2f3f61d-7478-4b93-85b3-a3b199b320c9", "value": "1536:QTj+NHtWI81QLBDcKeQ0gtA/lJxrbRf49SOpUC3bjZRLqQzR:QTj+NG1yVcKeiA/R/DUUi/zLqQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639041311, "uuid": "b494f786-0bbb-4508-a250-342ce464a87a", "value": 98705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639041311, "uuid": "24d26474-53eb-4414-b812-c7f347ed2221", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041311, "uuid": "c9a2e262-b935-4254-bdb6-12ef44675b08", "value": "j-1041562201.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0138d2-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639054102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054102, "uuid": "f9d5d31a-ab45-494f-9b8f-3e4cd2f43b9a", "comment": "Malware payload (SnakeKeylogger)", "value": "2ec56ab80db1df1fb7545db814941880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054102, "uuid": "33d42f8e-220d-4e04-aabf-b1998c403faf", "comment": "Malware payload (SnakeKeylogger)", "value": "5b9631dc68cef927d9e480dddb7309805fa7ae60d992e3195371fc138b43ad48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054102, "uuid": "0cfd141b-38c8-497b-9b9d-d8c3c26df15a", "comment": "Malware payload (SnakeKeylogger)", "value": "57ca60dfc8ac0b0b37a11308a527c133233550a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054102, "uuid": "a6f07b58-b5c8-43f7-a8e7-b9ddb5c81ba9", "comment": "Malware payload (SnakeKeylogger)", "value": "7defb32d77ab7972f5dc3564d36a1574f24a92c1461150ec919e74625d07d410cd81db555b614107a9acbaadbe890bbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054102, "uuid": "7c2820c2-f372-426e-93fd-ac9d0057ed42", "value": "T13E55F14AEE9095E4DC2DD374197BC8354B37BC6B68B4A55C24CA36773FBA9930032683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054102, "uuid": "ce4e7c6f-2ca9-4bdf-9a8d-a7d1a5d3dd8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054102, "uuid": "425b4a3a-3a4d-4daf-a22d-526e10198e7a", "value": "24576:PIKjy/SYCpqCufKxTRUF9jQOkDy6UP/sBdLJ/1ldLhlGbKVn:/jASC1KxTa9Uty6SsBdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054102, "uuid": "8c94550e-7625-4c59-bcdb-08628859f165", "value": 1393664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054102, "uuid": "d1086b3c-c462-4e7f-b161-0fb9a22ba846", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054102, "uuid": "47f6d712-862d-4f00-93b8-e1dc8e251498", "value": "NAM-PRODUCTS_LIST#20220017689322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a585592-58db-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639045860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045860, "uuid": "3d41b54b-ead5-4815-9a5e-110eddaa347d", "comment": "Malware payload (Heodo)", "value": "0f95314d6a4c37a409b7262faf5e2314", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045860, "uuid": "c82f540d-394e-49f8-bb35-d27a59b1f865", "comment": "Malware payload (Heodo)", "value": "5be044e26263b5181b3254962210c92a8dd4b9777a0dd18d8d7e4bbdf4e7a5e8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045860, "uuid": "61957054-205e-46fb-96ec-b01336f213b1", "comment": "Malware payload (Heodo)", "value": "b727e088bde561217f121755b5a8114d60c7e061", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045860, "uuid": "62c977ab-ae74-4349-a93b-886ea3eb19ce", "comment": "Malware payload (Heodo)", "value": "99a14f0bff1ebe48bbea82def0ae780784734673904d0f7b48e43371b40580f9a977eef0ed8883d8114a83eff7c204c5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045860, "uuid": "59c9bf52-c4f0-4812-8c79-37710c190bfd", "value": "T1D99301CAD6A5DA7EF4E6D038E4BBA1B97323C036C05C1E82918DCAC8812D5C657FA1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045860, "uuid": "2b8dfefb-7f6e-472c-9a26-e23ccbaf9928", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q38U:psXZ3MYeGt9sLBrGrQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639045860, "uuid": "cf033b2a-977b-409c-84e9-4978a1bfabe8", "value": 90147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639045860, "uuid": "eb20e0f6-6ceb-4070-b9e9-ead64cf1b526", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045860, "uuid": "c219c522-7ee3-40e3-92ae-217edeb240a8", "value": "emotet_e4_5be044e26263b5181b3254962210c92a8dd4b9777a0dd18d8d7e4bbdf4e7a5e8_2021-12-09__103037384251._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6208c9b7-58cc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639039538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039538, "uuid": "0369fedf-c565-4c77-b66e-2994bc78b428", "comment": "Malware payload (Formbook)", "value": "675ca678b8c8d5b4ddfa26c622d9cfe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039538, "uuid": "9f7eb200-05ec-4ed5-a15f-6518ae583e8d", "comment": "Malware payload (Formbook)", "value": "5e358d7efd59653da3b376bf85ad3657ca8fc74a41272da720e3eedfb4572f8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039538, "uuid": "a9ff7d06-dd4c-436b-bfaa-b4cad69d8228", "comment": "Malware payload (Formbook)", "value": "83d9b55cb76fa74523f5d038dcc1b76fdf1b7a6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039538, "uuid": "dbbe60d8-0ebb-4fec-b6cf-a955e629e676", "comment": "Malware payload (Formbook)", "value": "937bce9cd203dd93d33df9ffb4ae432e12e644ed50a7b3f1527df3d7e1ed22b280f7474aa06fc8c984031b4ffc9dc5aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039538, "uuid": "bdbf01c1-771e-49fd-b249-9fa06414b3e9", "value": "T12C52181BF798C33BD5BC473557E200002739DB235C63EB691A8C60BA6B5736886A3397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039538, "uuid": "c6cae521-dff9-49bf-a111-e5622ba37505", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039538, "uuid": "4a4e69ea-1f94-441a-a8b0-4079644819da", "value": "192:9jngmuuuEl1AYgB37JkPhHtZXDbfgLsni+WdOCzctx0juW2BFo:9gAdqYQeprDLhnAdZctxo4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639039538, "uuid": "908eb231-f64d-456f-8f5f-68a8bd3053f8", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639039538, "uuid": "21a8486a-2e3a-4b1d-a7db-de9096bf9972", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039538, "uuid": "70a43ee4-9352-4acb-9104-be33fd6b2e96", "value": "Wrong Remittance to US.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbe77f5-5894-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639015506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015506, "uuid": "e3f1c303-e5a2-4a44-b74c-e250afcbfe6a", "comment": "Malware payload", "value": "f81a8b22a829e3a6090debc48bdb8db4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015506, "uuid": "141182cc-ba3a-4e7a-8d3a-aef8ce2be3ea", "comment": "Malware payload", "value": "5e63e8976f6d42d2792b5d832cb7fbe80beb67178020a419eeea238fcbd33d5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015506, "uuid": "27541d80-60aa-4763-8904-36efd6955006", "comment": "Malware payload", "value": "c16c811116b22991025b91017a048ce4e85b9d77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015506, "uuid": "7c5ce110-d00a-4d5f-8fc9-3a1eedd6a250", "comment": "Malware payload", "value": "3cd1198f095441cbd9a2df94d8d650ba4190a13786d08f6d39eee776d859531ce4d9928122308e3f08fb5c395c0c3b53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015506, "uuid": "adf203ec-52cc-44ae-baf7-0879e8f539ce", "value": "T15CF423BE46CCD6AECACB0DB65435D4F6B5014C9F9615082B7FF430E28FB90653A22758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015506, "uuid": "3b4c66fa-031a-4816-9762-5272d94361cb", "value": "05f178c4fb733f4d3010bbfa773de3d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015506, "uuid": "4f656b32-f112-4e7a-b712-30261dbf0b87", "value": "12288:NaKNV6AghfAYVgdjtATnYjgdfPhAuN7crwHWybHz1vLJp9TpRbHzTVZ0rtH1oSW:z6mYVgiZCwHWyHJLJpVbHzTMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639015506, "uuid": "29b231ef-a9b9-4f5d-9f0c-b8b8d77ab3e3", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639015506, "uuid": "6d5607c8-35ed-4f25-a4fa-02eb9667fe03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015506, "uuid": "0ce6d1aa-9d7e-44f2-b91a-9688a5da0ccd", "value": "PatchTU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2251ea6a-58d1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639041578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041578, "uuid": "ee3dcd2d-62c5-4b02-a20d-3b97cde4d217", "comment": "Malware payload (Heodo)", "value": "5c74ad8d79e18d5126e7d27203d633ba", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041578, "uuid": "7f792a24-734d-4b03-ad54-b515875d2109", "comment": "Malware payload (Heodo)", "value": "5ed89b15568f9be6e1c8daaf92d08b06e13c54e4c7e3266130aee1f41d7f6b98", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041578, "uuid": "769d5ca7-da50-4a76-acf0-310861129374", "comment": "Malware payload (Heodo)", "value": "82097e7106651f8cca82dcc14dc9b542fcfe25c5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041578, "uuid": "f450ef8a-5ddb-4705-9fec-2380bec91a6f", "comment": "Malware payload (Heodo)", "value": "e6590cec7c82e2c4c3165506e37f43e3db72c8cd24cc6233a9e2d02666812954e6db0486158714aec22c670b5237b06d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041578, "uuid": "72f4ad27-fe4e-4593-90da-3b79f80ad6e9", "value": "T15E44BF10A181D036E5FF087A85FAD9BE466C76600B80DDDFA398187E4F6B5C1763059B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041578, "uuid": "07ac84b9-b264-4bfa-8fcf-18e32620a142", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041578, "uuid": "5720f731-216a-482f-acd1-133d0e0d49f1", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBrnmgL/S:Wvef8+h61mRcHL+rF6l5EAQWTTL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639041578, "uuid": "2b2bc362-040f-49cf-98f2-04f0742c547e", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639041578, "uuid": "0e76bec0-0f95-4383-a0c1-fc2bc03b785a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041578, "uuid": "b5c42bed-5292-4563-bb48-b4f262e80989", "value": "vP.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8824f18-58f4-11ec-96a4-42010a9c0029", "comment": "Malware payload (SystemBC)", "timestamp": 1639056916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056916, "uuid": "90971119-fd59-442e-8fec-0fe93181301b", "comment": "Malware payload (SystemBC)", "value": "a81072e83ab01de6da91b58215ce1a43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056916, "uuid": "5edb3fa9-f822-46b0-bbe5-fadb1ec8137c", "comment": "Malware payload (SystemBC)", "value": "5ee310ba8a5457718b5c554943914d39d820abf6af3ce7ca087d3441ee089662", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056916, "uuid": "afda3df9-ce18-4592-b396-c9621f84b7ad", "comment": "Malware payload (SystemBC)", "value": "9f0fffe9e612c2f1f0e7686d323975e607174ad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056916, "uuid": "8ea2b676-a6f3-40c7-86e2-c5fd2809e6a0", "comment": "Malware payload (SystemBC)", "value": "65bcfe25a270ec9fdc43188ee3e0baba09dbcb5d3294940c47ed3a36476dbb5c1c29b5bcaf679c8a3053e649b2182c39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056916, "uuid": "c4cd0d42-2e15-4a59-a14e-24bca19a1114", "value": "T10E749E00B6A0D435F5B716F85AB693BDA93E7EA1673490CF12D426EA17746E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056916, "uuid": "e728b2d9-ff72-47c0-8875-3174eb15daf0", "value": "d9d9fc0ee02596fca6336fbe79f431ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056916, "uuid": "2135df7c-6dab-44bd-b146-85a38398864d", "value": "6144:V92QmCXB9h0Byr3YrFektOgYK9L4Pn/TLRKF:VLR9h+yr3YpektOlK9AnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639056916, "uuid": "4124644c-3a7b-4d4f-bf85-96ed9435f9ed", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639056916, "uuid": "f3938443-66eb-443a-a29a-e08aa40c6f04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056916, "uuid": "e13f149f-7716-40bc-a9a7-69904867062d", "value": "a81072e83ab01de6da91b58215ce1a43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830c2180-5910-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639068799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068799, "uuid": "c995f9f6-4391-48cc-83c7-23a0fb2945dc", "comment": "Malware payload (Heodo)", "value": "29b1e78ec90a88572571de4e76289596", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068799, "uuid": "297f0b2c-e624-4767-bd49-cc04f3be09b9", "comment": "Malware payload (Heodo)", "value": "60070dc681a9f7c4a79a3637402a55b5c3e8fba4a2df0ce681f0b1ff311a360a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068799, "uuid": "639e7e01-5fb3-4771-b125-6368a49b7a3c", "comment": "Malware payload (Heodo)", "value": "01589dcfecaa3ac142938c7f7208a8071e90455f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068799, "uuid": "4468adea-7f1f-42be-bcec-5c1ac848321e", "comment": "Malware payload (Heodo)", "value": "ece1aa4eb7e09bd7e1e87dca0a3f1f8c80a2312eaa4278d440dea01cffee9cbae75412c05ba78350ed124364837b0504", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068799, "uuid": "43cfa576-0628-4a77-894f-fb6faf321326", "value": "T1019301DBD295DD7FF8E6D438E4BBA0B927728031C15C1E82628DDA48812D5C757FA2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068799, "uuid": "672cc796-02e2-4b0f-99c7-04bf3d4e2347", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbc:yIBQ3MYeGt9sLBrGrBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639068799, "uuid": "6065f621-edaf-45be-97af-2ac2936931b5", "value": 90157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639068799, "uuid": "2f99f350-c473-4fef-b6ef-210e21949832", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068799, "uuid": "01bb165e-503a-4124-b474-4020ee3de9c4", "value": "emotet_e4_60070dc681a9f7c4a79a3637402a55b5c3e8fba4a2df0ce681f0b1ff311a360a_2021-12-09__165249667144._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258f95c6-58dd-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639046738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046738, "uuid": "d31437f1-cd27-4d71-9ce6-72320e7032da", "comment": "Malware payload (CoinMiner)", "value": "281c466f8a75fcb08dcc845037e0be36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046738, "uuid": "d490437b-0be6-45a1-bddd-3edd0bc7e84b", "comment": "Malware payload (CoinMiner)", "value": "60a6c54a1f1b186f9d9aa6404fa500f1f8d3358a20520a49ffb0b6d05c6376b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046738, "uuid": "a81daaf6-b79f-462d-9729-bc41755698c7", "comment": "Malware payload (CoinMiner)", "value": "9e74ff01d00e68bfc67e32ad5f5b6b6fd1aadc51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046738, "uuid": "5c2050d0-1716-445f-9810-1e0d14becb92", "comment": "Malware payload (CoinMiner)", "value": "617fe3dbe3a607a1345a55053dff6c4811ec0ab574aa4dc94527cfb1b008dbbb7e9565a3d15542d1ca9ec843a358bfd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046738, "uuid": "1a4519af-1ed1-4c71-988e-8953f9e53ff1", "value": "T17FF533A9BA1BC0B3C03507F9541AFA6E264E3D79F4E989EF64EE2583591F6C21D01037", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046738, "uuid": "6a293b93-86ca-4787-8891-55b55a06dd4e", "value": "8cd46bde02e59ad820549e317d49d8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046738, "uuid": "2c5bd35f-8520-44f7-9eeb-c8a4a65f1337", "value": "49152:ka7HeBx9rdSzARHXOFbGcnXWg9nsu9fZkC2GaYBojAzEWaJJz1W4Jwx1S8g4:k7rdSUHeFbGIBl9fj2GaZqTYFXwng4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639046738, "uuid": "73cf210a-d9d9-4ede-aeb2-18b06c49f587", "value": 3414320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639046738, "uuid": "5a95a73b-dc05-4fd1-9d4c-69331d79af9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046738, "uuid": "b90bc729-f0e0-4177-8499-02fbd8509946", "value": "281c466f8a75fcb08dcc845037e0be36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f91b860-590f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639068283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068283, "uuid": "ff016f12-3c3a-4ef3-90d1-ff62db23b712", "comment": "Malware payload (Heodo)", "value": "d67193e7b4806640105a117a020ab6b0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068283, "uuid": "9bf4ddf0-89b3-432e-b9c9-14059ef1d0b5", "comment": "Malware payload (Heodo)", "value": "60b238f32cb7814cf644f6b8d9d6d6576462b0b5ef10c03d608181ac88fe57f6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068283, "uuid": "7d02ff51-f122-4c36-90b4-ff19fc4c63d4", "comment": "Malware payload (Heodo)", "value": "fdf3b9a1c83e68cc0dd69c80015822a044cbdc5a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068283, "uuid": "220b463e-1526-49f8-9850-9132f86c12c0", "comment": "Malware payload (Heodo)", "value": "1f4ef274f9b2d9c3a3376793f145ca76cbab777230e40e631302b2652c6ecd6f93066750c5acd3b90a31e09cb7744416", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068283, "uuid": "daa8c3d3-f182-4e3c-b548-f12c07c16087", "value": "T13BE29D2D49497D9DC3F38E3EC70591EF640A1DA160017ECAE4907E8E12B12EA57CDBDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068283, "uuid": "6ec785ba-528c-4124-8a12-2345c10634f8", "value": "768:kfGjIwSSISSoSL3xCYmmUxjfC30+kS4Qyo5041V+6i:+fTxbmXYk4pi41s6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639068283, "uuid": "f8a8cb9f-c5c6-456c-a372-3040906584ae", "value": 31523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639068283, "uuid": "5e0b1822-be72-450c-9434-9beb528325a8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068283, "uuid": "133c4412-6b75-4cad-83c1-7f2873b3c37e", "value": "Data_01516.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162b514a-58de-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639047141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047141, "uuid": "96cce80f-9d16-48eb-b6e8-a010240d912a", "comment": "Malware payload (Heodo)", "value": "6c69bc006e9006849d4041f93806fb96", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047141, "uuid": "662bcdea-dd80-47c1-b655-1172a909fe9d", "comment": "Malware payload (Heodo)", "value": "61a47ebee921db8a16a8f070edcb86b5efd47a8d185bf4691b57e76f697981f9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047141, "uuid": "1992e9a5-a4f4-4f31-8d19-73d650ce51ea", "comment": "Malware payload (Heodo)", "value": "57c70a4a5dea8e77cd4c412f8a6c997872a1a379", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047141, "uuid": "0c892024-40cc-4e42-a27d-b25549f48aff", "comment": "Malware payload (Heodo)", "value": "58eec100979452774adbece1f7b3994e1873e488206b7bfe8d8e27759b8cb78a2dbe1f85171483c7cd5fa0390ee28ac6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047141, "uuid": "d3ae8b54-23fc-4efe-b218-d90266c7c542", "value": "T169C33A10F39341F3CC930DF229B6B62EDF781E066124DFAA47980F17AEB5245A669C1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047141, "uuid": "6c323565-2f64-467a-83e6-be93bcfbdde3", "value": "3072:/u5tHNpD8QLG/qDhOabqFFgVEOJe2rYUWPkQFisz:/u5ttpQQLGQWFSeYHmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639047141, "uuid": "c5b4359f-c28b-46c6-a6e8-5b96cfd2416e", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639047141, "uuid": "5bfa4152-603f-42e7-b125-f7ce2713cd3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047141, "uuid": "6fa051b0-b981-4b11-b91c-97e8b9697eec", "value": "61a47ebee921db8a16a8f070edcb86b5efd47a8d185bf4691b57e76f697981f9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9f3f58-5902-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639062587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062587, "uuid": "6e3fe2a9-027d-4cf0-8f01-cd7234f77f54", "comment": "Malware payload (Mirai)", "value": "f6f2644912a325201791a24a759dedd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062587, "uuid": "6bc58aae-3d6f-45ae-af65-23e7b6fd8444", "comment": "Malware payload (Mirai)", "value": "6225688b709a12faf2a46ea4cbec5e3c51079000574f1f77e364c456419f68ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062587, "uuid": "6fc13865-a3c9-4eca-b94a-7b331076c480", "comment": "Malware payload (Mirai)", "value": "c67820759dbf962d072c7d285fcbb028ee76cc55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062587, "uuid": "05f9ad9c-731b-4362-befb-14938799efb0", "comment": "Malware payload (Mirai)", "value": "da12f0d95c61f70e0a7b0db6ade66ab7f7b7865545279adad8d6cc2812775583d783abbdea77ca1cba4a077d72697278", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062587, "uuid": "9eb6dca4-5110-442b-94f1-341d509cd496", "value": "T14FC2E0742840A570E370053EFFA9CA875BA791F482E831050A505BFE964F486BDBB78F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062587, "uuid": "a7624e27-2753-4411-ac8f-ff6537b9bdeb", "value": "768:4RSa8ZS/L6rze3OXrFKg9KZrqoDu7+Wns3UozYJ:eSjFJXZBCJDu7Lazq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639062587, "uuid": "ab4285db-e190-426d-b324-7dac7bf0a9de", "value": 26292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639062587, "uuid": "4b757bbd-b6b2-4905-89e8-88f1cce7a9e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062587, "uuid": "53592134-073c-48b4-a9ad-ac20e811df65", "value": "f6f2644912a325201791a24a759dedd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf40535-58bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639032412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032412, "uuid": "9ade0693-ece3-4676-83c3-d8fad70a517f", "comment": "Malware payload (Formbook)", "value": "814c0d4b66ea58928bdaab507596bd12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032412, "uuid": "3ad503a1-ee5a-406c-b272-3f52b8b71f73", "comment": "Malware payload (Formbook)", "value": "6246f8ebc3d0501edeea55073a793b133c04fb1e8fe8cff68ff6b014b23a7fc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032412, "uuid": "dccaae48-d0b3-4849-9866-050cf8f394a2", "comment": "Malware payload (Formbook)", "value": "ecf22f1c650398550ae284c3a65c261bd6c3412e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032412, "uuid": "e71b10bf-fbf2-41de-9e22-7dc09ab35824", "comment": "Malware payload (Formbook)", "value": "b385e7a76a2e442c5ba589d94710e62171ce9460d5090705872bd74e9ad9473d8737b97cbdc79a67bd252e99d41989a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032412, "uuid": "38e37fb0-99ef-451a-9f14-ac7dbc01c305", "value": "T13635F024D96B951CE56B76F98F11BC620E2B9DB9C0018606237EF6192A3D707CF223DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032412, "uuid": "1efb5868-2ccf-4719-b514-2d1ce77d7c27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032412, "uuid": "8c53af3f-068f-4da6-bd5d-379048cce4e9", "value": "24576:PZr8xh7RHUcLgbAsSCsZf3ifTT8u4SfnrFTCVK6VOWcnp+0eNLxkCW:PRDAsS1OTTbd5GguOWup+FdvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032412, "uuid": "d26dad5f-c65c-47d7-943b-0bea62c9d6ba", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032412, "uuid": "c335e323-2b42-48df-a163-22792abddd5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032412, "uuid": "80b6f9e5-3e3c-480f-9f7f-1612206e8782", "value": "Hesap_Hareketleri_30112021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe131da-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639054218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054218, "uuid": "68dec4b3-6809-4342-8d1c-0316c0fa38e1", "comment": "Malware payload (Mirai)", "value": "39ebca17ffc411db240c889b9bf287e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054218, "uuid": "b059e0df-d20d-4507-b031-bf92be1f2db1", "comment": "Malware payload (Mirai)", "value": "63c676fb9f93561144ba100b352c3417d2c10d2149c23f0f497cd85a597cccd7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054218, "uuid": "2fd91ab6-33c0-48de-a911-d22c73c9e73e", "comment": "Malware payload (Mirai)", "value": "afa7a512b7131e0d00c3991f0485a60808f872d0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054218, "uuid": "08727f1f-25e0-4246-8251-06bc7c96b4f8", "comment": "Malware payload (Mirai)", "value": "0d616f42d3c791fa2e4b556e1fbecf611232422b66ab6f7c3effdacfd4b21f57b65ceab0290f393bc756f46a3e8616f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054218, "uuid": "c6d978e4-90b3-4708-bb0f-c7048e11407f", "value": "T13CD2E164A6A0E8B0DEB4533EEE7C4142235B13BFF4ECB5E705948959B25C60BD339286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054218, "uuid": "c512ba8e-7253-4cb9-9802-afff6a413ace", "value": "768:6FoxdX+IoMKVUfzaP1urxIGyYUzpzAhDxZAcNEs3Uozd:6F2+IoXVeNIlzpzAJbzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054218, "uuid": "75c959ca-595b-4f8c-91df-52e233eec8b8", "value": 29960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054218, "uuid": "9476a9ac-bc4d-45c4-94bf-dcd8079976aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054218, "uuid": "7ce2a840-4f35-4fcb-a953-4eada446979f", "value": "z3hir.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4085ea-58c7-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639037300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037300, "uuid": "1f73b0e2-8212-40cf-b0d7-8c95c108014e", "comment": "Malware payload (AgentTesla)", "value": "fe0f8a0e7d278e15f15458df75659d04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037300, "uuid": "eb1b7d85-4049-47af-966c-cceeae0d586f", "comment": "Malware payload (AgentTesla)", "value": "642e4b040da9b5c042cb683a1749fb56aac6cfc1492feee9a4c6b654c5a446e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037300, "uuid": "7a23790d-28bd-46cc-851c-2bbec0c6d2e8", "comment": "Malware payload (AgentTesla)", "value": "371525842372a55fd30fbd6fcc1650481bdf1ce1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037300, "uuid": "27410081-d534-423b-a227-084a401aa5a4", "comment": "Malware payload (AgentTesla)", "value": "82209c88d5ffd6a65d802e172ff13234cbc5e455b429bc0dcdd4e511f4588ef73e286e3b95fdfd3fb69d48d8909c3a3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037300, "uuid": "6181ed64-6c93-4ff6-b23a-6b5f6eebda51", "value": "T1E4350120D9AB941CD94B32F41E11BD921E2BDE78D1118A4A277EF158513E613CF327EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037300, "uuid": "1e63113c-8bd2-4ef0-934b-35c010e2ebfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037300, "uuid": "585b32b2-b6cb-4029-b144-ea3bed26f2d0", "value": "24576:SSShg5Q9i9peuGcgtRm/VjTAyPFlcw8HPyBD:S87exYRTxt3sK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639037300, "uuid": "6dfcce91-1494-4090-9cb8-e6b3ec31c1b9", "value": 1151488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639037300, "uuid": "870ed023-cf21-46ed-bcb3-2380e9a4dcf6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037300, "uuid": "78c92140-9e0f-4007-a3e2-17b9b30ea84b", "value": "BL 204103842.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4ad624-58fe-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639061062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061062, "uuid": "176c0afb-87a7-4353-8e93-729a4cc1e3ef", "comment": "Malware payload (Formbook)", "value": "47b2a766e5bed32590a8c85c7174f45c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061062, "uuid": "f7bef65c-5dd8-499b-bf38-cea235c65c87", "comment": "Malware payload (Formbook)", "value": "67784b75c77762be449b4a271f9afa04520817197749c84a82ca8d1942867163", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061062, "uuid": "d2da3cd5-218c-4102-b4ac-8c9bfe0c6c79", "comment": "Malware payload (Formbook)", "value": "74b88393740c0f980f40811ba32b07ad31f6a721", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061062, "uuid": "39479691-7e8a-430f-82eb-3f1c08fdee0c", "comment": "Malware payload (Formbook)", "value": "aacf7a59b8563426bbffa1c569eb380005aafc491964ebd178f444050a8c2990653ed2f3cd39acff997cb23b1efd2692", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061062, "uuid": "d61472dd-2bb5-47c0-b767-9a6233bfb5f6", "value": "T1262512657DD9ED08D2FB37368DDF100046BCB8425824E63E38EDA1BC6953B646AB01DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061062, "uuid": "0b1a58ff-7cf0-4a03-be7b-f9f02863536c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061062, "uuid": "45352928-8120-43a7-a313-a130e1219ddf", "value": "24576:tIzjM/6DUNss5XeNOTIiqLFBpD3WniPp11a0I8MSD1kA:kjGlx5XeNOk5Xjq0F51kA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061062, "uuid": "540315cd-cac9-4b86-87f9-4271d347c12f", "value": 1052160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061062, "uuid": "0b91d0b5-534c-4859-9cbe-f19804dcc19d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061062, "uuid": "98be897d-265a-4227-820d-4ce774b35e58", "value": "47b2a766e5bed32590a8c85c7174f45c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2d53ec-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639054216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054216, "uuid": "bab37ca1-04a2-481c-826f-691264e51958", "comment": "Malware payload (Formbook)", "value": "bb6de85814b8dfac48acf2fc3066a7e6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054216, "uuid": "b746d6e3-660f-42ee-904d-ed85b1086ea0", "comment": "Malware payload (Formbook)", "value": "67bb84a55c548e5ab362f13a6902148b0609a372dc9f9f8e3485bfa2bcfb003f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054216, "uuid": "0d192f20-4006-4770-8144-11f7960802cf", "comment": "Malware payload (Formbook)", "value": "26b27198e9c29fb0cc4749158e955d7e57a671a8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054216, "uuid": "ebee2edc-b871-4ca0-b239-91df8df5a8ca", "comment": "Malware payload (Formbook)", "value": "e68301e2c47417805b73308bc5652bc72f3440d74ca138ad25c164395fa1d03da9ab0f93b10db6d1dc873979e807a0d8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054216, "uuid": "9b0d76c7-1601-42e5-99c5-644211e4a8f9", "value": "T170341257FEA0FD4FDA9291BA4915FBAAE66AFE473FB43605B51C305C7E3502442E0600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054216, "uuid": "72822f7d-a483-4c42-81a5-300c0091de1a", "value": "6144:DkU4aVpFpJ5wPAAVTvuxSNmWlfxvAryp5c/4Sn3zpe:jVdJYAAly0m2x4Wpm/JY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054216, "uuid": "24b0407c-ac3d-4c55-9ef5-61d8d91d81c4", "value": 234456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054216, "uuid": "b48b7c1a-d584-4a35-a3c4-4169b084b8da", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054216, "uuid": "68beda5c-7cbe-4d20-a1b9-a99136d54194", "value": "New Supplier Registration Form MopcomsTurkey.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e020a0-58f2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639056085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056085, "uuid": "b5a8801b-cc51-42ff-8d8c-843825374d03", "comment": "Malware payload (Heodo)", "value": "d8614f52bcc20bd665afd0d919795670", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056085, "uuid": "089ce45e-05fa-4162-95f4-45963ea65fe8", "comment": "Malware payload (Heodo)", "value": "6811543ba47fff984680204eb7ab7cd013d821122f8de8762435ccc270c09cca", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056085, "uuid": "9e1337b3-6611-46de-a263-0bf52fcfde09", "comment": "Malware payload (Heodo)", "value": "8aef4a013231cb280ceaf1ce2593e86c45f1c47c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056085, "uuid": "4bafb35d-8fc1-47f4-972d-e20cc3fef21d", "comment": "Malware payload (Heodo)", "value": "594a230ba545540ec69cccafbaf6dbff5733d6bb49c2c06c49a64e32efbe212e4fa1152b5eb3509b30834f885c209a04", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056085, "uuid": "5c516f9f-5e83-4c32-b4ef-e2c87db48cb7", "value": "T178E29E2D49497D9CC2F38E3EC70551EF65091D6170027ECAE4907E8E52B13AA93CDBDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056085, "uuid": "e9f9d527-4731-422c-b14c-886da96d404a", "value": "768:V3yjIwSSISSoSL3xCYmmUxjfC30+kS4Qyo50NC0NZ:9TxbmXYk4piNC8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639056085, "uuid": "e9bb3cad-f004-4858-b557-464afcf44d02", "value": 31524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639056085, "uuid": "90926fb9-3cd3-48eb-89ce-67218f4d2327", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056085, "uuid": "dac3c1ff-e611-4c90-bb37-8e9e063d839b", "value": "untitled 8698896487.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2fa6ed-58ed-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639053864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053864, "uuid": "12e9eac5-5c39-4587-989f-b1f11299f1de", "comment": "Malware payload", "value": "f6715d3dcb116277e842da20331d5c00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053864, "uuid": "318e157f-629f-431f-95b0-56a2a32a74d0", "comment": "Malware payload", "value": "682033ad5196cd91bba96f6bdcdeb9c2757ccdbf77add437f65df356c2456505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053864, "uuid": "c9de18e8-4db0-4dd2-b8e1-9e9551739923", "comment": "Malware payload", "value": "0eee81d7d29ee89aae81660236a6c4a62b368399", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053864, "uuid": "52fe185d-c606-4c20-9cef-28d9cb3c8d12", "comment": "Malware payload", "value": "e50ae6c489f56d26ea483ca3026a0bc60922930ce3bdcd8bedfa1fd3c99eacc916923ca3cce32f2e173c73f607e8d6a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053864, "uuid": "186cfa86-68da-4bb3-9bdf-5688bffce837", "value": "T152256C11E6427136ECD300B386FF1AFE9D2C6616030C64D7D3C45DA6AAA19F33A37666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053864, "uuid": "2cb06b92-89a4-468d-98e8-413a73595a9f", "value": "24576:hEpfLmZkUtN/Wy+jtYkQkbF7vZjnYdG/9QDkmho:WpylrKY2G4+xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053864, "uuid": "1bb1cfe0-0027-4679-85ca-7c170a3898d2", "value": 989942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053864, "uuid": "aaa5ff5f-d05e-4c48-b7d5-2333784b17b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053864, "uuid": "23d396b2-21ea-46ca-8217-57fe1cd6406a", "value": "f6715d3dcb116277e842da20331d5c00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f7a0c8-5902-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1639062687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062687, "uuid": "2a0c85e5-3f6c-4a93-af78-7e2d5c0f45e9", "comment": "Malware payload (OskiStealer)", "value": "94f23d246daf95cb6253e0f4df5bff3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062687, "uuid": "d92bcba0-9dc2-439a-a44b-006bd05e77a5", "comment": "Malware payload (OskiStealer)", "value": "692f3c6667e00facad6f7f400d646d5fe7db1407ba798a472671ebc51e881085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062687, "uuid": "5788798f-b0c7-4578-b684-d8ff36147bf1", "comment": "Malware payload (OskiStealer)", "value": "e38868c95e8ee1f3e48157665eb51d554e83cb62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062687, "uuid": "9983f7ee-dbac-47bd-ae5c-ebde835788aa", "comment": "Malware payload (OskiStealer)", "value": "1acb16deefcea5a19f2004a4ac012a0c55bba9998b527b89549f41de9606c461b21d3d06ef9dc7409417dfc3b8abffd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062687, "uuid": "2bdac2a8-9fdf-4fcd-bfa8-caf17b5ae5b1", "value": "T19B55120A39A1D41AC1695BF2C6AB9050CF7CF4037D62E7B7299523EDB535BDA8903383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062687, "uuid": "5a6a66be-b23e-4bfa-9053-c6c64eab0a72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062687, "uuid": "6a3ce844-8eaa-4f6a-a06d-310bab7bba12", "value": "24576:SIKjy/SYCpC/KMF/U1x6qJsD2w4SUUbel0chgZ7QX0FCnY/AAqOV5uUWlrGGG:AjASKyM8L6qJsDMSfbU0cSZjFCnY/fuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639062687, "uuid": "f0fc2acd-7138-4881-9f10-6ab8cab0c3fb", "value": 1327616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639062687, "uuid": "7a5d36d7-f879-4351-be8c-c31a8eecf9f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062687, "uuid": "eabe5df4-621c-456a-8807-2fd26fbdd98d", "value": "94f23d246daf95cb6253e0f4df5bff3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2255dd47-5883-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639008078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008078, "uuid": "6afca94b-c61f-4f51-9690-7a1780d8a0a0", "comment": "Malware payload (Heodo)", "value": "9e1808274981d9a43bbd6ba40fd437dd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008078, "uuid": "1107b85a-ce09-489b-82bb-ce2ec2e906d1", "comment": "Malware payload (Heodo)", "value": "696f15274289cfdd0971125c1153106725d04c75239c3593b7bd98f56f693204", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008078, "uuid": "0924ea69-d2b0-479d-8b49-e9557981944b", "comment": "Malware payload (Heodo)", "value": "7a79bf46fd161aacd4d231c5cb22a9ab8462c1d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008078, "uuid": "2105c59e-66b5-45c0-b36d-b9d9eac4220e", "comment": "Malware payload (Heodo)", "value": "88e92dc963bbddf46bb1bd79254d9b813ea6f8a30eb1c4412316c962a20008ebc4618e7022291bd00161341ee2b63f4d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008078, "uuid": "07dc06fc-6b1d-40af-9270-9beabee164b5", "value": "T1D944BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008078, "uuid": "a4a9e428-2258-4505-982b-8deba658c098", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008078, "uuid": "2ea3a5fa-8dc1-47ba-8461-8fa3cde431f9", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTB92ypv:6jIG/pjjuLbJLmGshoCUnWTPpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639008078, "uuid": "ee6db2f3-6029-4129-8339-13edfe3bc062", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639008078, "uuid": "ce49b4a2-5848-4424-a24d-33735feff6b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008078, "uuid": "f7a4c7dd-71ee-41d5-9d1d-5a6d5d7925e1", "value": "emotet_exe_e5_696f15274289cfdd0971125c1153106725d04c75239c3593b7bd98f56f693204_2021-12-09__000112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e854d3a-58c3-11ec-96a4-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1639035693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035693, "uuid": "df474ebb-5e72-4bb4-8526-a38276d528ef", "comment": "Malware payload (AZORult)", "value": "d44784d29913883acf91d59262756df1", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035693, "uuid": "041b7738-8248-4a7a-a8ac-e1e904234b33", "comment": "Malware payload (AZORult)", "value": "69971224a233ddd3d0def4399b896c28e3e514966634b415fb91ad3f1df9ab7a", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035693, "uuid": "a38a3c7e-0dc1-43fb-a127-2d68c71a35c1", "comment": "Malware payload (AZORult)", "value": "a6d5368ede3f0e7d30b310c96d9bf527b29d33fa", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035693, "uuid": "14ca30ab-5c90-4903-9dfa-3ad4f965ab4f", "comment": "Malware payload (AZORult)", "value": "ebbcb106935169dfc6c58c730391bc23cbb2f33e3788a5c48df82e65b3adeb25d3363293738ec4ebc8491065759cf41f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035693, "uuid": "3a998fc1-ce07-49e7-884b-f31825f5c78e", "value": "T10435121D2AF0A5ABD57956F1C267C050CE7AE01B2E72F2B628D211FE7B386C98543713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035693, "uuid": "14e222d3-9d3c-49ab-aa55-c0edb255ff81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035693, "uuid": "9c5e395c-2f67-45ac-a288-8ce5fc50f85f", "value": "24576:rIKjy/SYCp8TVNCagIJAma8FaKahaPfLXeXicNVZ8kKJo8:rjASUTVArIztcE6J6Jo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639035693, "uuid": "a88d3759-ed73-420e-8108-452cfc8ddea8", "value": 1153536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639035693, "uuid": "7182f56f-2ff3-4b68-a730-ce1f9e22b534", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035693, "uuid": "bff3a670-7e5e-4d2f-99ff-61d6beab574f", "value": "HalkbankEkstre073809405251,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86c6e91-58ed-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639053937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053937, "uuid": "fd2533db-1b21-4ec4-b323-a76a3d9a1173", "comment": "Malware payload (Heodo)", "value": "30917d9d9210a090db51bb5cdc81d001", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053937, "uuid": "c43e9b7a-f923-4ba9-9fc1-5b1ddbb1b1c4", "comment": "Malware payload (Heodo)", "value": "6a0f5abeb63ca487fe0749be23dc30cae1c946be6a0166ee55126bc0ee3fd502", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053937, "uuid": "f1145757-ad50-4e4b-b723-1b7e99c971e0", "comment": "Malware payload (Heodo)", "value": "b564a8e20169c06cf20f37c2e9308a4bd8c9683d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053937, "uuid": "5426530f-51e5-4f9b-9361-4ab32c72e0b4", "comment": "Malware payload (Heodo)", "value": "17b8500cfd8d09699edf7aebcfff6b6ad4ebd068cba6645cc56b338535efebe2d32093c3ecda5ad35480d74e62a5767d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053937, "uuid": "1ea74bef-baf5-474a-ad88-2160eb6a7556", "value": "T1E344BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053937, "uuid": "3e73599c-0d3c-4623-babb-84f90c0c4ed7", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053937, "uuid": "8e119eac-415c-4aee-bbe3-a7d89fab0268", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBL2ypv:6jIG/pjjuLbJLmGshoCUnWTFpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053937, "uuid": "8184a08e-8267-481e-8c5e-535a928628b8", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053937, "uuid": "881c8df2-145a-4105-9256-dafcf94310e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053937, "uuid": "3d06c82d-d674-4e60-8e6f-53b84b1bfb5b", "value": "HnrzQbKxyWEvXZssU.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d293c72-58ff-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639061461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061461, "uuid": "e650737d-92ef-4bbd-9639-cd56d9cac658", "comment": "Malware payload", "value": "e715d9d6b80368d0714e440a27644e7a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061461, "uuid": "3c9b181e-b983-4f4c-a969-54348c3287ab", "comment": "Malware payload", "value": "6a5d16fee2738554bd51b163fedf71b871e64a0c5b1ad496717c990d38d3ae24", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061461, "uuid": "41832836-b390-43a1-b6ee-55943b4fec18", "comment": "Malware payload", "value": "f02584cfc8b2729fddca15553481b7ca3dbe7f6f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061461, "uuid": "0a5e8db8-bccb-442c-ad71-8061cdd65dec", "comment": "Malware payload", "value": "ddaa4de9234288b6739ac09ba1b94777cb852e0a4a688e9ac7c24693837fba69767a25da5cf4525f27ff6c58cc6aa2b4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061461, "uuid": "81e1599c-ee70-4f5f-b8d9-c941d9e45af9", "value": "T184712C99D0472549E234CEFFD66517F2B24D903374057425784B737DFAE42CB88425E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061461, "uuid": "7d025d0e-d777-42fa-ae01-9636728700ee", "value": "48:9hyQEFRtNHGMNRDQ0S5ID9Sgf68wAMWX5IQwh7QfZ1kWWSeEnZRQvZlFkJcLV4c:jyX3vm5m9Sb7A7X2GLHbemiXC+Oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061461, "uuid": "cee1d439-59ab-45c4-b44e-2fbd30f3ed13", "value": 3798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061461, "uuid": "e8efe6eb-9981-4fda-91f9-2374ea88e964", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061461, "uuid": "b1efcdc3-5faf-4aaf-9b31-06d6009b677f", "value": "emotet_e4_6a5d16fee2738554bd51b163fedf71b871e64a0c5b1ad496717c990d38d3ae24.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066d6ed8-5918-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639072026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072026, "uuid": "838bb10e-d513-446b-acf9-fe342627748b", "comment": "Malware payload (Heodo)", "value": "b3f9c43e347b41ed7ad847742d035b4c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072026, "uuid": "fe3209a1-8857-4d0d-a2aa-7e0db5cbfb8b", "comment": "Malware payload (Heodo)", "value": "6b24094a69cf6e612d38e8b0a29ba0805cc160dc1a84be86c55dd8c7f59521a7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072026, "uuid": "f2ec63e6-753a-4d5e-ba83-c5bd6852f0a4", "comment": "Malware payload (Heodo)", "value": "c2d8f9e12680678683077f5fb27a33d4acd2bd9c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072026, "uuid": "811ee263-69c8-4d81-8e6e-fcb52389eaeb", "comment": "Malware payload (Heodo)", "value": "a667cb6f60c96fd48a5024f434e5c25b7a60135ad6ffc9b8b7e03d6823228be02701782188c9bfc6b3e8275c56b9f452", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072026, "uuid": "6eb9b099-b4ce-49a4-8235-df6844b39fe1", "value": "T15A9301DBD295DD7EF8E6D438E4B7A0B823328171C15C1E82628EDA48812D5C757FA2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072026, "uuid": "a9bdd957-173c-4c58-ba67-f7d9fcbdb2af", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nb6:yIBQ3MYeGt9sLBrGrB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639072026, "uuid": "2c67d079-f51c-43a1-a640-f7b79753e221", "value": 90157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639072026, "uuid": "5eee4a49-8b04-4118-a1c2-1a15364c6b94", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072026, "uuid": "45380b10-da34-4c42-8734-111d2e578b4a", "value": "emotet_e4_6b24094a69cf6e612d38e8b0a29ba0805cc160dc1a84be86c55dd8c7f59521a7_2021-12-09__174636253320._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0375467a-58f5-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1639056988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056988, "uuid": "75763915-26d9-4739-af3e-ecaf4ffd4710", "comment": "Malware payload (CryptBot)", "value": "3a4299640dc759ba6b81c68a9db479dd", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056988, "uuid": "c330cd61-33bb-49d7-a418-4afa21ae63ac", "comment": "Malware payload (CryptBot)", "value": "6b36946cbb79720d4389896c2a5a750232a6d48f2d4aea06a454d481f221691a", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056988, "uuid": "7999cad1-337c-41a5-bd8a-cfb6c417820f", "comment": "Malware payload (CryptBot)", "value": "dacad8f2056dd2a781b12cf1525bb1c05c1f46d6", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056988, "uuid": "5da5aa95-d953-4ed1-99a8-f809dee57d9a", "comment": "Malware payload (CryptBot)", "value": "dd65aae568b6aa88882985eb28a7933e9689da41cb15e37dff21b4ab991ec20eb6baf228c9acfa3e43fc9dfc278ff19f", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056988, "uuid": "ee443d72-bec0-4bc2-864d-96405b1afd66", "value": "T17284BE04B7A0C034F5B726F8597A93B8A93FBAE1572491CF61C512EE4A746E1EC7031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056988, "uuid": "39fdc73f-b3f8-42f3-af67-46e52dbcb480", "value": "971a9f981d9286b99905cee799d3e7b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056988, "uuid": "40189b50-2616-443a-ac02-eb63653b6a13", "value": "6144:vHhHth59jCeDk5VeOSZ7UDnQU9O+WamfO8XNFnGL5h5PK:vHJ59nkLgoMU9O+W3fO8vnGhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639056988, "uuid": "82d9cb96-fbf3-4c00-9d72-75f15e6cd2d0", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639056988, "uuid": "9e70dc2e-8566-4968-ab84-e64482973dfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056988, "uuid": "3007b145-3e04-4e4e-93b1-6974dd27985d", "value": "3a4299640dc759ba6b81c68a9db479dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe64a35-58bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639032206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032206, "uuid": "9241f78f-af24-45b6-9a75-7f6e9fbcf371", "comment": "Malware payload (Formbook)", "value": "43a4ba49bc8f4c69feb1d5846ad53c34", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032206, "uuid": "bcd4c6dc-ebab-4a4f-9a46-dfc943ce7a44", "comment": "Malware payload (Formbook)", "value": "6b4ba43438408919a0f6c21762729bb019c3119ea2a810fecf1b27cb011753b9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032206, "uuid": "6c456cec-18ab-48e3-95dd-64574d396e92", "comment": "Malware payload (Formbook)", "value": "b1088e7d1bfe43979f90f8add11ea7bd3f3f2d60", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032206, "uuid": "d292b020-167a-48bf-8148-2d2f02471bde", "comment": "Malware payload (Formbook)", "value": "33f84016cc27dc9b5ef69a6f77190644272968bb9789e764890257798937ebbb4411c6f5eba0c79138ec964ec6e49650", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032206, "uuid": "5a3b7039-94d8-4dbb-8ede-2ce725b43249", "value": "T19F3412C07DA6D588C493C9B521F5F78CC966DD7BE780A24F9118328E11F7DB6A1102FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032206, "uuid": "d36b3611-e47d-44df-afd1-5f8a1602df5d", "value": "3072:dI5rDtkF7b1g9UDkB87Rsd9X2pzRKjyUFRwj9PQFSzDvCabjFCN6X0BjgFM2w6PT:6bs6AkKeD2ghT+WF+vFCIqopa9WzqL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032206, "uuid": "1a7147e0-085a-4107-8dc2-f6ae1d2cf1be", "value": 234712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032206, "uuid": "17aa55fa-2c45-4caf-84ab-69621237442a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032206, "uuid": "62114111-e7d4-4023-ad72-060032155d1a", "value": "stocks.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed5946e-5900-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639061786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061786, "uuid": "bd096aab-7dcc-4a1d-a1a8-569276b9f0c0", "comment": "Malware payload (Heodo)", "value": "5f46d2a0623367d245cf3eaba9c0049d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061786, "uuid": "c49e47e7-de15-4d0e-aa6b-8a19b4922866", "comment": "Malware payload (Heodo)", "value": "6b73d209933e752fbc8ed27fc0f08aeaa1d9923d7c1bf0678a376eceaf76f4db", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061786, "uuid": "20f7ff11-0402-410d-b476-e7ecda318631", "comment": "Malware payload (Heodo)", "value": "1a0dc582c00ea05b6153f44480ddff78659da68e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061786, "uuid": "0adc76aa-6e91-4284-bbaf-33d8b9556376", "comment": "Malware payload (Heodo)", "value": "7819f114f188f6cc368d639b68d4bcf66da8be6bf155d3c6f746445881455e467fd1cbebb1ba32fde5d34adbea386e88", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061786, "uuid": "a55aa304-bd66-482d-8a19-69a5f76927f6", "value": "T1D4A44B00E711F13AEAE700FBCAFB88AD9569AB14139919CF55C86EE5E7190D43C3261F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061786, "uuid": "96fa83c3-7926-4c3e-8ae3-ed65acd8c8a3", "value": "12288:me+n9DJGtOal5V8yMcztuEpzZ4GbOX8+d:m5MtOK5VXNzZ4GbOX8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061786, "uuid": "344cfa91-443d-4c6d-9366-5e8f6d681819", "value": 478759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061786, "uuid": "cd12b3ba-e1e5-4fae-8536-8609726913e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061786, "uuid": "41acad9d-fa63-43af-858b-5cf76015048d", "value": "emotet_exe_e5_6b73d209933e752fbc8ed27fc0f08aeaa1d9923d7c1bf0678a376eceaf76f4db_2021-12-09__145621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f69ae2-5892-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639014717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014717, "uuid": "c316eb7f-62c6-42a5-9bca-4649c9ec02cb", "comment": "Malware payload (Heodo)", "value": "7ffe63fafa07a156df587e3ca4cfb5fb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014717, "uuid": "47990df6-ad18-411d-8d71-df9a1772bb70", "comment": "Malware payload (Heodo)", "value": "6bd19629b2f1f81c3491e672afc86bdd256432f88c4cbd4b5140f12bb788f153", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014717, "uuid": "1d6b05ce-73a1-4e6c-86db-bc193846d813", "comment": "Malware payload (Heodo)", "value": "939ae2f2c0900a0ce83c6e1d7286755e28db2e54", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014717, "uuid": "0bdf9c26-553e-40b3-84d9-45b8add9f733", "comment": "Malware payload (Heodo)", "value": "e7ade9766075ae7f0999be69d222b5898fa9fc75fa1aa8a11802ca76ead213370959e5ea1ce8c96b9a585fb4bc687120", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014717, "uuid": "36917d6c-304a-430b-a540-2750078e3026", "value": "T10993F1DBD295EE6EE4E7D438D5BBA0EA27728027C1685EC181CDCE8C852C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014717, "uuid": "78357496-7477-44ea-a4b3-c9d2b8b58e3f", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iyS8D:Gp4Z3MYeGt9sLBrGrS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639014717, "uuid": "7ef1f83a-d819-409d-b14f-295fab779d20", "value": 90142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639014717, "uuid": "741aab77-ab46-4060-8c30-7afd6f6b4f18", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014717, "uuid": "f0a336dd-0bdf-46e4-b82d-7a713eb9f65c", "value": "emotet_e4_6bd19629b2f1f81c3491e672afc86bdd256432f88c4cbd4b5140f12bb788f153_2021-12-09__015145260166._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe84b9a-58c8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639038051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038051, "uuid": "9e233256-df73-4a58-8421-3bb8b4f1d0d1", "comment": "Malware payload (Heodo)", "value": "61465fc910b7854b1429f9a2162cb0a9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038051, "uuid": "63fed220-cb05-475c-85aa-c557b17c2073", "comment": "Malware payload (Heodo)", "value": "6c47073ee9d9189f7ba8391526d28e733ede97302d259d54aeb985b0d3279bfd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038051, "uuid": "de4dbd83-897e-443a-b22e-21b05d1cbc60", "comment": "Malware payload (Heodo)", "value": "0da1cbf2751d628ebad5b71143b4ce82a295eafd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038051, "uuid": "728f3682-56d2-4d60-9c28-5bb4f007dee8", "comment": "Malware payload (Heodo)", "value": "bb2eecfe37e71028614e1e08642140b076ffb5659d258235f56ed1f402be98b471647fc138f94fc091f7b551ac91e3a5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038051, "uuid": "95db231a-878c-4a36-8f01-c8f9655b0aae", "value": "T10E93F1DBD394EE6EE4E7D438D5BBA0EA27628027C1685EC181CDCE8C852C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038051, "uuid": "488f77bc-5652-492f-9975-785aa5526742", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySx:Gp4Z3MYeGt9sLBrGrSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038051, "uuid": "8a66e39e-0ddb-47e1-9a6d-c0ac5767c223", "value": 90142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038051, "uuid": "f82e7693-d038-4e8b-bee1-8b0267711918", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038051, "uuid": "ed50a5fb-b088-46b0-912d-a380dee5e1a5", "value": "emotet_e4_6c47073ee9d9189f7ba8391526d28e733ede97302d259d54aeb985b0d3279bfd_2021-12-09__082029362469._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086c518d-58f1-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639055279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055279, "uuid": "616f2167-9c32-4b9f-bba3-cfd83decec35", "comment": "Malware payload (AgentTesla)", "value": "31a8809fbdf7310799627be59681d874", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055279, "uuid": "77dc7f39-8e5d-46db-ae20-60086739c4c2", "comment": "Malware payload (AgentTesla)", "value": "6c4e4cfefc79d2041e39a42d83c667bf5dc8d42a7e0d18b855d348efebde5fb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055279, "uuid": "f679ac5c-5f5f-42b2-b0ed-bf65396a5ed4", "comment": "Malware payload (AgentTesla)", "value": "ca119860bf830e0e1f7346e679b88cd11bf4f53c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055279, "uuid": "4f250c53-e903-41ea-be17-70978a76fe9b", "comment": "Malware payload (AgentTesla)", "value": "a0c8a7388d1b7fa6de90824a7593539e7e8a52f5bc6ff04da5aaba8b369f1374a63b455a69fae43b80689bb6eb70d0ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055279, "uuid": "03e7cf4a-d82a-403a-b87d-2eb448e8b3eb", "value": "T13945224A6126EF14F4586935F5A7C12202387D6A1947F3262DD0BAFE1DB3B0A4F077E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055279, "uuid": "c9da595d-4455-483c-a492-2a4feddb94f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055279, "uuid": "7dfba62f-36ca-4de9-a7b7-a09b350013e1", "value": "24576:dVFnRUuqmqn9dVM4vEknCw0D5TEM3RkYhhy7mSCoiq07yh:8Bmq1M4vEkCR54M3qLzPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639055279, "uuid": "5c0c8c1f-466d-4453-93aa-7502dd2b8400", "value": 1203200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639055279, "uuid": "cd82d635-05d0-42c6-b5e3-89cca6a10ca6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055279, "uuid": "30cde022-b58d-49ac-95f8-a9c443df10d9", "value": "PO - Drawings And Specifications Sheet^PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663c57fd-58d5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639043410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043410, "uuid": "ac6ce1d8-970e-4ffc-969e-723ac9ce08c8", "comment": "Malware payload (Mirai)", "value": "71a8811e21a9634c7879b68261f7631c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043410, "uuid": "22ffdfc4-f86e-478e-adc0-6d493b91c5bb", "comment": "Malware payload (Mirai)", "value": "6cadb1ad4e96d6d1ba1e45f2081268104006fb3f4e886b6a984d9d70685ec5cd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043410, "uuid": "41386be5-d22e-49de-ba78-fd5f6ec3f57c", "comment": "Malware payload (Mirai)", "value": "6747cd606f48485ac080aa22a31af3be76cea754", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043410, "uuid": "5c056545-1627-453c-9fc2-c0df073466e6", "comment": "Malware payload (Mirai)", "value": "86095c189921042adf637b378dc52cd5b53e7408f51b3d2a52efdaeb74aa7ac9be8f29f021a2c54655aad3bc2ba24050", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043410, "uuid": "8891161f-d788-4f5c-b243-2651a05fde07", "value": "T104B2D0717015B8B7C7E100B79AEDDA83FB801EF8D0E8B3291465099DEAD5D53AAF1207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043410, "uuid": "2e43eca0-4ddb-4c74-b583-f23918eafaa3", "value": "384:bZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3pXhymdGUop5hx:qX9nxn8o9wnBoWzEQf2EjKb3pXs3Uozj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639043410, "uuid": "59e090d8-4791-4c4a-9533-0263efaad7d4", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639043410, "uuid": "0480225a-f9d9-46fe-bd4f-fc1a08c1ec18", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043410, "uuid": "ccc4f475-9f90-42ad-acf0-a923ea0aac22", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a4ab32-58f8-11ec-96a4-42010a9c0029", "comment": "Malware payload (BluStealer)", "timestamp": 1639058500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058500, "uuid": "b20d1f61-90ce-4dd7-b46a-6c5bfcc30246", "comment": "Malware payload (BluStealer)", "value": "6ad66a80752d3a59da8e76e52a9b8e1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058500, "uuid": "83a38d00-17c0-49ec-a556-e132bd0a947e", "comment": "Malware payload (BluStealer)", "value": "6d7a3b7d57a9f91bb466f8d939f3265b6b7906b0644d076e256b56992926e660", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058500, "uuid": "caa3326d-21ae-4832-8cc0-49fc41052364", "comment": "Malware payload (BluStealer)", "value": "09d6fe421e0521414a1817efb749dd4d2ce234f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058500, "uuid": "13f90859-c7c7-428e-9ab3-9f0a6d925b91", "comment": "Malware payload (BluStealer)", "value": "8086efc4a5ae2653fc653ad65ffa473f9fc8378d6661585c7c2fa6289611000b2254314a5e5d1bdd3c9adff96480cfdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058500, "uuid": "cd8bde4a-cba5-4d9d-ae82-98d5d150280a", "value": "T195353BBE36561921FD0F85704941663CA7268F0322696CC2D7CE75CAEB3F5F63C4988A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058500, "uuid": "bdfb64b4-b992-4db2-8296-8756e5e446d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058500, "uuid": "1b7aa864-ba73-40ee-b371-dddb54c72f07", "value": "12288:Pxg/2TjFujdE+lDxMqCyPTZsMudS59SCcBgvhJCDdxw2Wh9+KYDalc:i/2TkdXl6qCUTZq8+u7CDEphAdDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058500, "uuid": "53dce1ef-03dc-480c-812c-2a99093a276d", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058500, "uuid": "95581017-5a2f-4111-9190-5de3ccb2410a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058500, "uuid": "6469a412-88ce-4316-95e1-4520f26fa501", "value": "6ad66a80752d3a59da8e76e52a9b8e1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab41297-590d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639067362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067362, "uuid": "ae7ec706-db72-4a61-8e75-e68b6842c249", "comment": "Malware payload (Heodo)", "value": "24a099ba50aa1bfb813bcd5061472ddd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067362, "uuid": "7cfa9f08-9866-41e8-af06-e8fd7c684684", "comment": "Malware payload (Heodo)", "value": "6db713111922141d1e216988ca94471878eaf0cdefb37f14a61a6186c9590e19", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067362, "uuid": "6848276c-7bc7-40e1-ac07-e0fd52586c9c", "comment": "Malware payload (Heodo)", "value": "bfa4a15d8cbf3a4ab1c348e4c6dc2e9983bde601", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067362, "uuid": "a6035beb-1667-4bc8-91ce-2f1be2659a1f", "comment": "Malware payload (Heodo)", "value": "d2df892221d08c267786fd14436387b856acbfa4e9c8c228e4f30513bc7d1bc702506bd1a5e38a7efc902ae3c5c52c2c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067362, "uuid": "2686d07f-88d0-4c98-bb05-e7e4d776a81e", "value": "T1D49301DBD295D97FF8E2D438E4B7A0B92372C031C15C1E82628DDA48812D5C797FA2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067362, "uuid": "0ffee19d-65c6-4df8-89ce-95aca6f9407e", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbl:yIBQ3MYeGt9sLBrGrBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639067362, "uuid": "d8bf03dd-f2e8-4916-844d-aab551d1d8e3", "value": 90156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639067362, "uuid": "15a87c73-dfd0-41e3-9985-fdf87bacdd63", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067362, "uuid": "6dc2debe-4d18-4720-9178-5cd0f2f435cf", "value": "emotet_e4_6db713111922141d1e216988ca94471878eaf0cdefb37f14a61a6186c9590e19_2021-12-09__162853572906._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0aa26d-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639054100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054100, "uuid": "2abd755f-652a-4201-ace4-9f19df6a0307", "comment": "Malware payload (SnakeKeylogger)", "value": "8e8cac3b3c3eebab5da1f477477423ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054100, "uuid": "e8b65bd9-3c98-4c9e-811b-1fffdc9e637b", "comment": "Malware payload (SnakeKeylogger)", "value": "6e0f21b4b4c9e9a85186c6026f2b057f5a2f308d2b2c212258ca56eea57af17b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054100, "uuid": "ea131d2d-add8-4ffb-9a3a-fc06750fb67f", "comment": "Malware payload (SnakeKeylogger)", "value": "e1d9a7484097d5f2b2834cb0fba7520d4453ac97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054100, "uuid": "05b6e276-7835-458b-a847-f7285ce438ff", "comment": "Malware payload (SnakeKeylogger)", "value": "7a8f49b3623c82421a5acb4becec4f753e26959577b30b0eb1c4d4184051e2aad3493217b977b4c7c968d701c41fc3e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054100, "uuid": "5b9fd2f3-1ab3-44cb-b4d0-0115f2bb1bc3", "value": "T14B550206A950A236EE2C67749B33C4304B26FC6E3D75E17D18E53DAF3B7A6C6A012513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054100, "uuid": "062a8da8-afcf-4d44-b704-b1f1e902e42f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054100, "uuid": "3d98d757-2415-4153-bc0a-26fa7f0d2432", "value": "24576:rIKjy/SYCp17G3vBfd2GjdGVn0o6I/I6bFKRJU:rjASN7wSGhGVn0hIw6UjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054100, "uuid": "60ec2e47-1d70-48ea-9d3f-47dbee602497", "value": 1380352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054100, "uuid": "64c2a66c-390d-42bc-8a02-6107deda8018", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054100, "uuid": "a55cea91-f263-4d29-8e7b-fe79842e47f6", "value": "Quote_consumable order ECR2019RS099Resonant.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde1d353-58ed-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639053919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053919, "uuid": "e6a8e6b2-8548-4af7-8a0d-7bdeb8341221", "comment": "Malware payload (Smoke Loader)", "value": "22d69a9e92b86a32f62f59c58d376e9d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053919, "uuid": "199e8076-f863-4911-9b3d-87dd320e9dad", "comment": "Malware payload (Smoke Loader)", "value": "6e787e37746f7e0139c09b78d4f377a7d7b568239ad419bdd1fcd219b02a6667", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053919, "uuid": "aa48503b-3c28-48c5-ac00-400a5aa00fd5", "comment": "Malware payload (Smoke Loader)", "value": "c96656ce2074015440849b503663f20a02751e82", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053919, "uuid": "e0d6c259-445e-40be-a31b-23e1ce2d966c", "comment": "Malware payload (Smoke Loader)", "value": "c7bb315d0b9a32d17309a90c588b02713349b329f34b6e400b27ab36d7658fb3e54b29d21c1148dc58ce03a39ea63353", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053919, "uuid": "30493ddb-8894-4261-b3aa-8cb9677ef476", "value": "T167748D10A7A0D435F5B716F85ABA9379A43E7EA16B3490CF12D426EA17346E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053919, "uuid": "2801751f-c77d-4959-8a9e-a3abfc377fa0", "value": "d9d9fc0ee02596fca6336fbe79f431ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053919, "uuid": "0fd9a361-86f8-4870-8d29-67f1bf45627c", "value": "6144:yPu4g4vEGwQC8ErPV2RAciELrv+yujTZhSf:yOGwQC8EzV2RAjELJubw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053919, "uuid": "765025fd-9fa3-4331-8c1b-eb49a2775ac6", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053919, "uuid": "eb58530b-b6c3-4b99-998b-edd72b69a282", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053919, "uuid": "351467e5-5a60-487e-a43b-c4b25d54f950", "value": "22d69a9e92b86a32f62f59c58d376e9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f93a4d-5949-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639093411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639093411, "uuid": "16e3decc-9ef9-41bb-809c-c94c49e2f578", "comment": "Malware payload", "value": "11ac9d909d43f7fbc3459c5a0be969ce", "object_relation": "md5", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639093411, "uuid": "dfaaf19f-3b4f-4a28-9c42-e6e44b5773fe", "comment": "Malware payload", "value": "6e850d9044a03b40cc06b56f9ab884ddaa8519cfbb13fdb58f4acf6e56dddb82", "object_relation": "sha256", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639093411, "uuid": "b8458f1f-b187-40bd-8152-b0543dd2e4d9", "comment": "Malware payload", "value": "c86a24704bab6757ffbb062c479e0c89e25ebd73", "object_relation": "sha1", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639093411, "uuid": "536b68c2-70a6-4f4a-aee8-3ca73deb3d78", "comment": "Malware payload", "value": "4f9580fda912255a8dc5027d8e36d4f6bbce77321f9c2af19cd9bf3980400ed0471c4cc0d62834b22275cca6256db095", "object_relation": "sha3-384", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639093411, "uuid": "970c4da9-d01d-4c03-9c51-cb7e1d1fdb36", "value": "T12A24F10DA83CE89EC72B1431C708AFEB851B5061EDC2B82E65C9394D5955EEB7BCD18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639093411, "uuid": "c5212a24-e0e9-418a-9f92-70bd60b95c63", "value": "3072:1QIcfEIz6t8weEGc33rk590Du99wpFlUz7o8NXKRlzpG7/UQXIqdtKcmIDYPIZEo:1rcfEw6R9537k5WSOeME6rGj/m/58DDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639093411, "uuid": "effe1a9b-e115-499f-8c3b-c28227fa1e45", "value": 214792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639093411, "uuid": "a4c569ca-12b8-4565-924c-b668bb5c19e9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639093411, "uuid": "8abcee95-cbcd-49d5-aeb1-c7872de905f3", "value": "signal-470366864.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bb8f5b-58df-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639047839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047839, "uuid": "9a7d9a20-1f6d-4931-8797-1fecf098b784", "comment": "Malware payload (Heodo)", "value": "9cca23e45d791c9bfa8bd91f1001ea2d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047839, "uuid": "7221483e-ad0b-48f4-bed4-6d9f483712d3", "comment": "Malware payload (Heodo)", "value": "6f42b72cd9319ce52dc6e13ad170721e4529a8eae6eaa39b519edfc3f0a56ef0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047839, "uuid": "4baa9ad7-e41a-4815-ac7f-974e0bb1d280", "comment": "Malware payload (Heodo)", "value": "1cb4afd49ef20987099d5660e5023740afdc65c8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047839, "uuid": "31e1c207-8a0c-4628-ae5a-3cc37b22d49b", "comment": "Malware payload (Heodo)", "value": "b6f7a99a711e174fcd7f7c2868de17883b62987fd9058a30bc6a3ae3c921004cff9b79d8de67aa63b6424ac7e4544b11", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047839, "uuid": "65fdf742-169f-479a-b557-2596fdeaa071", "value": "T14D9302DAD6A5DE7EE4E6D038F4BBA1B97723C036C0481E82914DCAC8812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047839, "uuid": "d3b85dea-420f-46cb-88a4-99a9ff622bfa", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3u:psXZ3MYeGt9sLBrGrQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639047839, "uuid": "9fc6ac39-5cf2-49c1-81a2-da849782fef9", "value": 90151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639047839, "uuid": "a6ca65e3-6630-4982-83d9-f25a369b4805", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047839, "uuid": "58fa1363-db1f-4668-b9a5-b1dfb4535ec3", "value": "emotet_e4_6f42b72cd9319ce52dc6e13ad170721e4529a8eae6eaa39b519edfc3f0a56ef0_2021-12-09__110335702770._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf96c1b4-58f4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639056901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056901, "uuid": "89c0efe1-afd5-4bd2-b740-6e6617be5e73", "comment": "Malware payload", "value": "a217eac4512ed13efb5b01402c9fd0cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056901, "uuid": "cb50c5b9-eb16-4904-a336-0cbb3e26e716", "comment": "Malware payload", "value": "6f9fa7f1d3e752cb25026029aea230b4c2f948a4d4592f5a8884ab5253577494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056901, "uuid": "8719e3de-40bd-4f7c-b3e5-109d9afceccd", "comment": "Malware payload", "value": "f00d1b68e3bd7727d4b5f8f0e7d24611fe55158b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056901, "uuid": "10a4fec3-7dbd-402f-8ed7-d1eb9ce8bc07", "comment": "Malware payload", "value": "0248ccce862327ff94664ea85f53e0cab99a00bcd8d68a5f929db66bce610b1dd39b353a9180c6e2c64868ccc94cc711", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056901, "uuid": "f3ec5a38-4c32-4055-ad99-bf4a3719eb18", "value": "T16DC4C869A6F1BE29C3D62A37D029C86086D1EB401663E35AF5FB02932F4F3B14D5B1D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056901, "uuid": "4cae0d01-abb3-47af-b970-e77c733bb837", "value": "6144:U0yn2Bz0xQNfyDmU8OrBSFI9RH3E0jTkDhNRMfR5oL0ViqHF6:hBqQVyNEwwDhNmEgVTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639056901, "uuid": "080b8520-d760-4c2e-b30e-d94c44ae7cc0", "value": 582775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639056901, "uuid": "2cadb6a3-6244-4b37-b2b0-08cd2724c831", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056901, "uuid": "fcc91367-7c74-41a6-bfe2-42c504fdd270", "value": "a217eac4512ed13efb5b01402c9fd0cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7bcfd6-58bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639032202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032202, "uuid": "86cd8a3c-4dfb-4954-8162-810abe93cfb7", "comment": "Malware payload (Loki)", "value": "653b345ba2b8e62c7589dfb89ffd1f1d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032202, "uuid": "b4c5b80c-ddac-4c50-8165-4a7e9fac3b49", "comment": "Malware payload (Loki)", "value": "6fcc0bf27e6201d4112ef35938a7c7103f60bfa9e63fae68fee30fc4f458f882", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032202, "uuid": "6747b95c-98c5-4489-aa96-bf6a68a0a3b7", "comment": "Malware payload (Loki)", "value": "2dae4d41149445aa720a1ed7e85b3548dcf22347", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032202, "uuid": "0e4b2ba7-0a73-49b5-b07b-0d7185f3a6fd", "comment": "Malware payload (Loki)", "value": "e9c2c2f0eb274573193c494b808d1acc95458faa2b6a154997a323a353b91554279cb5bfaef4686d6184d5b707c3cffd", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032202, "uuid": "d3d4273a-990a-4e89-98c8-dfc4fc09a6a4", "value": "T1EB341225766E0183C0E1EA3A91ACCC796399DD6B51B6C0DFF5A9731629FC4191E0838F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032202, "uuid": "4eb7837a-af91-4732-b31b-902f51d08a2f", "value": "6144:k0IJnTCmGRLefs/QIb2tloZluUcCON1V2My9WvF4W9DJo+NdutrIx:k0qnm7RLn//bo9U99EWW9Du+ir8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032202, "uuid": "feb7d836-1ee8-4936-97b4-39105ee428e6", "value": 234632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032202, "uuid": "cb4db8fe-029e-4ee7-8581-3d8d50552e1d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032202, "uuid": "08477e06-326c-45f2-bddb-9f7c73a51375", "value": "shipping doc.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92cd60a-58cf-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639041026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041026, "uuid": "1b40a282-efc5-44f2-86b4-6ff46e3c2043", "comment": "Malware payload (AgentTesla)", "value": "76ab0da2a83408feb9f5d73cc55a1369", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041026, "uuid": "b0c89190-2099-409b-8a86-86546a789011", "comment": "Malware payload (AgentTesla)", "value": "7058992d11de14caa978ce9e404a95eff8fe277ef13ba0b37d6e504de20a9105", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041026, "uuid": "aa89780a-7bdf-4c4b-b49f-6f706cb0569b", "comment": "Malware payload (AgentTesla)", "value": "a168b8880b20573adf46ebe809ccdc364881bcb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041026, "uuid": "76810d7e-b4f5-4c01-92b3-aa15a25394ab", "comment": "Malware payload (AgentTesla)", "value": "46850a92bd6a50992c6c5535513249e48e9e00a2d14a936009a3354e61cf36070937ad2030dd572a6841a736ec58563a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041026, "uuid": "1fd025e4-1804-40ad-a9ee-18dfb5fa6c88", "value": "T10694E06721938D53C681997C4170F7FC837C9FA24E2B36CA516A7622D9B1C4B2B4CCE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041026, "uuid": "f750bf3e-78b7-4d25-b58f-0e29471349aa", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041026, "uuid": "2203a740-851f-4f6b-956f-c8050c9b1c11", "value": "6144:TGi7FnvhydhcoKQl65+JewFVmp/w9rummkO9NnXE2XDIDiqsX+D85dKzMpgqqDRH:1Ng8NI9rut9NXFXMDkX+qdKPv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639041026, "uuid": "5370aefc-07a4-4a24-977d-1f4d2d978c76", "value": 434064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639041026, "uuid": "bd72a427-306d-4cee-857f-39ed9a139ed5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041026, "uuid": "c91519d5-be7d-48f4-a33a-6fe8dcf5d84e", "value": "dhl account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4924537-58ab-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639025503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639025503, "uuid": "4d4be799-eb21-49ae-ad60-396518fb5119", "comment": "Malware payload (AgentTesla)", "value": "cb67f060090105667f34a5e63825559c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639025503, "uuid": "e3a46832-8dbe-41e3-9250-871d9ca4cdb0", "comment": "Malware payload (AgentTesla)", "value": "7127a7cd64e8f209fb9897219ce472b1700b6f7c0b405e1a067f605e51dbcabb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639025503, "uuid": "9af1d95d-ad0e-4452-aa83-2e3fca961c1f", "comment": "Malware payload (AgentTesla)", "value": "bd2ac195cf6137b593042b30f0deadca8a69a162", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639025503, "uuid": "b45c921b-e462-49f4-ba88-88551bcf2750", "comment": "Malware payload (AgentTesla)", "value": "1b5ccdb9badde758e071548ad9cbdc8095b25ba15b08a69480840a07bbf29dad54b43d123737c70a017959de1848fcfa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639025503, "uuid": "c14c9e12-0b66-4f38-8462-4ed0801266e4", "value": "T10B15AE691182A7DEF43ED775AA207054D3F0ADF6D723D28EFCE630CA8573A516622132", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639025503, "uuid": "bc856e49-1171-4c14-8bf9-643c1377ebad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639025503, "uuid": "607e41f7-b088-4775-abe1-85934beaf2c8", "value": "12288:ytr7yDTwl9kj4RvVKd/5phzOsTPenG+jGzSJUh4yv4vLRUD7GLT/ta2MUe1w:y57tFVeL1/en0bhR4qDSLrta2M5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639025503, "uuid": "f0595203-994e-4362-9aac-ad3e40e5ebfa", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639025503, "uuid": "3140eed7-50c4-477f-91b7-32cae5377b6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639025503, "uuid": "4e94a0d9-4d63-4c12-8617-9fb1bd74039b", "value": "updated SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b89bc14-58da-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639045432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045432, "uuid": "96d82ab1-664e-4768-9606-063772615f41", "comment": "Malware payload (AgentTesla)", "value": "0973203bc5594b384f2bae84d0d893bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045432, "uuid": "8c6ce313-6f3c-47b7-b9e3-6d7c229a9791", "comment": "Malware payload (AgentTesla)", "value": "71c0c9f0e8c1c053d7fe70e2693ae21124d30b4b256d75670e6c1b657982b6da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045432, "uuid": "203578e7-749e-493c-a969-4ccd31fa5a77", "comment": "Malware payload (AgentTesla)", "value": "f13b689b7be3a1f1c353e2f9dbc10fa2896a4812", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045432, "uuid": "00fd6cce-3a61-4fa4-84fb-6cf6312e872a", "comment": "Malware payload (AgentTesla)", "value": "eb3dea85c4e7c39e00dbe20b570f7030f3cb84ee82a412b14002812972b0f847be00f40cf638aa21c7c534c5490a6e82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045432, "uuid": "3e662a1b-1ed7-4dc4-bc28-fac17877830c", "value": "T1CB94DFC5AAC9076AD3390C7D349970A3017BD6F041AE92BDCF123E5163F9056EDAB6B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045432, "uuid": "23792373-80aa-4f91-ac21-54ef665da6c9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045432, "uuid": "30c738eb-7508-43d1-806c-fa4c0ad2763d", "value": "6144:TGidXlj/i/ahA9iF317jK8kJwly+XUMS483WEIRwb9czr2nW3AsZr2UtBndA:H/phA9q17Tk/+XQ4mWVwJc7wkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639045432, "uuid": "0cc15b2c-b2f3-49c8-ac54-0443ee778d72", "value": 430876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639045432, "uuid": "a181ad8f-5beb-499f-b5fa-723df3ea95a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045432, "uuid": "4d02aef7-f141-439d-9a11-8a11ac8536bd", "value": "INVOICE OF 0Y02682100000G.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99330dad-58bd-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639033188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033188, "uuid": "d5ea44a1-ec7b-4c59-b708-21bf01214628", "comment": "Malware payload", "value": "933d3f432d7a874a1ea19b2658900922", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033188, "uuid": "baa621a4-df17-4f6a-944e-adb2d2dd550a", "comment": "Malware payload", "value": "71f3017c59d30ae9192909fc4742d725d639e4d0528d36ff6ae16a82ff6f9f79", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033188, "uuid": "4f68ad8f-4587-4e87-8509-5df0238ef8c7", "comment": "Malware payload", "value": "eaf401e74d9fab424149ef05a2f069306fe73108", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033188, "uuid": "318a6aec-f245-4c30-b10e-75a6d401d991", "comment": "Malware payload", "value": "90ab327b5b3f475ee50ec172e2fafdb5fa06bb64f8530092524f293957c5bb922bfb962f16b4f735ad02c8e6290b507f", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639033188, "uuid": "ea3c5b5a-030f-4150-9e56-4a63447dd00e", "value": "T1FD358D267190D873C13B06B9CD57E7E42829BF11AB14ED8737E57C8E1EB9680B816387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639033188, "uuid": "22b48769-2b8b-4a80-b6a6-3e0e0d4c6e5d", "value": "12288:JZLuO0wmv2pdKSKVLmbPy7PXjW1ebIrUxhmKQHwy22NwtIKmmTIy76dFRcqz:bCRv2pvAmbPy7PaYbIryhmNgtIKuB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639033188, "uuid": "85341e3a-59d7-4939-ae35-900a70555d9c", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639033188, "uuid": "a1d3b091-1618-487b-87af-e60ef5a1e7b9", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639033188, "uuid": "1f9fedc0-53ed-4a69-af68-484cc9ffa158", "value": "DHL_SHIPMENT_ARRIVAL_NOTICE#424253-DEC-06-DOCUMENTS_FILE.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc35447-5918-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639072196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072196, "uuid": "15a4cd85-7137-4a38-85ec-7841dbe28cb9", "comment": "Malware payload (Heodo)", "value": "57a6b00ff88a7e6b31c46402a613e382", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072196, "uuid": "da9b5085-3ab0-469c-972f-03ebd5cc6e6c", "comment": "Malware payload (Heodo)", "value": "72a43f286da24854d23ac2774de7b19d41588ef15a2332f9c7b51dcde9e3ba0f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072196, "uuid": "121aeb24-b4ab-44c9-9df5-b1957de1b7b8", "comment": "Malware payload (Heodo)", "value": "a3411a40f73c1daeb47f01650e6c197b19354006", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072196, "uuid": "02fc1b76-2deb-4983-a0fb-3470fa1ad54f", "comment": "Malware payload (Heodo)", "value": "580187bada90025e055fecfdefc090e11ed21d74223478ab28b7a468b21974a368eff28de9155645409d8bd4e44fad44", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072196, "uuid": "3c3e2eac-e223-4fe6-af80-a02ed75273aa", "value": "T1B944BF10A181D036E5FF087A89FAD9BE466C76600B80DDDFA3981C7E4F6B6C1763059B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072196, "uuid": "614016a6-2969-483c-b7a1-8d0f1b3769a7", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072196, "uuid": "31c7e513-8c65-445f-9b4a-d5c4fe7e73b1", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTB+mgL/S:Wvef8+h61mRcHL+rF6l5EAQWTOL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639072196, "uuid": "676c66f5-fdd4-45cc-a347-aa5b69341808", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639072196, "uuid": "dfeb931b-7707-4e31-8c9f-4cf0cd490f19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072196, "uuid": "d88ed676-868c-43ae-98c7-a428226984c3", "value": "1eJJ.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d74800-5883-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639008077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "5d4400d7-a43b-4f2d-a7b1-fa1773b5da58", "comment": "Malware payload (Heodo)", "value": "7ecd95bcff289c4dd77ac17b1bbbdb44", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "2f69c9a5-4ae0-46a3-8c88-cd403d023a80", "comment": "Malware payload (Heodo)", "value": "73006582bc52e09efa8523e5dadcb68fc3af7df4e7f4b04b154a008517eb2e30", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "f80f1da2-0442-441d-9967-da9ef6e6cc58", "comment": "Malware payload (Heodo)", "value": "6c5020f9584d8b0037816f388409a0f7bdb221ec", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "0a10f207-5a14-48f7-8efa-18a2ac9d4ee4", "comment": "Malware payload (Heodo)", "value": "0b2ebcb5711f27f9ff6b9e115f2f9dd0b0e01af67ad8b2201e926f56c5a7e0fbb4ae16ec3f861a27d46b0b2455c9c1ad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "7c454260-26c5-4016-aa63-e9a046848935", "value": "T14544BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "40484826-00b8-428f-bae3-e26e0412b7b3", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "95d4e180-1e60-4035-8a48-7f13d1f66c0f", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTB02ypv:6jIG/pjjuLbJLmGshoCUnWT4pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639008077, "uuid": "9a2f5a0e-0e78-40d5-a3f1-a41073e87fa5", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639008077, "uuid": "cee105f5-7afd-4143-afe7-d66f3e9c6387", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "8aae10fe-ef1c-481a-9ecf-df8f4c1f19ce", "value": "emotet_exe_e5_73006582bc52e09efa8523e5dadcb68fc3af7df4e7f4b04b154a008517eb2e30_2021-12-09__000112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad2b312-588c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639012226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012226, "uuid": "5dd087df-0bce-4087-a5fa-d2aed2c6b18a", "comment": "Malware payload (Heodo)", "value": "c0c6bbad01fa6d776e7075e3b0239620", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012226, "uuid": "5c7f1566-090b-4c6e-974f-b0ba7b6d83c3", "comment": "Malware payload (Heodo)", "value": "73219c18a83518ac23e6cebdd132cbc09f799b64b5e6cdb1badac00935489636", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012226, "uuid": "911b1fab-ef44-4b59-be6b-806aba3bd62c", "comment": "Malware payload (Heodo)", "value": "43ca62f3486df3fd72c0bf728d90bfeb27343f53", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012226, "uuid": "423b3173-48a9-4a09-9701-141fa151c04d", "comment": "Malware payload (Heodo)", "value": "e34a35ebf6c5ba3edfddaeb8f7bc10b6d225d68cb6f443754a9c5d394c323b1390d8be7778248b1cdcb6087688b7e50d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012226, "uuid": "a9dc7ba4-be88-4cae-88a1-b1dd2e999477", "value": "T1EB93F1DBD299EE6EE5E7D438D1BBA0E927228026C1685EC181CDCE8C812C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012226, "uuid": "40efb508-cc1d-4f0f-8e97-9c4b8c775046", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySs:Gp4Z3MYeGt9sLBrGrSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639012226, "uuid": "9ed5f2a4-fe5e-45d3-89d6-686aee3d0eeb", "value": 90141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639012226, "uuid": "599cd981-e50a-47e2-af18-d6634a8fac24", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012226, "uuid": "2be34c09-24ee-4659-92f2-6927466bc731", "value": "emotet_e4_73219c18a83518ac23e6cebdd132cbc09f799b64b5e6cdb1badac00935489636_2021-12-09__011014224351._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57db9cf7-58ef-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639054553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054553, "uuid": "82b36eec-256b-4dce-8144-f6e5f09aaa8a", "comment": "Malware payload (AgentTesla)", "value": "5547672b20c45e017fa87b847f95a51b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054553, "uuid": "108bfd27-7b97-4c0d-8725-4b4ab456ae54", "comment": "Malware payload (AgentTesla)", "value": "7342ffcdcdd7fc489e21c83560a04d073dd08190bc9e9d66ce8d99ded0d10e1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054553, "uuid": "8fe33002-3e68-4793-ac82-f53e15279b53", "comment": "Malware payload (AgentTesla)", "value": "2404d258ef763633902cac3781a7d72da84ca6e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054553, "uuid": "7e41529a-9490-48b7-8d71-37bb51f1dcc0", "comment": "Malware payload (AgentTesla)", "value": "cfdab7a59d0f94bd8a35ae32eff6b6e81862ea054dd470841deafbba2d2eceee5b35c4592b1a80571757f47bfb111f7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054553, "uuid": "4be393da-abea-4b7a-866d-de398b273451", "value": "T19855131D29F465BFC1A95BF1C25790A0CAB8E0163DB2F2F55CC611BFB7385C99A02782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054553, "uuid": "cc3f9b3e-458a-4bab-beaf-65ad79160389", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054553, "uuid": "9ebc2049-64a1-4831-956a-af4b60c86bce", "value": "24576:+IKjy/SYCpXRSGtBW553B8YzkuLgDQVUT5YUEeeUbVBAjqsS6sRE++:sjASv9BW5oB8gELFLUbXzs/sRE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054553, "uuid": "f71cbba1-7fe9-458a-9b7a-c6a828edd6bb", "value": 1307136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054553, "uuid": "efbbb1a7-7e15-4f17-9d82-c45c399be241", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054553, "uuid": "ab494c18-e21a-43df-97e5-28df3d277572", "value": "Pago completo.pdf.________________________________________________________________.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f281d5ad-5893-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639015299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015299, "uuid": "d00be0d0-7a99-47f8-b741-b52a4f18936c", "comment": "Malware payload (Heodo)", "value": "5b848880b8b86835f583c64395bdf2a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015299, "uuid": "57d35b02-5c66-4cae-a93d-92427c434d09", "comment": "Malware payload (Heodo)", "value": "734c95d2b84120651502613fbec17f05bdbd695dc16c11e97653df7dbe1c6552", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015299, "uuid": "b63b4e17-c26f-4f05-9be0-1118a7baeb6e", "comment": "Malware payload (Heodo)", "value": "3f3ec861d75de12626f1dc853b050e8e5d46df8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015299, "uuid": "40af9692-a9b3-4a3d-8a84-67b57dd374ee", "comment": "Malware payload (Heodo)", "value": "61f64ecc632e07238d72e72f39ff735f1b9490cefa99400666047a722e043e0a92aabdae2cd39a5fdd9f9ff6840c1634", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015299, "uuid": "46779b10-6919-4bc1-8860-02e952be9fe8", "value": "T1BF44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015299, "uuid": "522f8be1-bcb3-4f13-b01d-921204a21d16", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015299, "uuid": "1951eb3d-1b4f-44e9-aa32-03d8b41d2db1", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBP2ypv:6jIG/pjjuLbJLmGshoCUnWTVpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639015299, "uuid": "50b7d901-0dec-4418-8ed9-336d00e93968", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639015299, "uuid": "2cce093e-a0e2-42a3-bffd-bbe2182f962e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015299, "uuid": "7dbece02-335d-4f72-b80c-04167d045722", "value": "5b848880b8b86835f583c64395bdf2a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7035cb2c-5940-11ec-96a4-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1639089383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639089383, "uuid": "6db006f8-379d-4d48-8b1f-9737542063ba", "comment": "Malware payload (Amadey)", "value": "0baf86bc85c38681c2b88deb869cdd74", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639089383, "uuid": "ade4c618-903c-4f20-add4-fe202678f02b", "comment": "Malware payload (Amadey)", "value": "74bb6b2e6e0fb719237cb58c1ed17a91032ff3c8a3c11da92011b8e0ba5a1179", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639089383, "uuid": "590df93d-703f-4f01-aa79-b46fad3a662a", "comment": "Malware payload (Amadey)", "value": "1085d5be3068954b550f300f7f16e94a67dccfc3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639089383, "uuid": "57580f63-934d-4a29-b56e-a8ff43a15157", "comment": "Malware payload (Amadey)", "value": "d6b17f5be5c8f7fefcf33103e87eeec0199bf4afc1720b52b309f26f4fd8542c1bc15f4f5ca3805c47838cee1f67f2a7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639089383, "uuid": "cfda8ac3-cdbd-4835-a9ff-68bc8ad84c8d", "value": "T14017331B8F6460E3C58F053A90B6FEAF161E83AA613D7F59A3800CCBEF76D0D8499545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639089383, "uuid": "b195b4e7-7ba6-47ed-8b0c-e2e048b0cf22", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639089383, "uuid": "ae6ad047-123c-4793-b6aa-d9b9d9fba3b4", "value": "393216:J4eVt/535sASLCqk2tgc+A9X7XSSoA/NGQvWHMrcu:JhVJ5J4XkYgc+ApXr/NGQWHMrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639089383, "uuid": "a423219e-81a7-4e42-85c9-7023504dd672", "value": 18799883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639089383, "uuid": "500c80a6-cf4b-47eb-bc0c-6f331f76c687", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639089383, "uuid": "6379b9ba-78c4-41c3-9add-0a9e4c5333bd", "value": "0baf86bc85c38681c2b88deb869cdd74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69cf5d3-58e4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639050041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050041, "uuid": "86ac72a2-456a-4397-8e0c-5a5bc4af317c", "comment": "Malware payload (Smoke Loader)", "value": "a7b8bb9f2aaf5c1a07af5fdfabb2a1f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050041, "uuid": "3fd16f69-68c9-4ed3-84ab-74c0ec035ffa", "comment": "Malware payload (Smoke Loader)", "value": "74e0750c52b67b6b099f46086e04d2a130d95dd42a8739289abc0395862e3e2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050041, "uuid": "016e9cfe-5191-4224-be50-c2b99ce2204f", "comment": "Malware payload (Smoke Loader)", "value": "e5d892d8c416d2768f12e7f45c8588a0c98f5987", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050041, "uuid": "5b654c7b-93d7-4d9e-bad8-fb973605a552", "comment": "Malware payload (Smoke Loader)", "value": "f149d81930c44e757499954fe0473055c9e31e8b4012adf6e64b36a12843ed45a9fc6b23168bafde6a10615f98751553", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639050041, "uuid": "aaabf9be-38ad-4b70-9618-2392c32988ab", "value": "T1F4549D04B7A0C435F5F712F849B693ADA93FBAB26B2490CB62D516EA1B346D0DC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639050041, "uuid": "cbf369b1-2486-4942-b40e-de30e6589008", "value": "1e7f53cbc09c74d2d76a753a16b82f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639050041, "uuid": "dfd1ebe1-6622-4f54-b240-ce09ff83670e", "value": "3072:6j0wfSey9q6S7WHwgZ9bPgGfKL5toPkuuMjzIQ5EThEbshMgN1QqLUBEDedWtwut:jSyHwgnPnfKL5yPkIzP5WSshMI+2D2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639050041, "uuid": "357dacc2-9026-4327-98b1-e9f54afd6978", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639050041, "uuid": "31ccf308-5fdb-4f93-b83b-c57bffb17ebf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639050041, "uuid": "b974124c-6291-4f82-860f-6f2c9634aed4", "value": "a7b8bb9f2aaf5c1a07af5fdfabb2a1f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8947411-58c9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639038475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038475, "uuid": "728b9929-9d47-4e5e-bb36-2e163158228c", "comment": "Malware payload (Formbook)", "value": "4757c7ef0c25e23c2cccf5cae5c7589f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038475, "uuid": "ce1abfef-0b15-45e1-9819-a5364c0a57e6", "comment": "Malware payload (Formbook)", "value": "751fc783c0fd9c101fffd71acf1b2b33a0c33356e3be4789f7f19f5f28b7a0d1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038475, "uuid": "6cc9f658-4ad9-43ec-898b-53cd2349a286", "comment": "Malware payload (Formbook)", "value": "2a5600e7a0288807cce56abab6c04dad4c37faf4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038475, "uuid": "9500ff4f-1952-4a0d-8c11-826ff845716d", "comment": "Malware payload (Formbook)", "value": "2269ae6346faa75ae4eb84ba3dd2f46b45cb5aac7a617345c9af5a2079fcd8c46ae8328c61740c46d6654115c09a1f45", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038475, "uuid": "e54c01ff-ea6d-43d2-a74a-67a539e758ec", "value": "T1F9253368F1F1B10AFC7C1F942AD348A17AB187164ECAADDE1DB71B536F440C8A7162D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038475, "uuid": "9ff7f61f-bf2e-4348-85fa-05727a76242f", "value": "24576:zUvaFm9V5vicX03NzhXzpHIWd46MJyKVnKZwj98e/CMuRn0UVOmn:zUSFaV5v7X0FhXFHIWd46TKVMwx8e/Cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038475, "uuid": "076fa0af-a725-4b86-af6a-f47892464758", "value": 993430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038475, "uuid": "d5fecbdc-e445-4496-950f-ec2f4a7dc1aa", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038475, "uuid": "5097526d-a9fc-4a1b-a516-221e5dec6d65", "value": "Signed the Confidentiality Agreement attached-PDF.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e520c396-5907-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1639065098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065098, "uuid": "b35c87e7-d1ef-49b3-9dba-0815c8a42bf7", "comment": "Malware payload (TrickBot)", "value": "bc4efa601376705459a082186ee97bf0", "object_relation": "md5", "Tag": [ { "name": "100021", "colour": "#B7B903", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065098, "uuid": "37fc2a91-d3c4-4e04-a4d9-34c71fe93247", "comment": "Malware payload (TrickBot)", "value": "75578e9d4935df53b648e93ee37cbc406d815a3a7748a60cccd0a74978baefd0", "object_relation": "sha256", "Tag": [ { "name": "100021", "colour": "#B7B903", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065098, "uuid": "f62c12e5-33b4-4ed1-a44c-ea6dfc8dde82", "comment": "Malware payload (TrickBot)", "value": "6e1702946cb436f06cef2dff06de148bbe47bdb5", "object_relation": "sha1", "Tag": [ { "name": "100021", "colour": "#B7B903", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065098, "uuid": "664b90f8-bcf8-429d-a637-1501c8302021", "comment": "Malware payload (TrickBot)", "value": "1c3c8a0679121c029afdaa623c85c4e233637a61beb8db6a217f8a3d8f153a3f592277164855086c74459eef27530153", "object_relation": "sha3-384", "Tag": [ { "name": "100021", "colour": "#B7B903", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065098, "uuid": "7994c645-566f-456e-ad46-e8b2c0c2c955", "value": "T16D9549276DD2E0021C175CF69EFB56F4760BC84529224CA72B377645E0A6270FA6F38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065098, "uuid": "be0803dc-ab91-40fb-8eb6-46c00de7f937", "value": "ada2df5716cdc204b561f1444d64c9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065098, "uuid": "a30b8bfd-75f9-4dc5-b4ba-fc0889edc4a5", "value": "6144:qpXjcPUqviYVZFiKXJxDPbOoJcfgQwJ2vkeDkCSHVmrOISZKByfjYoxj:qpXjcPl7FzHebpID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639065098, "uuid": "7e9baaca-1d0a-407d-b5f5-4e51c391f75d", "value": 2057728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639065098, "uuid": "8ba82a15-90fe-41e9-b114-3403686cd51c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065098, "uuid": "e70c505c-38b6-4344-8e6e-31ad6704d6f7", "value": "bc4efa601376705459a082186ee97bf0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78821252-58fe-11ec-96a4-42010a9c0029", "comment": "Malware payload (BluStealer)", "timestamp": 1639061050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061050, "uuid": "7801635f-07ee-4bdf-8126-18b360c15e54", "comment": "Malware payload (BluStealer)", "value": "9b2d8c2fea9c8211a23e357acb74ebfb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061050, "uuid": "5e470166-0212-4d89-8cfd-45ea7a5a7117", "comment": "Malware payload (BluStealer)", "value": "75c424059e394ad7e7125ec89b4367071a5afe9c161bed0d1bf512992090439a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061050, "uuid": "c3047a0c-1531-44e2-af99-2134b4a2ba92", "comment": "Malware payload (BluStealer)", "value": "39fc2fede2e91564eb7e9802db4692edd1171030", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061050, "uuid": "54790e6b-7db1-4a0e-9090-96701b64eeea", "comment": "Malware payload (BluStealer)", "value": "a5c712d58dddd179f4d2febf3b2bdf77894d86b2e4dfa82a555cb50aaeb4be6b7187272e89a72d976e9acb03244640aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061050, "uuid": "1a121f8f-2e1f-4511-b790-debf2e42af3c", "value": "T179E5B28A7E46EDDEDCFC9271554DAD33EE223E4E350A2505F285B79FBA360623900439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061050, "uuid": "a3d67ef1-00bd-44cb-80ec-d39c68e0245b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061050, "uuid": "312f1ac8-5db9-4e47-bd99-475ed4087514", "value": "49152:17oYVQX7t7d6IfsnikIEDVLs0XfMXM4hRdQ:1HQ/6brDVnfMX/be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061050, "uuid": "60b64a14-9155-41cf-be6e-40aff9be1fd9", "value": 3320832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061050, "uuid": "dab21887-b833-4df9-8e32-3b8a74b4f48e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061050, "uuid": "1352ec0c-a5ec-401b-a86f-3a528dc09b30", "value": "9b2d8c2fea9c8211a23e357acb74ebfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224725e3-5941-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639089682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639089682, "uuid": "466b1ea0-4f24-4dda-9ace-1c6f316c1ebb", "comment": "Malware payload (RaccoonStealer)", "value": "38c877443429d4e53d6880c97093328f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639089682, "uuid": "b8bdcf40-3259-4c31-8e4e-3b804222fe80", "comment": "Malware payload (RaccoonStealer)", "value": "75ee041d609c1aea9ddcc8465bf7eca07b5184cdc2e6acd5f29380e6499ee3b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639089682, "uuid": "d45c88cb-d6c2-4843-94c6-6157823ce52b", "comment": "Malware payload (RaccoonStealer)", "value": "9861cf0f83aa4325088bde8482d14ca81dc29d2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639089682, "uuid": "49901864-795b-4bfc-b11e-6c63759c44c3", "comment": "Malware payload (RaccoonStealer)", "value": "0dbc42e6d3833142a04e81506ffc9e08cdb4830b3d2b02990bc9ecf92e16bbab3322385790997b5c82cf935d07320c3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639089682, "uuid": "f96390d1-59cb-42d6-8905-f95a19fa04da", "value": "T172C4E014A7B1D031F5B712F4497993BDA62F7AA16B3490CF62C566EA67346E0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639089682, "uuid": "e9f0a507-104b-4cb4-8f27-8df678bd609c", "value": "a766db658c80a835898573464756c1a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639089682, "uuid": "9899c2ca-3bbc-4472-bb16-a2648a559c7b", "value": "12288:4jbp8vaFQ1PzEfITXh5DgDgRNq66pXczsp/qRmY:Cpk6IYIrrg2bmXpImY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639089682, "uuid": "a534e998-6eaf-4732-ba4c-7a75fc5f19c5", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639089682, "uuid": "fd144872-0921-463e-a126-4003197daabd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639089682, "uuid": "4e276ae8-e13d-4868-8787-dac3027d2628", "value": "75ee041d609c1aea9ddcc8465bf7eca07b5184cdc2e6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be9c398-58cc-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639039528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039528, "uuid": "da401120-db5f-450c-bd96-5fb82ccd55d0", "comment": "Malware payload (AgentTesla)", "value": "1dd670b688ed532b60667cfd320f9e96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039528, "uuid": "f1744faa-2b05-439f-9591-36644ab758a0", "comment": "Malware payload (AgentTesla)", "value": "771a4529468d690015334ec925af00ea289a095752e0cbe298462b9ff5025a95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039528, "uuid": "5645fd6f-2806-43b1-a5c8-4a82fa07177c", "comment": "Malware payload (AgentTesla)", "value": "110b64da0f00237172a4661aac08495ba9e12e18", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039528, "uuid": "de7f7802-a1c9-4c46-8f14-df7b5c3707bc", "comment": "Malware payload (AgentTesla)", "value": "612939a64169c51bd7600a9547dfc46b68eeae97c77f2ae443f824013642b3f37eb3c6048f3ca49659f69b697e28a92f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039528, "uuid": "9a8f2585-7f24-4f84-9631-5452fe3b3123", "value": "T123A39D637694E051C1A9197ED873C5F90BB37E11CA12C90B72C4BF0E3AB77839A63646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039528, "uuid": "4337abbc-ce72-4482-98b6-2fce2f417644", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039528, "uuid": "67575e7f-d863-465d-af3e-6782e1f7aca8", "value": "3072:MaLQ3Br/Xe9GXui4HixpUuHd7mzlLOXs/GKrHzF:849AxpUuNmhLw8G+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639039528, "uuid": "b3333471-ff22-4196-bcf6-33b7ccbd8d53", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639039528, "uuid": "526da136-744e-42a4-9743-df388d5b0c3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039528, "uuid": "dfa6bb34-a2a6-4521-8a41-ef9c229f24ab", "value": "ConsoleApp9_P40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f14a16b-58f9-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1639058968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058968, "uuid": "7f773c9f-a6aa-4e2e-a188-92f96f9f378e", "comment": "Malware payload (CryptBot)", "value": "4178889644ee16b35980aa93efa56a6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058968, "uuid": "7984640f-6031-48e1-ae45-ddde08902b7d", "comment": "Malware payload (CryptBot)", "value": "77780592f36ea632562e85524013043b817b528f8fe79f09cc2a6558b56ec9d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058968, "uuid": "1c31c6ae-49b8-4d54-885c-3e0064ce887b", "comment": "Malware payload (CryptBot)", "value": "b958d90841b93ba18fa9473c40eefe835d451653", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058968, "uuid": "ecc23621-839c-48c3-9825-93f464cfb46a", "comment": "Malware payload (CryptBot)", "value": "ef0d58f52544f358681b15e768dfb4211de01dc2394649ab045425217861bf9c75fdab96d4f38d4b1ea69ea48bdf526e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058968, "uuid": "7ff318f8-ee3e-485b-997b-ad82ff7603cc", "value": "T19C84CF00B7A0C035F5B712F4597AA3AD6A2F7DB16B2491CF62D026EA5A347D0DC7071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058968, "uuid": "121ac38b-5c6f-44ce-9dea-3caf3ba3b259", "value": "1e7f53cbc09c74d2d76a753a16b82f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058968, "uuid": "137db3ff-45d5-4aa3-94e3-7271ad4189bf", "value": "6144:0e9j/CDq1TpCWfegr6K6BPm5Nf9flv2AchxcHaC7BqIsq:78A+K6BO5J9flxMxcZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058968, "uuid": "d59921ed-2f73-4a36-8ca6-843ef6ff4379", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058968, "uuid": "9b14b2c1-2c7b-42cd-86d2-9985fadb2665", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058968, "uuid": "cc35ce26-896a-48b3-982a-e43f66a0b144", "value": "4178889644ee16b35980aa93efa56a6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83743b7c-590b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639066652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066652, "uuid": "93f13d3a-d0d7-47ea-a87a-1357292a34bc", "comment": "Malware payload (Heodo)", "value": "d5416402f9c4890499837462de9745b1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066652, "uuid": "9c552c90-388a-452c-b91d-2e939bda4e3f", "comment": "Malware payload (Heodo)", "value": "77eb108ef31a5a559cd861c6fb184724a3cbacc7bf9b889d7157c2fabcee6a25", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066652, "uuid": "c72e927b-cdc2-4a20-8b53-5ed780fc36e5", "comment": "Malware payload (Heodo)", "value": "b83178aa2673f77b6a51eedc98ec41a4736bd66e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066652, "uuid": "51fe9a33-753d-469b-846d-28278d74b85e", "comment": "Malware payload (Heodo)", "value": "6bc1a20111f6b21dd2394a042bd9b95e737b05a753a578a06ec787ede1b08065ab11f81c7b1e90be6805644c2f2ffda7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066652, "uuid": "5ff01d6d-fd32-42c4-b80c-69e38172ac03", "value": "T14F9301DBD295DC7FF8F6D438E4BBA0B823728171C15C1E82628DCA48812D5C697FA2C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066652, "uuid": "d0188f9f-542e-4839-9511-870b6e19651d", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbztC:yIBQ3MYeGt9sLBrGrBztC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639066652, "uuid": "6f2e3572-7d04-4868-996b-1b628dd6be23", "value": 90159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639066652, "uuid": "b787e059-e83a-4691-a7f2-3067b7247096", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066652, "uuid": "71ec1fbd-698f-4899-92f9-5b6784e9783c", "value": "emotet_e4_77eb108ef31a5a559cd861c6fb184724a3cbacc7bf9b889d7157c2fabcee6a25_2021-12-09__161719642082._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6f6058-58cf-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639041010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041010, "uuid": "6d5ba814-8237-4676-84b3-f23ea1e63f69", "comment": "Malware payload (Loki)", "value": "4daf5fefa37b93e9d7ff417ff531ff86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041010, "uuid": "2fc43e2f-3279-4471-b330-e8d7bf7d7e3d", "comment": "Malware payload (Loki)", "value": "78306c46527c2f5d6d8584fd2c86a80e37c6a9a423dbef60317bb98c911a4a10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041010, "uuid": "25294ace-4cb9-4929-8795-b7a7397c4a90", "comment": "Malware payload (Loki)", "value": "53788bd038c41afc9cb028a39192125af0ffb04b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041010, "uuid": "b1a520b9-80c9-42cf-9d98-fb17febcf5e5", "comment": "Malware payload (Loki)", "value": "a5b439ce89153f0e91ff8cc32aa5560ec20d8a2f5c66e075698d8c43a3ebb59477b640ee12b1c8a62997692dbcf36f12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041010, "uuid": "9998eb08-6baa-402f-ba7f-8e6dd1f38b8b", "value": "T14515230921AAAB14EDB84D30713B85031B76FC98BD65F72E79D071BC0EB2F4D4A47692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041010, "uuid": "506e29bf-e4a8-4c97-bbb3-e36417684873", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041010, "uuid": "c23bef41-588e-42e1-a240-c204a6ac2fd8", "value": "24576:jIccOiNQbmFTknMwG4DoVhA3OHcHyDX18ta:TiGmFTwMwGoorKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639041010, "uuid": "abc23fd2-8eef-4452-b943-c297bc91461a", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639041010, "uuid": "aedfc855-8c5e-4360-937a-a5a160ffb54f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041010, "uuid": "73d5d643-1049-4f3e-b8d2-3cb5a5d2d6e0", "value": "4daf5fefa37b93e9d7ff417ff531ff86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0362338-58ed-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639053923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053923, "uuid": "f4b38aaf-f320-4972-901f-e2aa8c532f5f", "comment": "Malware payload (Heodo)", "value": "62ae71b19bbc0664cdf06bd0fc63d383", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053923, "uuid": "791de31d-cc57-4eb1-90d4-2d7e688b33fa", "comment": "Malware payload (Heodo)", "value": "78a7200badb2f8666b93a937d2b328756fe350177c7bc9025e54269777e49208", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053923, "uuid": "4d831e3c-4f80-4e02-91b0-1b8cdf3d7ba8", "comment": "Malware payload (Heodo)", "value": "a07a7f5b5f87c44e437f6ad1ccaf60c18e9bde50", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053923, "uuid": "549c689e-dbf1-42db-b88b-5b265102f739", "comment": "Malware payload (Heodo)", "value": "ae6eb2a25e6540c9e8ba3c1e676521e630ef27bf9457df52d2b861b3de4181be1418b458c6cc5c89507217fdad09cf3c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053923, "uuid": "b77f152a-b4dd-44a2-ab39-c1efbfb7ae81", "value": "T13844BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053923, "uuid": "f42d392c-a9e2-44f4-8fcc-ed604b8386cf", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053923, "uuid": "13a122d5-188b-40ca-b916-7ed7d64980a7", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBV2ypv:6jIG/pjjuLbJLmGshoCUnWT/pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053923, "uuid": "537d7fc8-a03a-4633-abbb-db4034286050", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053923, "uuid": "352a554d-4eaa-4a94-b629-96608fc73908", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053923, "uuid": "7fd12cde-4c52-4300-9199-735a0d61c2e5", "value": "SsCPvL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef047718-5918-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639072416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072416, "uuid": "eba1c8fb-26c2-4b9c-af11-11b4736330c0", "comment": "Malware payload (Mirai)", "value": "7c5323c8021572a5e391d92b2fcd5902", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072416, "uuid": "79e19b9b-949d-406d-b4fe-e1c8ea6ea443", "comment": "Malware payload (Mirai)", "value": "78ff4e9cdd8493c7d631e4620442ff585c87b6655bdc9c53de9913c9967937c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072416, "uuid": "9fa79f12-e2e4-4673-8649-d64d5c68c316", "comment": "Malware payload (Mirai)", "value": "2ded65b6fd299b623f4f773f35e556327ac6efbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072416, "uuid": "5b55e287-ab5a-4bed-968e-930aca922220", "comment": "Malware payload (Mirai)", "value": "580667a11800a0d3abbe148ed94698259d7a8c9e813c3c9802a8cbb01210339c9a35f61ee84dc92630b9c85775b101af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072416, "uuid": "c0a94237-66f7-4440-a594-2950584614ca", "value": "T106732A8B64126DACFD5BE97581220E0AF82132125FA31F27A6D7FDA37D23190DD0BD16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072416, "uuid": "6adcea02-440c-44ac-8ee1-0f52a4fe0842", "value": "1536:7otNVzhZyv6TqCr4N07Ov4g1pZRIT1mjEXr436R+ZT08T:7QVzE/vdp+sMJ+x5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639072416, "uuid": "6ea90fca-80bd-4b33-8035-eed96bee0bc0", "value": 77328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639072416, "uuid": "1dd9126b-e09a-4e68-aa1d-e126f01e6379", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072416, "uuid": "0484b2c3-2d0a-4d83-88f5-239420f67191", "value": "7c5323c8021572a5e391d92b2fcd5902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd2443d-5902-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639062885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062885, "uuid": "35016881-1556-4a26-842f-3221e2d1dd48", "comment": "Malware payload (Formbook)", "value": "35419b03cee338eead08d7da57ca60da", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062885, "uuid": "e7770c9b-6688-40ca-98d8-50a8b74db4b1", "comment": "Malware payload (Formbook)", "value": "7afc2680c7b626c2cbe1b888a14dbf791b7bbcc4619f0a1a7afa881e14aa2269", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062885, "uuid": "78f56ef6-f4e7-46e1-a736-e71a3448798c", "comment": "Malware payload (Formbook)", "value": "65f12c5f45a1aae63ec0ca54e49f99121bf3df70", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062885, "uuid": "06555f00-26ba-4627-a920-f2b08a46104d", "comment": "Malware payload (Formbook)", "value": "153f7d89f2757add869e8fcc27ea229a767b240efbc4b1c298ff0aa31b7bbd9ffd0e63539d83afa7f66685fcb16d4007", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062885, "uuid": "63c9b793-5a1a-4437-b4cb-f9aa5b0aac62", "value": "T154841257B6D10496DCF60AB60871AAA6A1F71CAC41F0511F778D3F2B3FB3193094AB4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062885, "uuid": "24e07c4e-a6a2-4b01-a05b-831ca7079a52", "value": "6144:aGi4zy1TUZP1g/jEKAqNJncZndI0dsuUGucqtW4j/bz/x2ImkJCxA6G:hy1omwWdapsBGucp8bz/sJkY+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639062885, "uuid": "5e6fc4ff-691a-44f2-b5e8-1bb452fc54d8", "value": 391168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639062885, "uuid": "7361cb7e-6b5c-443f-adf4-89c12cd90314", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062885, "uuid": "a5bddc74-9ce7-4c27-8e2b-2e6e658a0c5d", "value": "Salary Receipt_27845 pdf (3).iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c41f2d-589a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639017958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017958, "uuid": "74368c57-eeb3-4192-bfd9-7ca3089a6198", "comment": "Malware payload", "value": "170ef6e8b8a73c3e42ef2ce0b5517db9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017958, "uuid": "47923415-de46-4dfd-9b87-3798ae43ca51", "comment": "Malware payload", "value": "7b6cecfabf1bee2bf8e81a4ca3a9f4358e360817ee1b3b9221999f5c50433136", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017958, "uuid": "d17d8778-8337-4eec-89d8-a7ca33824355", "comment": "Malware payload", "value": "b3b6e9e97abb5720ed2e881ea1f5327af3659177", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017958, "uuid": "ad062750-f4e6-4e72-8173-2d18678ee7cb", "comment": "Malware payload", "value": "0ac2c971080941d880b60ec2f36923d4f7eec57b3be3c8bfc9ab435a2bb081a1f1734ffb86c467cfb59e87a5a2779b15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017958, "uuid": "687ebf7f-cb89-4f29-b2e6-01c00e01dfd6", "value": "T102C3271276418471F70D0B304946FAE04AAA9D3D5AE4E48FFA7C7E7A29312C31A7725F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017958, "uuid": "a2a0532e-d21e-4b34-a601-07c1a5ad76d1", "value": "d8130762549d8ab8e3c12e25d2f5f0e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017958, "uuid": "1ff09237-5045-4bb7-8265-c99dd651ec61", "value": "768:4Ke6r0NVnxxS6vobyOlWUpN3RdO6jVTBR2r/A7izRGUR/lHJ/d2uoe5N1Eyw0trC:b3aV2xblpbOUf2U7Y1P/dfLttr9pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639017958, "uuid": "926e4295-3f93-47d5-96a7-3de0c4762d37", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639017958, "uuid": "79f91082-24af-4480-9aa3-da65bc6867e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017958, "uuid": "9ae0353a-56fb-4ee2-85b0-245366cc497e", "value": "170ef6e8b8a73c3e42ef2ce0b5517db9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16743c77-58c9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639038123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038123, "uuid": "4cb2f8cd-1bee-4a5f-a354-694b2f8f814c", "comment": "Malware payload (AgentTesla)", "value": "daab149079feaef4b0d748dbc773eaa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038123, "uuid": "eb235340-54c3-4cd9-90aa-80a4b8af3ce6", "comment": "Malware payload (AgentTesla)", "value": "7c259d21e41a48bfdaa18657208f2765dd653b57a66067f0af61c4e42da34141", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038123, "uuid": "5d05abd5-87fa-4373-ab3a-86285d66ba78", "comment": "Malware payload (AgentTesla)", "value": "cf2b47095af6036953b2636945c5e3efa2f54cd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038123, "uuid": "0bd9cb56-b221-42c8-80fe-1fd78c862561", "comment": "Malware payload (AgentTesla)", "value": "65b0cb70ad208bc868ed3d4f54c2be42f355863bcae73e6aeb0adc78b018d34ae3b67261dc63b8277781f6db57c3f320", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038123, "uuid": "c460e4b8-05ee-428c-89dd-b150e1f61d00", "value": "T18BB49D2137891F12E839AF7800E18D6013F2EF29D7D2E71BBDE42596586EE814E62747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038123, "uuid": "07ba592b-5e85-433b-98a5-17dea5c2a095", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038123, "uuid": "7a9113b7-38e4-42c7-bb34-f561e7abea18", "value": "6144:3eHf3H9Jq0SuegVGJxyf18BPjO0flodz1h6qPYX6p+nXoEZaEPy4:3eHf3dbzVuUeOzdz1zwiW9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038123, "uuid": "d4d9704d-564b-413e-b258-7b7dc924ac92", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038123, "uuid": "fd443be1-53ad-489d-a602-dfb7e5da3c37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038123, "uuid": "f1162949-da23-4cf5-8744-046cad872ed2", "value": "daab149079feaef4b0d748dbc773eaa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385989bc-5908-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639065238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065238, "uuid": "05427a27-7351-4d5b-9f0b-46607d7e1a3c", "comment": "Malware payload (Heodo)", "value": "fb14a0e62ab1a5c6c32c0a435f293aec", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065238, "uuid": "2f4c4172-2145-4b03-a893-1ac0757fa373", "comment": "Malware payload (Heodo)", "value": "7c73a4da90b895e4add6c77b040582e03c9b358a4e9c2eb9d6c121371e2de1ce", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065238, "uuid": "484e98bd-d79f-44fd-94b4-82273df06463", "comment": "Malware payload (Heodo)", "value": "8505310deefb38b290aebbe75baf019bf891ba0d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065238, "uuid": "e62a0ab7-b8db-4353-9a6c-2dfb3fa3aed8", "comment": "Malware payload (Heodo)", "value": "94fcd639832dab90befdd58020d7fe26388af39bfb8a3212fe490c58b27eca914e4cd4d81b03e6b496869ac13b516de4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065238, "uuid": "94814eb8-325e-4582-b739-8accc62da5ac", "value": "T1879301DBD295DC7EF8E6D438E4B7A0B827328071C15C1E82628EDA4C812D6C757FA2C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065238, "uuid": "a31feb66-f5e9-4921-b556-2e86d2fc0120", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbo:yIBQ3MYeGt9sLBrGrBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639065238, "uuid": "81dfc9f0-d05d-480b-bb8c-e1cd68a1f4a1", "value": 90157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639065238, "uuid": "e28c7b85-0349-483d-b68f-9846dfd1cdd5", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065238, "uuid": "cc74a087-8874-4556-9208-1168f6a3b316", "value": "emotet_e4_7c73a4da90b895e4add6c77b040582e03c9b358a4e9c2eb9d6c121371e2de1ce_2021-12-09__155342168576._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991d5f2d-5905-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639064112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064112, "uuid": "40bb1c24-a4c6-4b26-a67a-069b9d16731d", "comment": "Malware payload (Heodo)", "value": "675bd62fed57895df0430592a63b6bf0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064112, "uuid": "27a1a5fc-c042-406c-94f7-1f8b627200d8", "comment": "Malware payload (Heodo)", "value": "7d50155f2fd02aa6067f653d01ca3cd296b9851974f23904b601fbffdff9fcde", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064112, "uuid": "0473da07-5395-480e-9bb5-f927b0a1dc83", "comment": "Malware payload (Heodo)", "value": "58fe170f8635127466b8f2f5c681d61aa8989059", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064112, "uuid": "cbd4f798-0fc3-43eb-af45-4953da02fd8d", "comment": "Malware payload (Heodo)", "value": "2c212607e4dc87a0686c8c249d3f25a0bae02b2bc1c2a88f1b1af52e0a9debbf4c02075abfad2356372df2297e63acab", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064112, "uuid": "44c572b3-9b92-4856-94de-eebeb01800fd", "value": "T1559301DBD295DD7FF8E6D438E4B7A0B827328071C15C1E82628DDA48812D6C757FA2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064112, "uuid": "4fcfa3db-16ce-423d-b3de-9db751b322a2", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbM:yIBQ3MYeGt9sLBrGrBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639064112, "uuid": "4b5decee-6626-4794-865c-3988a803f05d", "value": 90154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639064112, "uuid": "ce74f46d-848f-4bfe-90b9-d55e3c2835b3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064112, "uuid": "505adc7c-651b-46e6-a3f2-c9c2606e6dd1", "value": "emotet_e4_7d50155f2fd02aa6067f653d01ca3cd296b9851974f23904b601fbffdff9fcde_2021-12-09__153416675339._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44412924-5946-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639091886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091886, "uuid": "6e4fb124-ff49-4d48-b7ec-7377537c979a", "comment": "Malware payload", "value": "8e1f22dd9e809ead5e19b340b0c80cae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091886, "uuid": "46651f4b-a70e-430e-a347-a0e08256e77c", "comment": "Malware payload", "value": "7e363b5f1ba373782261713fa99e8bbc35ddda97e48799c4eb28f17989da8d8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091886, "uuid": "4fdaf560-1fb1-47f8-9e2c-2c7256ae2c4b", "comment": "Malware payload", "value": "2a53525eeb7b76b3d1bfe40ac349446f2add8784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091886, "uuid": "24f0d9ad-7506-4f6d-9892-6e1fecf6149f", "comment": "Malware payload", "value": "b313d2f5daaca487b1d5f89c38a43c3b76a5a3e6c4f0ffa4c22c222c68c3634db72233fa4a4536e90c835487877c1847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091886, "uuid": "78f6422f-8057-4197-8941-bd85e60be866", "value": "T11BD59E96F643E2EDCDAB1970301EB37AB631481D012D9F53EBEC4D21BE2E7111E8561A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091886, "uuid": "96044a8e-0a49-4304-8076-540122b30321", "value": "5feb41f9ada7e8fa6318152083f47928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091886, "uuid": "917c9801-7080-4eb5-b57e-3d32e6661b30", "value": "49152:2nvp+Zzw4dyY450JZRg/3a4aYstmTUVciEeNq/RgaJ2wQc:2nB+pLdoQz43a4PcGiIvwwQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639091886, "uuid": "b104faac-ad4a-4f90-a29b-ef20c2b11b17", "value": 3005440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639091886, "uuid": "e228df73-037e-4da7-8e85-f03ec7fafe63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091886, "uuid": "57994aa8-6986-4482-9784-b90298fd31bf", "value": "7e363b5f1ba373782261713fa99e8bbc35ddda97e48799c4eb28f17989da8d8e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8efdee2-590f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639068433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068433, "uuid": "f29b8661-ff52-45ba-bee6-dc1b18a4903c", "comment": "Malware payload (Heodo)", "value": "f3b74886e8a0b066c2a00e1570c2e43e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068433, "uuid": "7ad4dec7-832a-498f-b417-4b80a70788a7", "comment": "Malware payload (Heodo)", "value": "7e3e9faf7e9f086d7b301d03f312aca9aa2ad6a6843bf2bc39b1160f176d2a02", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068433, "uuid": "47204499-edae-4e32-8b8a-1620d3837278", "comment": "Malware payload (Heodo)", "value": "394150b0c990b8743b00d722002c3d6876ed2996", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068433, "uuid": "11747b4e-7a3b-4bfa-b32d-3d17a4656e07", "comment": "Malware payload (Heodo)", "value": "494fabb37b8b86712dc1f541879a12f9fe95d22fb3e8e0c01d694e69ea622500d249ea9287399ea3b860196ce1ec3dae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068433, "uuid": "4ff8d4be-7695-4ddc-9863-d8d627c5c1b3", "value": "T1EA44BF10A181D036E5FF087A85FAD9BE466C76600B80DDDFA398187E4F6B5C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068433, "uuid": "69829840-83a1-4681-bc24-66713c24bfc9", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068433, "uuid": "ee566efd-bac4-4e7c-bb38-b203545809f4", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBHmgL/S:Wvef8+h61mRcHL+rF6l5EAQWTPL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639068433, "uuid": "fd75400d-da0b-442c-81d6-0dfd226291a8", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639068433, "uuid": "ad5ffa99-9a01-4dd0-a4ee-512e6b54bac6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068433, "uuid": "0c804fc9-b190-4a8d-89c7-12dfd5d5c3ae", "value": "u.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2697c738-58ef-11ec-96a4-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1639054470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054470, "uuid": "ea994336-ca07-4e2c-aa40-d72d03b516d0", "comment": "Malware payload (STRRAT)", "value": "d86eb37fb515a419f7d154c0e0e915e5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054470, "uuid": "ce4276cc-240f-41c4-8875-4eca7464c6db", "comment": "Malware payload (STRRAT)", "value": "7e46aa47cfe108b7d8113725729e70a96bae5ef32686e7e41cbc56ca76aae58f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054470, "uuid": "a8574520-0383-4200-9501-639cadc9dec0", "comment": "Malware payload (STRRAT)", "value": "3817f60df66abe6278cf7bf0e0d8581e0a448cd2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054470, "uuid": "a4bc4526-3865-4b77-834e-62014f98bdd0", "comment": "Malware payload (STRRAT)", "value": "1560fb7dcb1878af3daaee668d8d36fb369bf784630b23d86f731b82c7a24f7e3c1d9ab2b7e80454e3efa84b91322c4a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054470, "uuid": "999442e3-868b-48c7-9adf-e4eb1455cae1", "value": "T1A004BF126FC4BE5C496BA108A0B70056A1E41ACDEC78B6C5F53FBF1B3BA1C8427D65C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054470, "uuid": "1eb5ba5d-78b3-4eb2-8121-0705f200958a", "value": "3072:hTcU5AMuEhp98ihStQwW9puXC7kqpiw9QESb/JqKgRP7CguIs+V0Os0WnthWKnK:KU5ANElBw2uXC7AnLgP7CpyGBWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054470, "uuid": "98ae1973-f287-47bf-83dc-99b80bd5bc47", "value": 188660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054470, "uuid": "d0543950-51c5-4c62-a4d8-fb17b23e3a5f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054470, "uuid": "562cc506-66b1-468b-98f7-7dbc7769ef25", "value": "Request_For_Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d154bf3a-58d8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639044878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044878, "uuid": "f0a1e66a-659b-448a-9820-e5f1fcc7a532", "comment": "Malware payload (Heodo)", "value": "b8a9f15aac66dfe4b068608160cd8046", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044878, "uuid": "be3ebec3-76fa-4504-8711-2235fcc2220f", "comment": "Malware payload (Heodo)", "value": "7f43c252d0ed571cde61f6bcf49f8d2f8355425eb372db11373b799d41da9308", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044878, "uuid": "73417267-7453-4634-9d8d-7ce86fe3b228", "comment": "Malware payload (Heodo)", "value": "f7f4f71e44db1825b7412ddb0bdf41ac38928e35", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044878, "uuid": "5c6b03af-f040-4467-872c-2274e4cc56b9", "comment": "Malware payload (Heodo)", "value": "eb9422eb7ca39a43cb7d9d1762e4ac0001c68163da5d8db323809621d07b6e12e01b4e6b81603d65a3148a3901dbb8c7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639044878, "uuid": "398d72d6-e257-41bf-ad3f-98a16794fecb", "value": "T1ED9301CAD6A5DE7EF4E6D038E4BBA1B97323C037C0585D82918DCAC8812D5C657FA1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639044878, "uuid": "9d4ad76d-bf15-4cde-a180-3e59aaca9a37", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q38:psXZ3MYeGt9sLBrGrQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639044878, "uuid": "8f0790c9-d5ce-4b6c-a885-d86a2a57837a", "value": 90147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639044878, "uuid": "1ca0434f-8861-461d-b03d-e2e8a30d76dc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639044878, "uuid": "a182e615-d138-4de4-abd3-fafc1b9bbc63", "value": "emotet_e4_7f43c252d0ed571cde61f6bcf49f8d2f8355425eb372db11373b799d41da9308_2021-12-09__101415675370._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bc0f44-58f4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639056771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056771, "uuid": "fef5d1f4-7060-4a5b-837e-5691fbccda7e", "comment": "Malware payload", "value": "92ffdde1a973440012b392018f64430e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056771, "uuid": "dd7bada5-0edb-45b6-a1e2-0f0477708e16", "comment": "Malware payload", "value": "7f92a437d95e748f472b3f7d249263751b1a74b8c1216b68edfd35f239c12b1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056771, "uuid": "fa46878a-5ab6-4b48-96d8-a51f541df482", "comment": "Malware payload", "value": "e8574f6dc0a27993bafe9da0285bcaa83e9745a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056771, "uuid": "d9b5354d-66ad-4908-98d4-1c82173a785d", "comment": "Malware payload", "value": "dd8f53f393b679ab9cec4cce2dadeedaea56a1d97dd75b1e01328d86d271aa4f890f0579ff5ee55581d1091fb46bd68d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056771, "uuid": "e73460cb-b1ef-4715-94da-e15ba97fa35e", "value": "T128F37C2176C0C072D19778B68629DBB14EBE7475212B5A8F9BD909B41F34BC2EB3530E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056771, "uuid": "ea5118d2-8cd3-45e2-977e-ca6baa269072", "value": "3072:rqq3eSfu9Jsrk7WRsJi2wb93gFcmmmbDD6E/t:f3eSfu9er5zmFdbDD5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639056771, "uuid": "ceb1c2bf-cb2e-48f2-af5a-9581fc22e111", "value": 170097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639056771, "uuid": "03e07e4c-3a7d-4ec5-a257-1870c458e403", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056771, "uuid": "a4d47b3e-f3fa-4820-b4af-f2896b73d7c6", "value": "92ffdde1a973440012b392018f64430e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60062183-58ff-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639061439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061439, "uuid": "f17b3ae5-f951-4bc7-9f9f-2ff1da0d63dd", "comment": "Malware payload (Mirai)", "value": "adb8ef9efe14678b5a08e72069394797", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061439, "uuid": "a7054cbf-7227-41f6-9858-639b03673356", "comment": "Malware payload (Mirai)", "value": "80685c0ff884a7987b0ae9a81d29780a330a74d5030af86f9adacc7039d08bef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061439, "uuid": "8a1debbc-1387-422a-9d80-aba202058717", "comment": "Malware payload (Mirai)", "value": "2635d291498051307a40882ee88c328dc1db9c51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061439, "uuid": "aa8f344e-8fe0-4883-8e40-3f07227a42a8", "comment": "Malware payload (Mirai)", "value": "a0eb5a7254abd2bcc29e37e0ab2b0c8a006d1e899285ffa4c53f4982691a922de6c54ac7776aac87fe5d962edab8ff97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061439, "uuid": "e10e9d6a-2af2-4de2-a759-2437bd49e177", "value": "T10DD2E074978B78B2C1B00135FBAC47D6059B1EB4D0FF73B3A62014A579E718D2AA05E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061439, "uuid": "685437ae-8074-49ea-bac8-26f26cda8d82", "value": "768:zA4uBc0T/nVvqV072G+IFYoXHZCx3Gc2Nes3UozX:zPuB7/nVMYn+Kf5ZDzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061439, "uuid": "f9f2bfee-e480-4652-8e4d-b3620266071e", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061439, "uuid": "209d88da-9192-4674-8cb5-6bb5bebda5e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061439, "uuid": "54971e8b-0309-42db-b2cf-81357e6eb948", "value": "adb8ef9efe14678b5a08e72069394797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782b5969-5906-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639064486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064486, "uuid": "243fe254-222b-4ddb-840f-e4ebce546207", "comment": "Malware payload (Heodo)", "value": "f5cb9b327572a7eccb5cbaf3dfa01617", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064486, "uuid": "4313c38b-cc6c-4d93-941a-ff0a2076e32a", "comment": "Malware payload (Heodo)", "value": "8199cd2fde7e3cec9521cf7aa7dbafe51ba2ea897a8c132318fc85507b90d05b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064486, "uuid": "04998732-246e-4d61-ab6f-70ee8cc8d57a", "comment": "Malware payload (Heodo)", "value": "38b3c7f22525f938e6160604c8afb88108b90d44", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064486, "uuid": "16daf891-552d-4038-953e-abec20242a69", "comment": "Malware payload (Heodo)", "value": "994369d57a8a3b7c2165a09a7dc920b53223e1bd2984d1159ad8366665bed1a5b9af88c92fe7e7980d41fa6ed51579ff", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064486, "uuid": "959c51ed-8bde-413a-a387-0dc6b420145b", "value": "T1019301DAD295DD7EF8F6D438E4B7A0B92332C131C15C1E82628DDA48812D5C797FA2C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064486, "uuid": "8a546598-e05e-40ce-842e-4f6c3aa2ae1c", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbY:yIBQ3MYeGt9sLBrGrBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639064486, "uuid": "0763a6c8-a184-4caa-8d16-2199901b1a33", "value": 90157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639064486, "uuid": "4b1993d1-c809-4aa9-b9f4-def76a51af4e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064486, "uuid": "d5d6ce2c-f8c0-451a-819d-31e46329a73a", "value": "emotet_e4_8199cd2fde7e3cec9521cf7aa7dbafe51ba2ea897a8c132318fc85507b90d05b_2021-12-09__154058207101._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68beaa2e-58b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639029671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029671, "uuid": "ab6c5643-1cb4-4828-a6dc-9280796b277c", "comment": "Malware payload (RaccoonStealer)", "value": "12aea40be4b9c458fd5a28705edeae90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029671, "uuid": "c1ba683d-501d-44e9-9b83-cbbff3f4c6a7", "comment": "Malware payload (RaccoonStealer)", "value": "83c67454738495db1e361f0b71c5ee08a6284080e4cb56070693a52537da214f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029671, "uuid": "d34f431b-3be2-48ec-bba0-575d3a9b7686", "comment": "Malware payload (RaccoonStealer)", "value": "d144806336ede9007e4e099c1b5bc5b125c5e19b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029671, "uuid": "9e68dae9-33b7-4440-8a7c-7f640818326a", "comment": "Malware payload (RaccoonStealer)", "value": "f3991671ee3d3056da702a6eafb8d90b29c02bd35dbeaa39034f3d7017e36382e19f00533c37a2ec11b72f72ad74f280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639029671, "uuid": "80574754-a250-40db-9f61-9a6e0d82eb4e", "value": "T1DF749E00B6E0D035F5B756F85AB693B8A53F7EA15B3490CF12D526EA1A346E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639029671, "uuid": "8d02d3bf-6708-484f-83a5-5987c506e1cc", "value": "d9d9fc0ee02596fca6336fbe79f431ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639029671, "uuid": "9e8b2353-44e4-4d93-9cee-c8c2484e8152", "value": "6144:rErYzZmWfv5KhFuQrd7JjNQrpaDVUGJUTvU7:rHdl5SFuQx7JjN+paiGJgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639029671, "uuid": "7d7ec2b2-0e5d-4cfc-8e0b-a0991de604c0", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639029671, "uuid": "5df4009a-86fd-4574-9ca2-b810e43067eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639029671, "uuid": "319fe056-71dc-4772-b2da-4150345aeadf", "value": "12aea40be4b9c458fd5a28705edeae90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b837a9-5885-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639009150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009150, "uuid": "358a585c-467d-4372-ad4b-68875d6146f5", "comment": "Malware payload (Heodo)", "value": "a66e60693cc66a27a567d001cb780923", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009150, "uuid": "f1780b92-72ee-4e93-8023-8288c8f45477", "comment": "Malware payload (Heodo)", "value": "84108e6b2761198075e5f9b59fa81540b8dc8adfa05a2e34e1aebe62575ea04b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009150, "uuid": "5d46213d-c184-4eb6-a4d8-630457b158d1", "comment": "Malware payload (Heodo)", "value": "3b45b7093e1c1b268e851d30b1dd6feab821e0a6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009150, "uuid": "5053b2da-dad8-4d50-ba6b-9597aca72590", "comment": "Malware payload (Heodo)", "value": "413ca7e9bc2d1c4c9ff9c33a46f796c9c100ff17fbd21b2786445fb88a95d777585b088770c9d87a9996129f1d59537f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639009150, "uuid": "27a97e7c-5548-4b81-a9fa-751a940ac80a", "value": "T1F893F1DBD298EE6EE4E7D438D5BBA1E92732C027C1685E8181CDCE8C852C5C657F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639009150, "uuid": "27ad5507-81ae-4d06-9ea1-6b29f9126754", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iyS/:Gp4Z3MYeGt9sLBrGrS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639009150, "uuid": "debe572c-0272-4052-b530-582155d6b97a", "value": 90142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639009150, "uuid": "1f2535f1-0528-44b3-8889-d74e33fa70bc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639009150, "uuid": "ca23042b-faec-4121-b30c-805a69130fb5", "value": "emotet_e4_84108e6b2761198075e5f9b59fa81540b8dc8adfa05a2e34e1aebe62575ea04b_2021-12-09__001859278876._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c2ecaf-58bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639032481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032481, "uuid": "f4768479-92a2-43b9-8b04-2f9daf0adcb4", "comment": "Malware payload (AgentTesla)", "value": "06c87290d7b63066b65f304a546a3939", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032481, "uuid": "4c1f4e92-6060-4a80-b187-562d50a29db1", "comment": "Malware payload (AgentTesla)", "value": "8425dc158b6531f671e254cacbbcfab569b1f4f4c3a63d21ddc4c33e5ac3c50e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032481, "uuid": "339d56ae-4aa2-4a21-8d17-a478034c43fc", "comment": "Malware payload (AgentTesla)", "value": "0b2bad9fe4a27ca3c669d99c5b8ebe4072b61fd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032481, "uuid": "f773b419-7010-45f4-ae66-4f82811554d6", "comment": "Malware payload (AgentTesla)", "value": "6e2bcf17f4d40ccde5d32f53cc186e99fcd67b05a310ef16a66ee23eba7032711f0d6f30f50bd2a53ece47e503458f5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032481, "uuid": "c9c69d9a-5f6d-405a-a9a5-fc2aa7a15354", "value": "T1123512ACB26071EFC857C8729BA81D64EB5034BB931B4113A46719EDDE0D993EF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032481, "uuid": "5e0bc40b-0ff2-459a-a418-82bbd7542580", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032481, "uuid": "fd73fa35-cb1c-4501-b790-acce5380e6e1", "value": "24576:Amq41whOjstqkxQVCUMf3QXWCCWKU3Fh1NRkGWGaUkHWgZaSwJNWJRKh:p1whOjsFFd3QXDaUVh3NH3wWjXiRKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032481, "uuid": "71da477a-ae63-4833-8839-18085a5693ce", "value": 1145856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032481, "uuid": "66b14538-f298-4803-b04b-5170945a2911", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032481, "uuid": "5a40499e-ee50-4381-bb51-63db3661156d", "value": "DHL Delivery Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9511fd26-592d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1639081285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639081285, "uuid": "69a08b10-e26a-4ba8-ba43-6573dece55ff", "comment": "Malware payload (Gh0stRAT)", "value": "057828dc4c06811b445afb5cf74f8eb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639081285, "uuid": "05fd3689-4a62-45c4-8621-f24e17f7b1bc", "comment": "Malware payload (Gh0stRAT)", "value": "86110204de85542d07e73eac81280f23e34480a56d2e085e6376f520b09ef6a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639081285, "uuid": "6bab941b-cbc9-4b0e-a3de-915a1045dd25", "comment": "Malware payload (Gh0stRAT)", "value": "2a6fe6546989944a96bba70564731bc303f1c09d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639081285, "uuid": "5e0d33ae-7769-4439-8591-5e3dc20c3f15", "comment": "Malware payload (Gh0stRAT)", "value": "ad3c6c4fa4ec48e118e97aff073ffbfdf22104890a8fc5a1712495f4fdea889ff619f5a432eb3448886daf3fc2fa8c8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639081285, "uuid": "6634bdb2-0e67-4bee-8341-a404b14826ce", "value": "T1A493E127A3D0C8BBE557053101735B39F7BBE3002A51565F77740F9BAA260C3DA6A2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639081285, "uuid": "3220392b-9df2-4dbb-8dec-cc48378d026c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639081285, "uuid": "b939942b-6376-415e-a8d9-54d7d977f253", "value": "1536:ALXB65939tY6HBg4sXJ0KDsLG1C/DsAaE2n73P4Qjky2f/:ALk395hYXJdsLGyDv2n7wby23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639081285, "uuid": "cf208ac3-f0d7-4852-a809-1c80ba0040cc", "value": 91990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639081285, "uuid": "217a6c1b-f4b2-4eb1-908b-cc9500b57aad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639081285, "uuid": "7d0ae17a-e91c-4031-a6a4-734788e8997c", "value": "057828dc4c06811b445afb5cf74f8eb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd86474c-5901-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639062562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062562, "uuid": "fe39f224-7e61-4fbf-bd58-8c6e4f299d19", "comment": "Malware payload (Mirai)", "value": "3da9fb61c57201fb73f0a96d92d54250", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062562, "uuid": "21cf5414-2884-4f58-97c9-dca2853bcf8a", "comment": "Malware payload (Mirai)", "value": "861df1d5b5215013bf20811d1f754d25b58a0679f9963c3e8e01b030940556c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062562, "uuid": "e840f1b5-3958-4aaa-bd40-e588dc6b2523", "comment": "Malware payload (Mirai)", "value": "39e14a3632cb676b484623af0edd8a100a7583b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062562, "uuid": "b60cdb73-568e-4805-9fe8-6229ed0841dc", "comment": "Malware payload (Mirai)", "value": "540d307adf0431ad1d901ec1371a4137cc7131211472588c2086a1b82605d33116e6c015cfadb378e5a6ada5dcba9e88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062562, "uuid": "049d4c40-af1f-439e-ba46-0bee698f5e8b", "value": "T1BAD2D0A963001779CABE90F8176607A13DB94F3191D3EE6AA1C0FAC2ED405F479A39C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062562, "uuid": "d4111873-2c0b-411f-ad62-80efab7d3d21", "value": "768:oyvYLznDEB2iC+sDqC6NtxsfzxPnNsGbLbXOJgGlzDpbuR1JP:XYnnDEBI+smATfLmVJuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639062562, "uuid": "577152e1-3a4c-43e6-acfb-56c91fea9787", "value": 30848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639062562, "uuid": "d336210d-e07b-45c9-a849-3aeff6b99bce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062562, "uuid": "8dc2494b-e038-4502-aa30-7db3e7ea84de", "value": "3da9fb61c57201fb73f0a96d92d54250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cb9df0-5925-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639077712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077712, "uuid": "cb611281-39e4-4ac3-a162-21816c4b9293", "comment": "Malware payload", "value": "56f9a2bc1ebe7a8b371a42072e52201c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077712, "uuid": "c1f7e34c-db40-42ea-9445-4476edc46d5d", "comment": "Malware payload", "value": "868586ba92df162b426fe9e37b12b47d2141dcb59743f05dccfbb8c90e10ed57", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077712, "uuid": "ae7ffdad-bf05-4f8d-a306-f34a68ea05e0", "comment": "Malware payload", "value": "e61cdee70a5765cede34078e5833471fd0d01c61", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077712, "uuid": "00f714c3-f545-4ba6-9a15-2694c429ceb5", "comment": "Malware payload", "value": "c7af8e5a0afe45b60bc971b2ed93d5e6cd1d5012bfb48923a903788ea4b49ca7c39f88586a8e3286ab5f1655b41672c8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077712, "uuid": "b1b4f5d6-9021-4f7e-bee8-f86eeada571d", "value": "T12F44BF10A181D036E5FF087A8AFAD9BE466C76600B80DDDFA398187E4F6B5C1763059B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077712, "uuid": "7f3fb00e-0e09-4dfe-bf5d-11619f299a03", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077712, "uuid": "50bcd8a3-9c12-4294-9e8a-5d72c29de382", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBYmgL/S:Wvef8+h61mRcHL+rF6l5EAQWTEL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639077712, "uuid": "9a224625-d82b-4f19-8f27-b32d714e8d42", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639077712, "uuid": "987afb3a-b7ae-4572-9f96-8ea6cc35f7d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077712, "uuid": "034b3f14-8ebe-4ba4-a988-339629b20c73", "value": "cZGG0vOO6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c70f68-5887-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639009857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009857, "uuid": "d9882540-7f54-4d0b-b46b-ea77ef953051", "comment": "Malware payload (Heodo)", "value": "f86f13c3f812bb93b41e22e36ad4e7e9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009857, "uuid": "8cff7ef1-1d67-4a64-b094-fd7992981965", "comment": "Malware payload (Heodo)", "value": "86949ee98a537b9d75160ab6ec416b4c55292239f260fc61e8f61e2ceaf13573", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009857, "uuid": "0029bb9a-0451-48d7-96e8-88bb7853234e", "comment": "Malware payload (Heodo)", "value": "25012806a718466a90b1c37629512c0b1f17db2b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009857, "uuid": "82f607bb-c8ae-49f2-94b0-fe8e98148f71", "comment": "Malware payload (Heodo)", "value": "7728a6bf1ff87c933e01529db3bdc244166e9c7b9e916cb308fd15d288e1d1dd9e10ac8d78111470207fc30d86a22e5c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639009857, "uuid": "8f69ff16-6bbe-4b33-844c-4d489682d98b", "value": "T12193F1DBD299EE6EE4E7D438D1BBA0E927628026C1685EC181CDCE8C852C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639009857, "uuid": "abf0fe35-5d9a-440a-bc17-612b72b7c3fa", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iyS9E:Gp4Z3MYeGt9sLBrGrS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639009857, "uuid": "655fb0c6-de88-4bca-ae07-ed08f42a38f6", "value": 90143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639009857, "uuid": "ee18e7e5-bb66-47f6-95f9-68aaacc434a3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639009857, "uuid": "5c67d5d6-018b-41b0-9ae8-4bf6bbf0537a", "value": "emotet_e4_86949ee98a537b9d75160ab6ec416b4c55292239f260fc61e8f61e2ceaf13573_2021-12-09__003036167837._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3265ccf-58c2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639035433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035433, "uuid": "ef65f3df-4371-46dc-9727-dbbf14a300e9", "comment": "Malware payload (Formbook)", "value": "b57b5730286c47c722bd1bd80e22dadc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035433, "uuid": "88b90727-0f64-44d9-b719-2271baf1ce1f", "comment": "Malware payload (Formbook)", "value": "87c4a09709a7ba312539673bc4e85e4543d8e1ac4da43ce58adf8635f97f6207", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035433, "uuid": "e01a5853-e41a-46d4-87e9-b2efe3c77d7c", "comment": "Malware payload (Formbook)", "value": "29852d0d02caaeb53a264871d0561867c72b97b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035433, "uuid": "15982858-c47e-41e5-b8e2-0f4ff25e9904", "comment": "Malware payload (Formbook)", "value": "a63f1e0714f7f6d020ba20dafd3711427f727b38dcbdb1c4416033ff9a092bf55596115321260f313edf1317599e17f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035433, "uuid": "ec232bbe-c2be-47ae-8882-b003babab7d3", "value": "T12925F024D9BB801CE86732F90E16BD561E6B9D79C1028A46333EB249197E707CF227DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035433, "uuid": "c860c427-64da-48aa-96a4-f00da8ef0a5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035433, "uuid": "cd9d3686-360c-4d0e-b2a7-106525223800", "value": "12288:O38A2q1aJ3OJO8E8P8r5TRGt1z30GUJ57kg3FdPINxesooWZL+iAgsdyn+vzrRK0:Ovi5Tgt1W7kgVdCtU+E4Nvzr8kiSn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639035433, "uuid": "1ec5931f-1dc4-40c6-9e6e-e61ab0395a36", "value": 1039872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639035433, "uuid": "3be75249-e361-4299-8201-f4106639e2bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035433, "uuid": "3d892404-5469-4c5f-9ab5-7d5fa8e0eb83", "value": "b57b5730286c47c722bd1bd80e22dadc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5c7045-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639054215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054215, "uuid": "1f09c28d-a481-4f5c-8f87-ad366a249d72", "comment": "Malware payload (Mirai)", "value": "d9b1b6f7ee427e4dedd9f3309ad69767", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054215, "uuid": "f55dba8b-87c3-44fc-bff1-33fbd4500a1d", "comment": "Malware payload (Mirai)", "value": "8a3223089c5ea26c39008f90175a1dd64da68f1b0ff04ea266c3f7b844ebad81", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054215, "uuid": "7fa05ae2-8bac-4d89-acda-3b920c0e1c72", "comment": "Malware payload (Mirai)", "value": "30fdbf85b43ceb6706c90c1e2dbe6e3035b601c4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054215, "uuid": "a2d4483e-62e0-478c-84eb-3c3c0e25f7c6", "comment": "Malware payload (Mirai)", "value": "0d03d412e98c9c5aaf47061a3b8c3861f4fa5986591478b807caecf66dfec78ab31507d44a61f545fa1a880aab770c49", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054215, "uuid": "685189d5-7b7c-4246-bbf6-7b8e8d2e56aa", "value": "T116D2E1F8DF649B8BD0C1A73E485DDC0E76ACB9A72AB6912A0B410D1264399A0D5E8CD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054215, "uuid": "2944208b-9c12-4fbb-8d5f-06159c4e1718", "value": "768:2N8fWlfoQmQAXV7E/QciiRcrHKOu3gfq6V:WMNXFl76Nnyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054215, "uuid": "94696e88-a4ce-482a-bc23-dc6c28b8f54d", "value": 29912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054215, "uuid": "a93ed9c8-59ad-49c7-949e-cb096c5dfce3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054215, "uuid": "813c1941-c578-47fb-84e2-0e35d6a62132", "value": "z3hir.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8139bd-58c9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639038460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038460, "uuid": "90f22aea-04f5-4af5-93b0-ea11a30b09f0", "comment": "Malware payload (RemcosRAT)", "value": "228e9762f27a523ad306fd176dd9a644", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038460, "uuid": "d91022b0-7eef-4f7a-a669-c1b379efc389", "comment": "Malware payload (RemcosRAT)", "value": "8a8f461270a94af10219b5ab9afa1133d8b83ebf5c1b93470896c35bdcb26b1d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038460, "uuid": "c4fd0421-14ba-46a5-a129-52db56bc0be2", "comment": "Malware payload (RemcosRAT)", "value": "b9482623aeccf0713a2a3a9c1e6b2c43abe410ef", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038460, "uuid": "0b0de588-98a9-426e-894d-9b0d9026be06", "comment": "Malware payload (RemcosRAT)", "value": "ad8edf0e22ad2795bd72bb3a0f6c745d3be6c314b4fd10d37397b87bb3fdac4682f92688a11ffa124d422bb621e9602a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038460, "uuid": "ae424fa0-4dbc-4615-b4bb-c6f0c4f1ddd0", "value": "T185259F62E2E01C76C06F15B9AE4BAFD825277E212D18DC462FFC2D8C5F357A034195AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038460, "uuid": "3ee7f618-cd67-4ac6-91b7-b4476b702eeb", "value": "24576:luRQsAJcBdZF0bE25chN+QIi3c13TOqamxypnUXfGe:lL9JO08b+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038460, "uuid": "5ae6d7d6-b131-48da-bf0a-69ea1907c75f", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038460, "uuid": "4e0129c4-9aba-4c44-9eb7-612a7c4c35ed", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038460, "uuid": "ba32a8f9-d8bf-409e-95e5-c869412aa550", "value": "Nuovo ordine di acquisto,pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e2cbe3-58bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639032192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032192, "uuid": "2eb5d376-39e6-47ea-89dd-8c8f2fc271ba", "comment": "Malware payload (Loki)", "value": "8fbbdfbb5fbc933ae3efae7d9057ac34", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032192, "uuid": "2fb2ed87-a605-4097-9d20-bc807246300a", "comment": "Malware payload (Loki)", "value": "8a9bd5d6387e351be1dbe3d83a718449075a442b8da0e7864a8f64caaaa20190", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032192, "uuid": "c3b08e1d-d4ae-4b89-8c71-09402fcd297f", "comment": "Malware payload (Loki)", "value": "9931091347970d581d74069fefce9f07a0d12676", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032192, "uuid": "faa35254-b0ae-47bf-8157-a427867c224f", "comment": "Malware payload (Loki)", "value": "be71ecfd251eb5bba144091c903c39b35ec4f65b32282b9d6da5121fde299862ecb0a6698fd69f3e8a12909d74d2e60f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032192, "uuid": "f6848de4-fd80-49ff-bc0f-86094e7fac16", "value": "T1743412397785E648F23EE3B749388A549F8CEDCD00548B0B184DBAF5F4769384662AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032192, "uuid": "b10b2611-856a-4481-81f1-0089304f5204", "value": "6144:nNiZBk4mdk/Nbm+DuRPNeNAstpyl1uKiu:NibkMlmBmvtgl/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032192, "uuid": "939cb9c8-5100-4ab7-8610-1c16748e7545", "value": 234584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032192, "uuid": "3110449a-22a4-4e47-8065-bc6743d87d3e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032192, "uuid": "5dfb64d3-c46d-4e43-a2e7-84a531d986ed", "value": "MT103-20215702.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9a9127-58b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639031474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031474, "uuid": "63328e9f-9e31-42e9-ada8-8c273e79f4e2", "comment": "Malware payload (RaccoonStealer)", "value": "93d4881ebe5dbba45521508338adafaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031474, "uuid": "6de30e64-5cf5-46f6-9cd6-a5adc638be54", "comment": "Malware payload (RaccoonStealer)", "value": "8a9c79cd2bf3fb8f4b4f588829f45057272aa2c10ad92a08208a635d0d048c3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031474, "uuid": "d1583e4c-abed-478b-bcf9-11adf33a0f5d", "comment": "Malware payload (RaccoonStealer)", "value": "e2c127e16989a69600a06152924b30f44d3828ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031474, "uuid": "7e4a256b-4d61-4e70-8d44-77126e68856d", "comment": "Malware payload (RaccoonStealer)", "value": "54d4d23de55eea8d8f560e0eb19abb6ca97bf718ebcfa1d25f8748b24148e1bd3b8f71626159bef9d8da9fff7118064e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031474, "uuid": "897d5e76-0f9c-4560-841f-724baa0cfad9", "value": "T193048D3175EC9533D1A34E304825FAE43E3BB8126A319107E25467AE1F72F9C4AE635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031474, "uuid": "715fb3d2-c1e2-4439-9bea-1883f765d1c6", "value": "d541639438edf94a0fdd982ab363141c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031474, "uuid": "cda59c72-079a-4dd6-bfe9-207943b52225", "value": "3072:OMuLXwo7UsYPGFKLhXtc2U5L5LHgbeMWrxpzbgqruXhs7sxkgaBChU+k2:OMuLXwT4Edc/pASMuzbgwu6Qigak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639031474, "uuid": "9b662c8d-4cae-49a5-aaa0-69fd06bc0b51", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639031474, "uuid": "31c9baca-015b-4017-bc68-6a4d099e16a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031474, "uuid": "7eb93a36-bb4e-4e38-8d3a-a59eaeb78068", "value": "93d4881ebe5dbba45521508338adafaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9bb146e-58d2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639042369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042369, "uuid": "8b336e43-feb6-4dd9-a6d2-df841187d6b0", "comment": "Malware payload (Heodo)", "value": "44dd0b1fc7488bc2c4b0b17616766f34", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042369, "uuid": "96cfeaa6-dd99-48bf-a789-0386a37fe71a", "comment": "Malware payload (Heodo)", "value": "8b3982a9940165a675cd71d2c4560fbb90bc8d8124e08839a631dd558036d6b9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042369, "uuid": "3aac2c4f-ffed-4c46-a661-e42e09d1472f", "comment": "Malware payload (Heodo)", "value": "fb6698ef1b7c3a2447bdf458b38ec26808c37224", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042369, "uuid": "039fdfc0-2b0f-4b96-aacf-29a43c9bd3f0", "comment": "Malware payload (Heodo)", "value": "026fb4ffccd4c75caa0a1f6b06a2b4f06712aa1148ccd11a437fe4a1b78e1b555166f1fb021d4c0d43a5937644ea14a6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042369, "uuid": "c7e29580-fac8-4220-9f3c-271cab187ecd", "value": "T1EA44BF10A181D036E5FF087A85FAD9BE466C76600B80DDDFA3981C7E4F6B6C1763059B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042369, "uuid": "99e70ff7-5037-442c-9cfc-01ab7e677fa1", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042369, "uuid": "6a85ff56-46c0-4058-8eb3-98154aa7a8ea", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBGmgL/S:Wvef8+h61mRcHL+rF6l5EAQWTaL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639042369, "uuid": "e1653095-b15f-4376-8047-2cec27a36462", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639042369, "uuid": "b135b386-2e4a-4f57-a99f-9d3728bc40ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042369, "uuid": "82ff645b-2398-4048-9421-ba2b7e310867", "value": "R7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eed2069-590b-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1639066645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066645, "uuid": "a66cd1a3-c70e-4025-9817-c87e90fc34b7", "comment": "Malware payload (TrickBot)", "value": "b23fa3285b95afdda1a59dde1a5e7b0d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066645, "uuid": "68169b3b-e273-4ddd-aabc-edb3d68b8b19", "comment": "Malware payload (TrickBot)", "value": "8b7aeacc9c43fcc6535f43e1bb351d11074107e9f2cc9fdf29d3e3a6aed5d19d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066645, "uuid": "ce7a50ee-3b35-4835-ba1a-841680c53552", "comment": "Malware payload (TrickBot)", "value": "eba18a38a3d446e78a89c79c7cf6eced269cee05", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066645, "uuid": "25b58ed5-2189-4457-853e-22001781f3d5", "comment": "Malware payload (TrickBot)", "value": "1976fe8e52e1f4709e84ad94c957ac4a4ffa9a3141cef07d5c36df0f89fb5445090aaee2982404567db222494a81d229", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066645, "uuid": "e546c025-f1b1-4803-b9a1-e8a354f54721", "value": "T1D0A4D00272E0C035C2EF133D19269B1967BBFD20DB7586CB2751BE9EAE346D18939352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066645, "uuid": "c8842b65-a64c-4f76-bf5f-53a66982b0e0", "value": "e768cc53caa0b68006b0ded6604c348d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066645, "uuid": "fd2d7197-e52d-4d15-a3b1-601a05ed9e9c", "value": "6144:v5+iRFTkRhO9SErtZtfherliYSuTNpBRaj4gzaxCdKJjWJFWMaDTX3H:JFTkytZTm4EBpL0zacMScx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639066645, "uuid": "9dcd7b65-71b5-4135-869b-2a2cfc6edef2", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639066645, "uuid": "7e9ed526-6b70-45f0-b061-a3fc40d257a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066645, "uuid": "fae3b9c4-bad4-4935-b13c-6dbec7786f10", "value": "b23fa3285b95afdda1a59dde1a5e7b0d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381e0973-58e2-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639048916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048916, "uuid": "0810985c-cd25-4611-a033-6b0bffd719ab", "comment": "Malware payload (AgentTesla)", "value": "3b50998785c532ce7eb8e091b9df49a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048916, "uuid": "2bbee8c4-87ed-45c7-b9b5-fa90ac40c715", "comment": "Malware payload (AgentTesla)", "value": "8c022231f5d0be9ac46ed5de8c075e8d79e0960be4fe6adeda24ee16f274a028", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048916, "uuid": "1226f32a-e8c8-4102-99da-fbbcfe9a30fd", "comment": "Malware payload (AgentTesla)", "value": "ee410d8a1429266806a692149d594983489e0082", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048916, "uuid": "f2ef9612-c7ff-499f-8c6b-cc65f06f12ae", "comment": "Malware payload (AgentTesla)", "value": "ab08083e31da12a990ddf378728ef089c3c9a9185f5423d50f166ae3b7c94522f052575e2f01ac911ce8673faa017fdc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048916, "uuid": "f773e964-0c60-41c4-82d7-296e4a3709db", "value": "T14765ED0E0A2141B3CDB6B93986376915F6D8622BB3F93A81D41D0D2BD64E7CCBC1D96C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048916, "uuid": "344797b9-0c2b-4981-8007-77ae858d6951", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048916, "uuid": "39071bad-6f01-40d3-ac8c-10d89d21ce84", "value": "6144:IL9RGqVkuO1WJ6tqLTYsuAp0N4o4ND4pUk7U3KaJ7ZzBCv2+ELbmH5LIL6aPJjuZ:ILm4Y5hUl77VBCrELE0GiJS//oVMxXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639048916, "uuid": "8eadaf96-9302-4eb9-a21d-782302a7bd62", "value": 1521152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639048916, "uuid": "fa358a28-8009-4ff9-9d25-53469a890ae5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048916, "uuid": "c36b1c32-010d-41fc-b24f-32c9383b07ae", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4231c94a-58be-11ec-96a4-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1639033471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033471, "uuid": "135a4e7b-ed06-4aa8-b6d6-e665e3281ccb", "comment": "Malware payload (BitRAT)", "value": "f5b6b9bef7ee2e9b6be5a324386844ed", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TechnoElek s.r.o.", "colour": "#44EA03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033471, "uuid": "c6ada716-004c-475d-93c5-9c28c810ac8a", "comment": "Malware payload (BitRAT)", "value": "8c1ec43b6a766a95c0d1b94fe24418541c8a8858847dff24334eab95e9c117e0", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TechnoElek s.r.o.", "colour": "#44EA03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033471, "uuid": "8934b2d9-6c85-4f04-b7a9-ad215b4e940b", "comment": "Malware payload (BitRAT)", "value": "e6396b2346a0b0d9d84aa6a4335ba18950872ffc", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TechnoElek s.r.o.", "colour": "#44EA03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033471, "uuid": "bd202f6c-1250-4771-925e-591f20b4dcec", "comment": "Malware payload (BitRAT)", "value": "a42deb8954270e5c2a5ede6608d6b247d400e1af988babfce0744fea0f6e5d1c2535471b826ae0d78e0923c43849241f", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TechnoElek s.r.o.", "colour": "#44EA03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639033471, "uuid": "c95dbc89-b57e-469a-97c2-bcce6e22b3a4", "value": "T14BD3180963ACCF29DA3E0739E1B851224776A50A7613F75A4FC1B8F52E737100B49A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639033471, "uuid": "3b3e83fe-99dc-47e3-bc37-aa5124bf75b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639033471, "uuid": "5bfaeff6-43e0-4272-a30f-e7985da2db0b", "value": "3072:t8PDT41Ya5pc8ykyNVTNy2OwEyWJUul25ceR+fJEkz:SrTbaPcnbVTNy2O51Um2NA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639033471, "uuid": "9d3b2d01-18b6-4699-b408-f3e3f16b4dc6", "value": 141552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639033471, "uuid": "7d435c96-59c8-4a18-8974-26c79c28c4fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639033471, "uuid": "7420dd1d-c780-4725-be01-d256b8213da1", "value": "8c1ec43b6a766a95c0d1b94fe24418541c8a8858847dff24334eab95e9c117e0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22dffc04-5928-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639078946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639078946, "uuid": "4574b160-f8dc-4f1b-9990-c6729d1e2a30", "comment": "Malware payload", "value": "03ac2fdcd05517a0c0376df77fc71965", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639078946, "uuid": "30d224a2-4372-476b-abbe-206b43d0e82b", "comment": "Malware payload", "value": "8c7a8843e4335b2ac428b475a5765ae005a4ed2059db35002ce01c033728ead7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639078946, "uuid": "aa8c3b79-52a5-4f14-a970-564e0341fde6", "comment": "Malware payload", "value": "60b55b2613ec2ed67ce5cb775fb1c179fd2ce174", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639078946, "uuid": "deeb5808-082f-4a6f-b198-3541a4d1157f", "comment": "Malware payload", "value": "9b70d23e2ada8e1b3b01f68212607a82e59962b9c65a02c8d49d3c8da70605074619d961d70009a4a275f5d8836689ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639078946, "uuid": "75fd2c16-f069-454a-a17a-03173c238c76", "value": "T12794DF2021D0C072D167247C8676C6B64B3B7C65ABA1E9CF7FC52A795F343D2C62839A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639078946, "uuid": "d9caa137-99c0-420a-afe4-5decc7d3d258", "value": "979c24149674ffe2c511255552b86b69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639078946, "uuid": "76bf0a40-ca4a-41dd-b96a-7aec86cc3524", "value": "6144:geRcUQM8GQIkuMp0SG6f975HyHxiwBNM9GyMGuhraQj8TdIThO5qXS:hRcUQM8GfkuMp0YPyR/kjfttTQhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639078946, "uuid": "608ad176-52d6-4761-97de-9bcf17d90e9b", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639078946, "uuid": "281dff0d-ba2f-4863-9154-0f5dc0522af3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639078946, "uuid": "be25a142-8d1b-4028-aee4-df1afc8d7c87", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82875a6-5939-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639086497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639086497, "uuid": "601c9fb3-e7ed-4aae-93bb-f9650211ad61", "comment": "Malware payload", "value": "6c5a687c199d773150a7b455e79dbbd3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639086497, "uuid": "9a25922d-c383-422e-b102-90fa059a4c1e", "comment": "Malware payload", "value": "8c8f303dbc1b15fc63192179af83af62517debb769869244a46d4aeabcf6b59b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639086497, "uuid": "1d35953c-7d17-405e-933f-c469fee6da58", "comment": "Malware payload", "value": "46ac2dc896093c75fe9d60b067311d0cd0836c71", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639086497, "uuid": "dab6baff-2e62-4d57-af8b-af0610ea87ca", "comment": "Malware payload", "value": "4a242d3e419bf4fcbc1f855d6107e6d2a785af38681a9d3dc15982f53c768afd82cf3c1c0030aeecb561e2beb0e977a7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639086497, "uuid": "0f7f2bd5-82d6-4054-bffc-c1e445410a5e", "value": "T14AB2753C054711929BB307C625C2DD829A140672FEB14CAF732CEF1A9FDAB55989239F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639086497, "uuid": "73bf58b6-f92b-4cf0-9180-2c0f55fd96e5", "value": "384:vCWXYiPgFUM1NMthosSLFLcBo8tD5mmgNW:qWXYiSZMthQ1+oy1mlNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639086497, "uuid": "22bb1619-742f-4a99-b26b-2f4399bf0796", "value": 24688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639086497, "uuid": "e57c4abf-b126-4407-b1a4-e7d5b9af93d2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639086497, "uuid": "5e5154d8-d212-40a5-bcff-1140243fb51b", "value": "g2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d05bae1-58a1-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639020980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639020980, "uuid": "050480e2-21c5-4c3a-934a-4837b263deca", "comment": "Malware payload (RedLineStealer)", "value": "a88d00d72258c4b82e23572bdc47f18e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639020980, "uuid": "e639d8db-158d-47bf-9381-fc35ee7a88c8", "comment": "Malware payload (RedLineStealer)", "value": "8d9b9cca07f1ee0633427ae056d4075a38bb2d12cc8dc9a0e31aef21ed7685da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639020980, "uuid": "39c14152-e7ac-499a-aa6f-9dace791e0fa", "comment": "Malware payload (RedLineStealer)", "value": "5756305e77ab1eb061ae3836f942cd6860a62236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639020980, "uuid": "55ac3328-9b77-48f8-9b27-5a8ea6b5057c", "comment": "Malware payload (RedLineStealer)", "value": "3be9a44e2e5824c9f646b4a743c51a1dc7b4f50fcd122d2b5bae87ebd260d8924125f4ad36fda46e70c1edac065b5457", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639020980, "uuid": "d666861e-79b8-471a-aa45-5316ff51bed6", "value": "T13285339E28B8161BCE9E01FC92B4690714B543E678F49A6D6D57EBF301ED186E720CCC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639020980, "uuid": "f672b5a4-71d5-443a-9be0-65f8e94a2762", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639020980, "uuid": "1d7ce4a4-ee30-45a3-b8f2-01a9459e2dfe", "value": "24576:AwCdPsKikbxs81BUYNVRIR7IdukBjDOqwhA9SFPWlY64TTxmHCN+68di6COQkEaV:rnoNs81BUYqRcW9t6cOdi/OQNatU6NV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639020980, "uuid": "23c72edb-ea2a-4f53-8c78-30a67f5d738a", "value": 1732992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639020980, "uuid": "05a9b933-a35f-4308-9f5a-c826b8129c90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639020980, "uuid": "5fa1039d-4374-4e3d-8c21-8ef71d69b896", "value": "a88d00d72258c4b82e23572bdc47f18e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0db2004-5926-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639078298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639078298, "uuid": "770387f0-7e8a-49e4-9886-8db767323b71", "comment": "Malware payload (Loki)", "value": "3146f851939adbcf9cb1797bb8d1e1a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639078298, "uuid": "93237850-71a7-49f5-9eb0-e1ab7e24396d", "comment": "Malware payload (Loki)", "value": "8e46572678e789fd31d822aa0ce498a2095b952f151e6d347a92cee5c9d13832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639078298, "uuid": "c7c608c2-c32e-4138-b049-f3c290384cb8", "comment": "Malware payload (Loki)", "value": "eeb7134c22283271c084cd7f53936d917f269729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639078298, "uuid": "d96eadfa-2feb-4c49-8f64-795c2784b87d", "comment": "Malware payload (Loki)", "value": "82f075c8f2e6e695920933fbd23550a4dab04243cbac7e7935688d3044160fd58985562958e10d388e4baa2f2c17842c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639078298, "uuid": "4e53bcf1-97e8-43bb-9380-17f37bd3f120", "value": "T1D764226AA7C0EFB3D451063D09775BBEFFB59250026B898F9B983F3F38562A54219043", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639078298, "uuid": "1f9b3ddf-e0c6-42a0-9852-83658718b7d2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639078298, "uuid": "5c911f2d-fdb3-4b85-a304-58fd9203aee6", "value": "6144:rGiWushDK07NCmdk7e2tDqHy5texccim/G8bPDFXKjuSP0P3Zqr8QHdKGc1vJj9R:YDK04pq7y5xcZGCxXN4q34HMGcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639078298, "uuid": "235c51e6-12ed-4ad1-a437-ae35039af192", "value": 306666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639078298, "uuid": "a318f931-9327-403a-b6f1-16750108187c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639078298, "uuid": "d49bcff5-3815-4e9f-ae79-128bc4c0fbdc", "value": "documentosDHL.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3782b5-58f6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639057673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057673, "uuid": "dabcf778-4e22-4c60-ae1e-b89d786c1172", "comment": "Malware payload (Formbook)", "value": "f6ca3d49649f09c1c63df1ef0c5554b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057673, "uuid": "9fcb10ad-ef97-4875-b3ec-a93bea3bf156", "comment": "Malware payload (Formbook)", "value": "8e73cb3bf0fdb5c8da777ca842b4b882f05d728709150ffac042c6e488b02663", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057673, "uuid": "7ca93db0-a47b-42a3-a10e-79bd41370429", "comment": "Malware payload (Formbook)", "value": "0d100b8072887b569b8721b2e4db8fc2ddbac3cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057673, "uuid": "5789b475-5664-4f00-8a5d-9d226ad490dd", "comment": "Malware payload (Formbook)", "value": "2181b0b90098643ace47e8180f47e9f504e308538ff9fb3765fbcba4d21450bb2a71e24276a4333e8beda33d64b3290a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057673, "uuid": "1a14bb2a-3637-47d1-98b0-d02a251501ff", "value": "T1276422DEE5823577E823027173719BBAE3FFDF9014896D3B6B681E861D7B08A4111B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057673, "uuid": "279880f5-2fc1-4367-ace0-a725b0d5d8ae", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057673, "uuid": "53506653-d06b-4fe0-ac56-79204dfce5f4", "value": "6144:rGilUM3TM/SFCpCmj86es8gKaz5vQZNmAu6SoG9ZELRI6KmUANIQ+:1TVFCpXfeZRa94ZUxZr+L66KrANIQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639057673, "uuid": "58b199fc-1538-4736-bd1a-f375794fbd68", "value": 311995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639057673, "uuid": "a8d3b0f9-9630-47be-aae9-aefd9a635a4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057673, "uuid": "cfa3c9aa-7dbb-4955-8bcd-4cdd39c0a0b2", "value": "f6ca3d49649f09c1c63df1ef0c5554b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afa4e61-591a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639072973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072973, "uuid": "de6cf863-46f7-4f10-bb06-e972480043ad", "comment": "Malware payload (Mirai)", "value": "050513aa9531cd4e54a351be0d28c71b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072973, "uuid": "7f79b529-ef22-49cc-9f6c-f4cf3abf1c24", "comment": "Malware payload (Mirai)", "value": "8f3e929df88b0eea03b85bc175bad056bdfc34247442361df0f17b0683cd46e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072973, "uuid": "0199c314-366e-4fcb-8856-b285943d7368", "comment": "Malware payload (Mirai)", "value": "ae9c5a090bed8258483c90badf77700fa5d796c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072973, "uuid": "d22446e3-18e8-4842-9362-e487cc1a5080", "comment": "Malware payload (Mirai)", "value": "d0e53f90e4d3836f1f6baf98c01605384807ad7c2e9f5298e3bccdf5b1167f422df78af8d3a9745aba5400cd65a6c412", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072973, "uuid": "57704fb4-6fd4-49a2-800d-4965785f8ada", "value": "T118E2E1ADBFC07BD6D87E6C3A00FD4F791A01A521339D495CA6045CEA6A0634BF60A47A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072973, "uuid": "c3aa82b6-82b3-49fd-8a78-32c7ff2ec2ac", "value": "768:pHu4OG1MQ6rsHemtM23QXveDuMhHPJ88qTPBZo1cJrrWn:/O6t6rs5t6yHPe8gnoCJru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639072973, "uuid": "b9b2513a-6a15-4325-9ce5-5cf329c9a6b3", "value": 32112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639072973, "uuid": "aabd6586-2f3b-4e61-97da-b13e0cbbf6fd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072973, "uuid": "6839516e-cc41-4f75-9822-d4cde1e1c1a0", "value": "050513aa9531cd4e54a351be0d28c71b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9cdaaab-5902-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639062851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062851, "uuid": "49eca6c2-ffb5-43af-bdb7-49f73e46bf3f", "comment": "Malware payload (Quakbot)", "value": "5a7ce647c5c9111c73b09dc455e317f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama142", "colour": "#C90C91", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062851, "uuid": "4412eab5-927f-4ac0-97d7-88f54d04107f", "comment": "Malware payload (Quakbot)", "value": "8fa469cc46d5658f78c0db3a99b0e9bc1f20f4958f4f8df3bba7a06918a3bb68", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama142", "colour": "#C90C91", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062851, "uuid": "6c072020-d949-421d-b166-4a67bc9ce49e", "comment": "Malware payload (Quakbot)", "value": "584499e170a0ff95e97dcf0943020d751f13f6d8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama142", "colour": "#C90C91", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062851, "uuid": "b81a524b-7d62-45c3-b6a0-4e467973bb89", "comment": "Malware payload (Quakbot)", "value": "176174044fd77d89a4c145830eb8ade8c9a6ca75d271ed3e7e970403c960bd8149155bad09172119ed55526c289cef9e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama142", "colour": "#C90C91", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062851, "uuid": "05cb40a1-6b33-4c31-9071-a2feddc52c4d", "value": "T11BF49022B2E14837C17716389C6B5765E93B7E002A38994B7BF51D0C8F39A613F292D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062851, "uuid": "2f69befd-ef25-4ae8-9d6c-1263141f5d06", "value": "345ca30570dd7ab1cf9d2e81ddccfd42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062851, "uuid": "2b66c2f5-064b-445a-9e00-05f04163ee65", "value": "12288:WPdRRiFWwvIV9NSca46WU4+79PfP57LzFUyCK09g01/RZK7NSb6Vl:8DOWTNSv7WpOZ7VZog01/mgbOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639062851, "uuid": "c8c95dea-2587-402f-a9c2-bb4c38d85052", "value": 773520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639062851, "uuid": "3fdbfd9b-4588-4416-901f-dfaa00cab9f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062851, "uuid": "b7a50ee1-ba11-447e-9ea7-b352835874ef", "value": "44539.6419649306.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0fa591a-58ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639052636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052636, "uuid": "fb387a92-31c2-404f-8f58-94891d0c1388", "comment": "Malware payload (Heodo)", "value": "b64ed88981631181c4460df74f4832aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052636, "uuid": "6ac2326c-56c3-4dd8-88dc-6ef94760e678", "comment": "Malware payload (Heodo)", "value": "8fa90ee26992a48404ee4aceb3b95f5b2cfb550731065891e5fa8c49cf43fed7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052636, "uuid": "0c9164a2-81e5-4cf8-adbe-8a9408d91a3b", "comment": "Malware payload (Heodo)", "value": "adceefbf3badcf44f88a696561a533e0747db311", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052636, "uuid": "17b7e96b-e6cb-4c89-84fa-5aa80664a85f", "comment": "Malware payload (Heodo)", "value": "99618f68ea15b7c5b054bcd01459564e2e17623838fac81e69f000b631c4bcba5a71a9a2d9c55452913565f58e1202df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052636, "uuid": "14955463-9673-49db-8d36-704cdb88a5e5", "value": "T10D44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052636, "uuid": "c3143d1a-cde2-414b-9508-01dda0d00c69", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052636, "uuid": "6940a0e3-8ed4-4fa3-baf9-4ab863d4e524", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBv2ypv:6jIG/pjjuLbJLmGshoCUnWTNpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052636, "uuid": "cc814314-1e45-4965-a057-e2055d38b80c", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052636, "uuid": "da12022c-2a9c-405b-b91a-68aabacc77c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052636, "uuid": "0f23f388-4d80-4856-8d87-b253caffb105", "value": "b64ed88981631181c4460df74f4832aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd332e4-58ef-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639054613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054613, "uuid": "cb38805b-0b6f-404f-98b0-21e88550edc9", "comment": "Malware payload", "value": "403434f80e50e284dc99bdcbf19a07f3", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054613, "uuid": "6e9311b1-132e-4d0d-9408-203c187bb490", "comment": "Malware payload", "value": "902803039bc071e89d12485be1cdbbe09911a1d8be1ceb4f2366575b4baa07ed", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054613, "uuid": "b1aa318b-1ca7-4f29-a6df-35e376a5d6fa", "comment": "Malware payload", "value": "e5e660014d32dc466519f1c4f696326fb9d82814", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054613, "uuid": "22e264de-b3a5-4d83-a9bb-8d112c740918", "comment": "Malware payload", "value": "c1e7df8cb3f96d576698870d18b519062397618857d8bd2ca93630f9ea61aa787829f162cc621f92d8c9c50920734eb5", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054613, "uuid": "bdc8d404-8eeb-4dde-b774-97d55d5871fd", "value": "T1E5F1AE83F0809BC4CB270B73E76B1869D61DEA48AF94A77E71D0B644068B42DFB1225C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054613, "uuid": "63c654ee-1f01-4337-ba3b-a98649c8fa95", "value": "96:WSNnNP1AnrKT2A5XxB+Wx/cr+kX+Q6Bej8XuaPUqrV2BQc0JnoGUo/yDbhnnC77R:WSPSrKT2+XlC3Ctupe2yc5GWsdZO1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054613, "uuid": "64948b64-6175-43d0-83b4-3762cf967a15", "value": 7911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054613, "uuid": "25765c1c-c947-4e83-9ffa-1ed4373ba644", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054613, "uuid": "7de91e92-633e-4925-8269-c2c65b34e37e", "value": "IRQ2107798.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27074121-58cb-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639039009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039009, "uuid": "bd824703-46e4-47da-b573-72f622a8bee5", "comment": "Malware payload (AgentTesla)", "value": "a934bc9fbe6e03bf7be8adf1f7896386", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039009, "uuid": "daaaa035-7a36-4d6b-83a6-3f573b61709a", "comment": "Malware payload (AgentTesla)", "value": "90af688d80446c8fa033d9afb6e6eb52269428e82c4f0c35adb595a75c943543", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039009, "uuid": "a68e2431-b940-4b80-92b9-cb5af7c8bd33", "comment": "Malware payload (AgentTesla)", "value": "5d61320d62f3e1ed6d918250d349fa8538dfaafe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039009, "uuid": "35185b25-10aa-4423-986e-70520b4444d1", "comment": "Malware payload (AgentTesla)", "value": "532649a5dd19b8613a70ad02ff454b1d6ac85db09523fec3d2cc686756f18ad322437767a83d48c4f195162ec1679f76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039009, "uuid": "77a51a4d-377c-4b72-aa2c-0649759f4334", "value": "T14EC4161576720000C87CDA3F56E5B90806AF6E5FDB20B81F1A6EF5C91A7374C9B06AB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039009, "uuid": "2c06b14d-1b05-4952-81f7-24167f04c177", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039009, "uuid": "1bf95dfb-519a-4785-8689-741d3a3be8fa", "value": "6144:JKN9jHf3H9Jq0SuegVGJxiE18BPjO0flodz1h6qPYX6p+nXtv1:JijHf3dbzVu5eOzdz1zwiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639039009, "uuid": "787c2929-367f-4368-aa07-511a23d945b8", "value": 543232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639039009, "uuid": "2110c129-8e09-45d3-96b7-ed5da83daf88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039009, "uuid": "96e527b4-150f-4f25-a54f-f03944990aff", "value": "a934bc9fbe6e03bf7be8adf1f7896386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa33d49-58b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639029674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029674, "uuid": "46c6eb52-5f93-4f88-9a42-482f2a3bd365", "comment": "Malware payload (RaccoonStealer)", "value": "2973bac5c724e940b911d100faff3e77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029674, "uuid": "a622f7b7-4390-4327-9baa-cca963c02609", "comment": "Malware payload (RaccoonStealer)", "value": "915302500c83a08962b8f217ffc8d091ddcb17529a6a0ab5bd8ba89a2431e7d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029674, "uuid": "27de4c65-0c29-4f92-b2c7-911aa33f9239", "comment": "Malware payload (RaccoonStealer)", "value": "164448faa69cfcd500c6ac8d1735493e9e78464e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029674, "uuid": "f050fe2b-5c63-4dfb-9ce3-4ebb6f71e36d", "comment": "Malware payload (RaccoonStealer)", "value": "7e13df788a779cf433b1bf38b42195cc9d9990dea8905ca546c338f020a881fe688c84b5df648a6e792ffa8f7c6b9d69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639029674, "uuid": "b35680a5-9a03-4a71-bb71-675b31cd484a", "value": "T1F9749E00A6A0D435F5B712F85AB593BDB93E7EA16B3490CF12D416EA1B746E0EC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639029674, "uuid": "9f17295e-e25f-4c81-af50-c69c51c9ef7f", "value": "d9d9fc0ee02596fca6336fbe79f431ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639029674, "uuid": "8a1c6985-5b16-4374-9324-a1601a1bcf15", "value": "6144:RdjAWZCN5UwXsWbnrgoI363zWKL3NCJTeO:RFTusWbncoI36DWKZCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639029674, "uuid": "3304a189-80d3-4670-8ea0-fb952fbd0a7e", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639029674, "uuid": "f08bf792-4d23-4138-a90f-391b38e20972", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639029674, "uuid": "77e64043-a2a4-4695-a063-93417684fb4e", "value": "2973bac5c724e940b911d100faff3e77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2cf2d3-589a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639018300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639018300, "uuid": "b9d7a505-044c-4a93-95e8-c463ead6e68f", "comment": "Malware payload (Loki)", "value": "e93a472772c0614482e68f16f943670c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639018300, "uuid": "cc755fee-6daa-48bc-9a29-164d2630bae7", "comment": "Malware payload (Loki)", "value": "92b7553b93d909aef1024e9de790f5b38833e8e10bd8aafa93c2b07081d8a05b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639018300, "uuid": "e42491af-7481-4ad4-8533-fd34d8c70a43", "comment": "Malware payload (Loki)", "value": "cc57f149e038d937246677a1705669516ac8a32c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639018300, "uuid": "907dbe9a-c1f7-44b4-9587-4362846ad3f0", "comment": "Malware payload (Loki)", "value": "3e6bd9c5ea384cf1d0182eb3fee910e9e03932eca6a87660e65eb833d2f2f3d7c0970523f0eeede50a10cccf405c8d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639018300, "uuid": "a677fb5c-fc5d-4abb-8546-30629cefd8fc", "value": "T1CDA46A829C622D7EC0144EF200D5A554E0AA1F0C9CE2951E9AD8BF69367378EE7FD1F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639018300, "uuid": "9f23f1fc-1100-4732-991f-62b7a9360064", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639018300, "uuid": "1ffc0f20-970c-41cb-b67f-bcd21da4e939", "value": "6144:KGiGaXGSnsLRNNd6s6b3p90EzYJP2uc/CAKaHRRXXUt:9aWisLz6990W4PBAKaHRR0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639018300, "uuid": "8a8d7575-3eb8-4b0b-865a-9e65ffa53ca6", "value": 475734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639018300, "uuid": "1cd9ae05-098a-44e6-b016-b2a457cfe1db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639018300, "uuid": "7ac89af3-5e98-4cb0-905f-981f10349588", "value": "\u6211\u53f8\u5df2\u532f$23856 (Our remitted $ 23856).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b9b4a6-5945-11ec-96a4-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1639091520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091520, "uuid": "b9c2827e-6054-4520-a5ef-3aee73e2224c", "comment": "Malware payload (Amadey)", "value": "0282fdb46e1cc2f6514f52baf20530d2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091520, "uuid": "2a3cb580-0521-4be4-b59d-3bc8bc7dcb24", "comment": "Malware payload (Amadey)", "value": "94566da96be8685e33c7e21e6b215c53aff7aca4ae105271792e3dcd9e631c63", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091520, "uuid": "5679d0d3-7aa6-4704-ab00-6eb15362e5ad", "comment": "Malware payload (Amadey)", "value": "77f426717ee587e7d616af2957db82aca7bba6a1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091520, "uuid": "dcbff4b0-3533-4ef8-bf59-27531b156950", "comment": "Malware payload (Amadey)", "value": "5b04f0b05ea27b86f0d115bf56ad879f998652701ab7ba876b05dd8f373fd66cb4eac11200a96d6a251db802fc4c04a4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091520, "uuid": "f0bf9b52-7074-424d-896f-382d068e770d", "value": "T10FF633C147D04172DA2D6AFEDA61329259E5522DECA0FAD77BA08C456912EC02FCF3D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091520, "uuid": "ecbbcb9b-05a9-44bf-8b7c-90c2b5aea2b9", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091520, "uuid": "cbd9e80d-35e5-4366-9ffa-978cf9062b9b", "value": "393216:JXTjeiPYxIAIqNfqCmhQ0HoLILPWssNeCKreKce8FPZmQ:JXfeeYxDdwC0Hf+leZu7oQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639091520, "uuid": "7f69dc76-8d8d-4ee0-a8bb-b3e6951094ff", "value": 16167667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639091520, "uuid": "353265c0-f1b1-4fda-a66a-450c7766cac7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091520, "uuid": "36d07296-2d8e-4e25-8fc3-b47e42618dbe", "value": "0282fdb46e1cc2f6514f52baf20530d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bd8b70-58ed-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639053660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053660, "uuid": "cadc2d14-396e-418f-84f2-5de0751160be", "comment": "Malware payload (Heodo)", "value": "1f9b71f3791fc9feaa4e0808a54d45a0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053660, "uuid": "33567f14-92bf-4401-be67-e37bbf170698", "comment": "Malware payload (Heodo)", "value": "949624c4ff8c04ce63b2522a0e350d93b8e0d5932d7c9bc7eab76f1c389ae00e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053660, "uuid": "e7cd615d-7abe-464e-986d-fa2135f7db7d", "comment": "Malware payload (Heodo)", "value": "c93b5d123a1f821648a50ad46e6d5e19693cb21a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053660, "uuid": "b5dbbea1-9295-4574-98e9-87bda5f2c2c0", "comment": "Malware payload (Heodo)", "value": "4b27088ae43e1c531f032804e5a8a523cb6c7cba4ea45421c40f50e8c69c380432511f8a37d85eb3cfde0beaa0887685", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053660, "uuid": "b8ce0ce2-db19-4e02-b667-07d773f726ab", "value": "T11444BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053660, "uuid": "15b04cd4-c5b4-4c4c-ae35-bfd62c6b483f", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053660, "uuid": "2734aeef-91d9-47bf-a2c7-334295d2a00a", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBH2ypv:6jIG/pjjuLbJLmGshoCUnWTRpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053660, "uuid": "e686c981-e9f3-4a5f-a33f-48f21d9af26c", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053660, "uuid": "5a769e94-8eb0-4d95-898d-ff95e50b68ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053660, "uuid": "48148b35-84be-4232-a01a-1ad3e72e40f0", "value": "h9Qp7ULDzOK61.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22680eaf-58ca-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639038572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038572, "uuid": "eccf223f-03f4-4339-8642-77e141abd335", "comment": "Malware payload (RaccoonStealer)", "value": "23a1ebcc1aa065546e0628bed9c6b621", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038572, "uuid": "07376924-4d2c-4849-a6a0-d28d97a20af4", "comment": "Malware payload (RaccoonStealer)", "value": "9615e9c718ebdfae25e1424363210f252003cf2bc41bffdd620647fc63cd817a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038572, "uuid": "443f1f51-457c-4275-b358-d06e31d6bda5", "comment": "Malware payload (RaccoonStealer)", "value": "d8e8a400990af811810f5a7aea23f27e3b099aad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038572, "uuid": "2ecf4ad7-edc2-4f15-b7f4-8d00f1800af9", "comment": "Malware payload (RaccoonStealer)", "value": "c17e5881b87be65e2b9f5879f70dbec4f592e22364f562a5a236125c235f2442989ab6bcbe7df9bfb1671dd95977336d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038572, "uuid": "f1fd3863-f694-489d-8ef0-afa2ae7cc352", "value": "T1A58523F11839E325C935B2B7F498F0BFA69D4C22DB84C8A6BFB62D5818F13815D96C50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038572, "uuid": "f02a23aa-582e-4099-9bb1-31d32166baee", "value": "a89ad4308c6b073c29d7b4d307af96d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038572, "uuid": "b887cad5-93a5-420c-976b-8c058184615f", "value": "24576:e6XIDc1uxIVMU63UgdPBHYN/kjSxPr+5jdF1NGlD5+MjDuoISJUe3jeuwwywfOaX:eoIg18sG3UqP2NplF1+6uo/JP2S/YBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038572, "uuid": "be184edf-1175-4f28-baf3-a79dcf350a4e", "value": 1769632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038572, "uuid": "9fd8516d-ffa7-4cce-a23c-2a44864f9909", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038572, "uuid": "34641058-0e3d-4076-b9b4-246b7496fb1c", "value": "23a1ebcc1aa065546e0628bed9c6b621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a47cf51-5887-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639009943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009943, "uuid": "c64d6596-4419-4f6b-95c3-ac2591787044", "comment": "Malware payload (Mirai)", "value": "2eb1a2d21aef751c274d6eacef880f7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009943, "uuid": "58574fea-9d82-40a6-9b75-557cc01e1659", "comment": "Malware payload (Mirai)", "value": "966494c889fc0741f8b1270b3558f6593702841397afb81f0c4de196820d1ddc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009943, "uuid": "5c454d5a-3fca-4980-abb8-3674809587bf", "comment": "Malware payload (Mirai)", "value": "31a03c086a69a828fcc75b83cf7377dd1a1e175c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639009943, "uuid": "3ab93daf-94e5-4c63-bacf-ab315239dac0", "comment": "Malware payload (Mirai)", "value": "9cf5d94d5f0dc940e96bc358c086a9d1399f482d7c3386f6577794fa72bb5902e3daf51db6584b026f29362def92c971", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639009943, "uuid": "1aa18d67-d1b0-49f4-b5f9-e9de45ba44c9", "value": "T149931957FC40DA02DBC41276FE5E519D371223DDE2EA3203EE269F2436DBA1A0D7A451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639009943, "uuid": "7d3d7218-7b4d-4c70-abb6-3a17bb8952cf", "value": "1536:ChDRLpjqpfHXYNyKnVv4H2HUOCep5GqaNPINvD:ChFLpjWG3G2HUOC83yiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639009943, "uuid": "8c27f6ee-4842-4cea-a264-8e426e1b0728", "value": 91516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639009943, "uuid": "b64d2762-4cdc-484a-bee8-35d5d91ebc95", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639009943, "uuid": "7d87d48f-8632-4e85-abd6-316b99dcd300", "value": "2eb1a2d21aef751c274d6eacef880f7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb72996e-58f0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639055257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055257, "uuid": "791121ba-fb66-4108-8aae-d53a1a4dac4d", "comment": "Malware payload (Loki)", "value": "ad9f1c493b3d8ed8cadd3cc888a16f29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055257, "uuid": "5e11bbc7-8019-447d-91c8-4c33a20a323b", "comment": "Malware payload (Loki)", "value": "9685ed86f91fd0a3c20c5badbf361475fa0316f365a35d352e8e1caff333890f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055257, "uuid": "10deb21e-11e0-422d-a117-a42b6a2778fd", "comment": "Malware payload (Loki)", "value": "940d6749df97ab644141fa7c5e3eccbf05c49fa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055257, "uuid": "eba92957-6de8-41b4-b503-0e2a4db6c2df", "comment": "Malware payload (Loki)", "value": "02c97468010dfdf803255974cf01ad99f250b65d39f038af7cb0834c9d63dda3e53828833e0fa7ff9b163ca30f9e8b33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055257, "uuid": "098f40d7-8464-4dee-95f2-597cc12dc398", "value": "T1CBF49E6531A0E473E23B957A8C27B7A85530BF516B94DC452AE4BC4E0DFC760F81B28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055257, "uuid": "83412d07-1eaa-4a34-a47e-ec9d2803e783", "value": "cf4ac33deb94090eb70c93b194aa229d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055257, "uuid": "089d12f6-deb2-46f7-8b38-2ef3b5e5c9a3", "value": "12288:/SYSMXRFwZEQ5TYy2apWLDcdIy7BdFRcqzit:/48wKOD2aI/Vu5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639055257, "uuid": "2fc3e584-24f0-4b77-9b21-a3b7cafc11ce", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639055257, "uuid": "112f36fd-f010-4897-b384-6e3a66f21e9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055257, "uuid": "8ddc6649-8941-46d1-958f-555ebfd2b1dc", "value": "Purchase-order#4fesfvdhdg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7a9f8e-58d3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639042746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042746, "uuid": "39a53aed-f547-4202-955d-bb8e5c157504", "comment": "Malware payload (Formbook)", "value": "8d6e177ad862e35cb53af6f78398aba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042746, "uuid": "f1e5ed6e-251a-40a5-a6e5-13473d7c504a", "comment": "Malware payload (Formbook)", "value": "96881d674f8e6c8ff14c923bc5c64aad6bd57ff03f540d8bc75e956fcfd49f8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042746, "uuid": "ab4ddba7-d6da-4c36-aa2b-d9e06a9e3c39", "comment": "Malware payload (Formbook)", "value": "f2c03507d265a79b2675d06e92790020b77f0ac4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042746, "uuid": "a106ae47-22b8-4e7b-8724-768cf68da85f", "comment": "Malware payload (Formbook)", "value": "a108b3d640e5859025969123771bd4232405b9a73e97aee8c601e7867df4f47df17822d5f379dccbc575e8d2324879a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042746, "uuid": "308850a9-3d59-468a-a418-df2bf1ce6929", "value": "T147350120A9BB801CE85B35F85F057D630E6B9DB9D4018A4A277EF219543E60BCF227DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042746, "uuid": "402f2829-f895-446e-9020-699a87e6b9f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042746, "uuid": "792b3fcf-04dd-423c-8c35-757ad7645828", "value": "24576:R9T+FZIZW3MktHAAtmhAyIPKerzvwVqL4YT4AoI0XsYF73Sfrw:R9TQZI0MkJAAsAHPKywVqsYU//xiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639042746, "uuid": "98dc3505-dff3-40b2-adfd-96b100023d08", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639042746, "uuid": "5d63be29-299b-4e0a-a28c-58c4c3515b3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042746, "uuid": "da4e9988-0ced-4b61-935b-5ccb219425ec", "value": "RFQ 000955743.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18626b5-58cb-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1639039295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039295, "uuid": "be6f8c53-4aa5-4483-9e86-96f25030a96c", "comment": "Malware payload (OskiStealer)", "value": "a6c1d6c7f027edd65fc284f1189dd5a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039295, "uuid": "43dfe359-1ea5-496b-acba-64e5793de16c", "comment": "Malware payload (OskiStealer)", "value": "96d8f77904387c5513e92733b0714987fdb476d6330c08c5404806b60f22af6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039295, "uuid": "2914839d-6476-436e-9c51-b05d3193fa1f", "comment": "Malware payload (OskiStealer)", "value": "21f603ab1d5b62c1ee34369d462616388806dc1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039295, "uuid": "a009bf76-132e-43df-af30-d32754125c03", "comment": "Malware payload (OskiStealer)", "value": "3093d8d67097025f5daa2eeba083393399d1b4efc253435da763622ba2b40de9bae011c0b84696544a26203f0d0776af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039295, "uuid": "0d6e9e0d-145e-40fd-b43e-bb39c96fcda6", "value": "T16655231B2CE4B56FE56D56B0C363C0918F7CF0032D55F2B6689356BF673828ADA06A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039295, "uuid": "bd2e8fda-c295-4963-8200-e988847b14b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039295, "uuid": "ff7bcad5-110f-40e9-b37e-01bb788538fe", "value": "24576:WIKjy/SYCpJ042WrhUAhIwpvYIQ35PhGtfl8noPC++wUX:kjASRN2Wrhlrhzemnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639039295, "uuid": "3ca05979-6613-4bf4-a50f-d79e47683931", "value": 1286144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639039295, "uuid": "afcf8827-3299-4f60-9cf1-f38528fd7a49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039295, "uuid": "22d0f381-fd80-46f4-a4e9-09d740b6a166", "value": "a6c1d6c7f027edd65fc284f1189dd5a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f026efd3-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639054379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054379, "uuid": "f4aff599-9728-47a5-a864-6d886e1923e3", "comment": "Malware payload (Formbook)", "value": "1025b4c47a69ec6ddbb42c8ee3ff0219", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054379, "uuid": "4ec008e2-2a46-4a9e-b716-91eb030c5fb4", "comment": "Malware payload (Formbook)", "value": "977507f7c880cc1a6425fef7d32068a687ec3db593e384f6730bf99803dc7684", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054379, "uuid": "af43c0a2-b773-406c-ac27-8b16cf9f3d9a", "comment": "Malware payload (Formbook)", "value": "f6ef57f11fc98f48373545da937eb89be95c3ddd", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054379, "uuid": "853c4373-907e-4ed6-bfc3-b65c235f3173", "comment": "Malware payload (Formbook)", "value": "83ac9fe0b15277e9f39506a67d2e2653a6d73675ad568f069f109bdd68b0ba7eda2f09fe2091bbc3f6d5fa68a1ccf673", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054379, "uuid": "25aa270c-8567-4284-a7fc-5249f2f15414", "value": "T1C06412E3B6C185F7EDF246B508765B6AC1BD2E8882B41A1F83D47F6339721D3049A44B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054379, "uuid": "0bbd7a4a-58c3-45d6-8e7e-c4286cae1624", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054379, "uuid": "9f75fa53-b5c4-4d2e-bd08-37c30bd022b7", "value": "6144:LGi4zy1/Vzlpty/2PTxsjFWkckvO7ukhrfxwbQWQ0sLlBWVO+Ket:Gy1/Nl7Vw4kcAOPrZwbTiYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054379, "uuid": "13a41f26-ff73-49e4-800a-bf3060b7dce4", "value": 329891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054379, "uuid": "b7dfaa6a-9f26-4ac9-bc08-b1a8cdc65adc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054379, "uuid": "e8a293c1-b73b-419a-8c35-6bee0060cdc9", "value": "\u0625\u064a\u0635\u0627\u0644 \u0645\u0633\u062a\u0646\u062f \u0627\u0644\u0634\u062d\u0646 DHL_119040 ,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d38554d-58de-11ec-96a4-42010a9c0029", "comment": "Malware payload (XpertRAT)", "timestamp": 1639047368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047368, "uuid": "34a21629-0e7f-44a9-8772-3d10f8084566", "comment": "Malware payload (XpertRAT)", "value": "1bad21957abf5597d295ed971faf1ffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047368, "uuid": "6c13368a-1493-4cfc-9825-c4b194ee6cbe", "comment": "Malware payload (XpertRAT)", "value": "97ccd53d7d9abd378152b48894064f0c226d40a40a19f9ca485bbf5c062d02ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047368, "uuid": "7cf8d456-54d7-4340-879d-10ea76e205c9", "comment": "Malware payload (XpertRAT)", "value": "a72a8de5dcdcf6d7b71e932c482cfa69d81ff28d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047368, "uuid": "2cceafb5-653c-4d98-986f-a56eb3ec3e22", "comment": "Malware payload (XpertRAT)", "value": "18e4fd35ce51b19591daca56a21a75fb34d465c8dcb7cb56fa862c2e6eacaa4da04ef4d734f91ae733f44bc3debacd91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047368, "uuid": "769c0de2-de05-4359-b0cf-516326b60ffc", "value": "T1BA45120D29F0E46BC16D5AF2C76BC090CBB9E0462D53F6FA6C9241BE7B34F895506B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047368, "uuid": "9e570427-77ad-48ee-831f-72659f99c06d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047368, "uuid": "dfa4b7b0-5713-4b6f-a35c-8556cd2d2dc8", "value": "24576:7IKjy/SYCpjVNH9RpUdKWjLAXVvb0ahsJ+vgdyyYpgxgLjXOy+l3d1QX:7jAS7VxpwdjLAXVvy8vfyXajenZd1QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639047368, "uuid": "3a2aac8c-f105-44c6-b712-6f798cefd445", "value": 1199104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639047368, "uuid": "43a8cbbd-4707-4d59-934e-680c19824597", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047368, "uuid": "3cd7e498-775e-4182-ae0e-0eed9731db0a", "value": "Expo_REQUEST FOR QUOTATION 2021-0912.PDF(79KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d965bc6-593a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639086748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639086748, "uuid": "9d338a0f-aa25-4dc8-9c64-7ca98a1cddb6", "comment": "Malware payload", "value": "b26ef9d1842d170dcd345a1bc880791c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639086748, "uuid": "8a704c3e-eb16-4e4e-8bb7-627d41df91f5", "comment": "Malware payload", "value": "983ae0d2ae2533d92f8a29551d8c835e4d681fc0d1aeac71003ba8014ffd65ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639086748, "uuid": "b626c34e-2b7f-435d-88ab-fd0a8cb980d0", "comment": "Malware payload", "value": "44c918f55d8c14345e0b01d4b9af07f642cd0a34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639086748, "uuid": "44518a5e-694d-4ffc-ba99-ebf6ead2adb5", "comment": "Malware payload", "value": "a4e648dc857284b9f5afff342b9da13f0692f397e2b458f5fbebad2bab8f088b22714adbc647f9c4d8eb1df3280fd8fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639086748, "uuid": "fadee4e5-47cb-4756-9a24-737ce05c7e28", "value": "T1F76412088EE116FBC5E51671127B9BB0EBB882DF01A8EE17DBF01E5F69E115345263E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639086748, "uuid": "45563789-de91-4f04-9e85-863f4fb332b9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639086748, "uuid": "e4254a4c-b548-4f0e-ba19-497de4a4d79d", "value": "6144:rGi9OJ3hYeiXNuPteS5VpgEzSAELI5BCrPhNzIQVBldokBeUud+HJlF:PNGPmEGTI5iZNhl/u8XF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639086748, "uuid": "8e31ff63-4de6-4fc8-9140-cc653fa37eae", "value": 308408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639086748, "uuid": "52fb391d-51b5-4aea-80c1-13087207757f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639086748, "uuid": "311bb1a2-0cb8-43d9-b655-9b2c584fe1c4", "value": "b26ef9d1842d170dcd345a1bc880791c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361587de-588b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639011547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011547, "uuid": "6750614e-11bf-4c56-af49-512dc1bacdf3", "comment": "Malware payload (Heodo)", "value": "81bac5a025255cd7a9ea7a4af7d45f53", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011547, "uuid": "09943542-59fb-47a1-9b54-ca953f15eed5", "comment": "Malware payload (Heodo)", "value": "983fea59daa9f7bd47227f275ae5994b414efd995513236639e4e69bad30d5a6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011547, "uuid": "2cf1b450-839f-4732-bb95-9906d4180cd5", "comment": "Malware payload (Heodo)", "value": "afa87ee58b33b0e92c6e5e1e820ac526ada3a184", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011547, "uuid": "47b36306-9ec6-485f-8bff-6b749e3c2ef6", "comment": "Malware payload (Heodo)", "value": "65e6fb960b2441b696361c0a9c7e712226f7a6b76f3c4702b2f8f23c19a00cb85330c86ecaeb2a1055b8a718727ac929", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011547, "uuid": "aed77600-3196-4aab-87d6-80aeb4dce554", "value": "T1B244BF10A181D036E5FF087A89FAD9BE466C76600B80DDDFA398187E4F6B6C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011547, "uuid": "1b76070b-b7c5-41ae-92c1-5d19b220e4fe", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011547, "uuid": "84e335e2-c6e8-46e0-bf53-f0280fd36d04", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBpmgL/S:Wvef8+h61mRcHL+rF6l5EAQWThL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639011547, "uuid": "3402fea5-7d96-4f3f-a85a-8c10e34e6b42", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639011547, "uuid": "1b092171-b392-4ec1-9289-157180f9ad85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011547, "uuid": "b4cee785-4083-4482-8629-707b71b5f801", "value": "emotet_exe_e4_983fea59daa9f7bd47227f275ae5994b414efd995513236639e4e69bad30d5a6_2021-12-09__005902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a59dc7-590f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639068555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068555, "uuid": "1450a887-de07-4feb-8458-fa5d8e4b654f", "comment": "Malware payload (Heodo)", "value": "afad95b1e4dfcaadddd777d6b2e9d44f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068555, "uuid": "0f0a0e7c-f863-4bb7-8ab9-503a341b22db", "comment": "Malware payload (Heodo)", "value": "98d295ea19d5c7748136c70ea4689c83dba79b9041864449b843bf4deda49b75", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068555, "uuid": "112b25cf-e333-4082-9920-7f7c875b6ae6", "comment": "Malware payload (Heodo)", "value": "7504c369253494ce40be58f602ef10634b5bba3b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068555, "uuid": "1ac18674-1104-431b-9190-1907fbc8742f", "comment": "Malware payload (Heodo)", "value": "4a0949be7413aeecc0ea5dc2d23ba6613deb36edd221d0d3bfbefc55aa30283fd0d7c78bbce208ca93096fadd4c1d916", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068555, "uuid": "99262706-0c3c-4922-8e37-1060edd4caea", "value": "T1E344BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068555, "uuid": "15d168d8-55b8-4b12-9bef-895f023344c4", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068555, "uuid": "d027968d-1137-4441-a459-e79592488e38", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBj2ypv:6jIG/pjjuLbJLmGshoCUnWTRpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639068555, "uuid": "eb9f52dd-52c2-4376-abaf-a4337eb9d527", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639068555, "uuid": "702789bb-193c-4e5c-8012-5d3dc3fc9fff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068555, "uuid": "34330361-f074-48e0-a9cd-f92c28e38e18", "value": "1tdsf1QGQ3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d41a45-5918-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639072206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072206, "uuid": "fad2c33c-25be-4c22-bc26-7069c869df51", "comment": "Malware payload (Mirai)", "value": "03612f7eb110cd928b948e7bed1b7bee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072206, "uuid": "8b080463-4c7f-4d85-b3b0-563df7ea8ebd", "comment": "Malware payload (Mirai)", "value": "993f0ed7d7b859d7aee3f5f724793fb02680324d451069ee9477f7ebdd98b5e2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072206, "uuid": "2240e953-8e4a-4da7-9614-8a0459d387ea", "comment": "Malware payload (Mirai)", "value": "568f8fd1ebaab209db1e3375f0046ed407454059", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072206, "uuid": "fe9d7147-8c5e-4ba3-8a85-1d6e620c4c9b", "comment": "Malware payload (Mirai)", "value": "be5d46622b43e0259e256ae15aefd4a8f8e272204d19a3541df283c94da43313d51dac65092f57411fa106373b244065", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072206, "uuid": "907d48a3-20b0-4913-b233-243ba5b4e896", "value": "T125D2E0B818AB5872D5B14B71DBE5DEC132030B7ED06BFA35290603D0DE8134A7ABE596", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072206, "uuid": "f399c562-52ed-4de8-a6f3-f49741be613d", "value": "768:VXQD3WV1wjry5HfJVih/y79gB/qzzs3Uozl:GD381bHfWJyZgB8ezl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639072206, "uuid": "301ce73a-918e-4df1-95ac-76ad83a5daeb", "value": 29852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639072206, "uuid": "65fde987-0688-47f1-a898-f0f40f9673ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072206, "uuid": "2219feea-b221-474e-9b97-249463797ef9", "value": "trynagetmybinsufucker98575.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec13882-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639054108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054108, "uuid": "75bf13d6-ba38-4d8f-ba56-ec93d7d577df", "comment": "Malware payload (SnakeKeylogger)", "value": "8b70954fa6e6cc11abce5eb3a662854d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054108, "uuid": "1aa6cf10-ddc9-4865-80ca-24afca579a85", "comment": "Malware payload (SnakeKeylogger)", "value": "994cc7cf468a58b8e349624496714a2c23cc97f40d7d608d66abb8a700783c1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054108, "uuid": "ff7715d5-f2ff-469c-9425-1cf18fef4bd1", "comment": "Malware payload (SnakeKeylogger)", "value": "c4e7dd66874a9950f3cf9bdba8754450171f6fcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054108, "uuid": "1b47b2cf-75be-48ef-b3f5-2e7e9513b789", "comment": "Malware payload (SnakeKeylogger)", "value": "cb0fc9de93265bc9ae0e13e1490c22f635f846148b1e4967dfa858ceb9cb4409a9866be0ee47315a7b0124507b770482", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054108, "uuid": "97005bbe-5079-42de-871f-be7f84c98263", "value": "T1EC35020B7AC9DBEBD9040D318D77E70643159E115F432B27B0D8BB4EAEF92118A4B7A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054108, "uuid": "617292b0-d237-423a-92ee-96b1a0800ac8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054108, "uuid": "41553630-aaef-4c05-8b7e-d2e934dc12ce", "value": "24576:utj1FEZxRpxz1FbRUFKCF3LyrnO2GmmycZy:DBFFIBxyK9IcZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054108, "uuid": "f27dd4e7-7c9a-4256-9147-2ef66093a94d", "value": 1068303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054108, "uuid": "b3df82db-6508-4055-8fcd-cb9335bf922c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054108, "uuid": "d185b64a-57d3-40f9-92d3-c5feffce1fcc", "value": "pedido n. 374_12092021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb56f0da-58ed-11ec-96a4-42010a9c0029", "comment": "Malware payload (SystemBC)", "timestamp": 1639053942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053942, "uuid": "1a2e7594-0e82-4079-beb6-0e71e786dbff", "comment": "Malware payload (SystemBC)", "value": "1dbcfa3bb1af2d00f54a7640d7c762e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053942, "uuid": "aade3bca-9f7a-4b87-acbe-5298d1f5e55a", "comment": "Malware payload (SystemBC)", "value": "998fc169ffc3a0733acc834d4634a5fede414e9fecd85bfbbb2ec80ce48810fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053942, "uuid": "94779889-d663-4266-be64-e842638bfd28", "comment": "Malware payload (SystemBC)", "value": "30d5a37bc22c3605ab5d480b29c928618aa9b25e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053942, "uuid": "9df8860b-910d-4ba9-9bf6-928ae5c74079", "comment": "Malware payload (SystemBC)", "value": "48eb82f47aaa1795261edaa41a6bd652cc9abf0e815bb28000956d7d2bf61300e84dc45a0c745a0779d7c063f4810884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053942, "uuid": "314bdc7b-f005-4693-8f02-c4b7e15ba0ab", "value": "T1F4048D3176EC8531D1A34E30586196A44EFBBC226A30A107E674E78E1F72FDC49E535E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053942, "uuid": "7650ecd2-7554-40af-bdf7-8eee62f83eb8", "value": "d541639438edf94a0fdd982ab363141c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053942, "uuid": "1c975cae-0fcb-4e6f-b12e-5c82882c3adb", "value": "3072:FTuLlO3oL57vcHv3M65Lz+5WrxpzbgqruXhs7sxkgaBChU+k2:FTuLlOeDIz+5uzbgwu6Qigak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053942, "uuid": "65da0708-bc7f-4b17-bd06-94724b329b1c", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053942, "uuid": "8813bee2-5a42-4a1e-8b37-92aedf112f3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053942, "uuid": "ece9a24a-59da-4708-a932-5a1672d53a3f", "value": "1dbcfa3bb1af2d00f54a7640d7c762e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ec1d32-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639054273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054273, "uuid": "324ea9d0-eeca-4f1c-aafa-eb76f9679bf7", "comment": "Malware payload (Formbook)", "value": "423d25ac5eadd82b6e1acc94da953cd0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054273, "uuid": "2345e144-c97a-4c12-b33d-6db0160e9cca", "comment": "Malware payload (Formbook)", "value": "9a273b116f24a436da506eb05f0d024d2982aba344c4d5a88289eb1ccdb29c50", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054273, "uuid": "e68c8cd7-fcb8-4593-b654-cc72ba1ea8fa", "comment": "Malware payload (Formbook)", "value": "26f4fdee839133a7f65b95639a7bbc0b6dafac6a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054273, "uuid": "68254f66-052a-487b-ba43-a48706f7480c", "comment": "Malware payload (Formbook)", "value": "19a31f145cd2273b79ad166d361f96b625b213766dbc6076efa8e9008a97d29f9b590fa09526ebb3f0be5fbe16316394", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054273, "uuid": "98fb987f-036d-4261-8cd2-696058b8ac63", "value": "T1FF3412D5B314D87FD7A7A471BEED0A2572ACEFC00096283E116437A568F6006CAD5BF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054273, "uuid": "03a0e282-3d45-461e-9202-2d1d29ee5ca9", "value": "6144:3B2T0SyY7hh3zUbTKlgS72JdAZtI9VgOS:I4aL3zEKh72vqcVg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054273, "uuid": "4faf63b8-c57d-4add-b9e1-7bc6ba68bc1c", "value": 234568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054273, "uuid": "0008cf2b-4e1e-48e1-b79a-ad42fac21999", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054273, "uuid": "50bd47c2-2022-4d8a-aebb-1efea034cab7", "value": "20211209071622734.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0fc22f-58d3-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639042620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042620, "uuid": "8717b3d4-b041-4f11-afc9-74bea03a105a", "comment": "Malware payload (RemcosRAT)", "value": "4fc9b1a0846d6d03bc686bdd61a56370", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042620, "uuid": "249bc586-faad-4723-983e-1fc79714c2a7", "comment": "Malware payload (RemcosRAT)", "value": "9a63e8c9e7bfb45eb903482e3ba9ed3f3d64db90b62f13355dff1a5ed5d2376d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042620, "uuid": "e8afbd3b-6076-4824-97fc-09c09b428d29", "comment": "Malware payload (RemcosRAT)", "value": "db8cde7d60b40b047c21b70e81cc97cbfec7bc22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042620, "uuid": "e604ece6-99d1-4791-a598-40de82454d44", "comment": "Malware payload (RemcosRAT)", "value": "3841f99e80090391a1432b39878cb6dad0ca974498f7df74a8aec7576552933ae5df489560e74ceb114560a203b536ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042620, "uuid": "b05c7c91-b448-437c-b809-64ca5318ff3c", "value": "T1F0159EA2E2E05C32C06F15B8AD4BAFE455377D103D18DC4A5FF82D889F767A034295AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042620, "uuid": "881c43bd-adb8-49ab-bd01-47d5de76e555", "value": "939d8f743f99c748d946de3c81bddd31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042620, "uuid": "44b2e638-d2ef-441b-890f-acb8e22c868c", "value": "24576:muRQsAJcBdZF0bE25chN+QIK3c13TOqamxypnUXfGe:mL9JO08b+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639042620, "uuid": "41db809a-3689-4d9a-b6b7-c7784ef946e2", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639042620, "uuid": "657a791a-04dc-45cc-a1ff-d80670d2c20c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042620, "uuid": "0f3f71cb-8bf3-4adf-91e3-93d7421c9c3d", "value": "BIOTEQ PO#200820-BQ-07 NEW,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8536ce52-58ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639031866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031866, "uuid": "40cbff64-5c1e-4c7f-b877-d77743abf5a1", "comment": "Malware payload (SnakeKeylogger)", "value": "88f89942f4916db1d528b204ee3e0459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031866, "uuid": "f30be6d6-fd84-4c70-b255-fe13a207d8d7", "comment": "Malware payload (SnakeKeylogger)", "value": "9b138ab23ad396c36059d64c744e5439bef763f4cb2daf9e6b48aa6bcff13dd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031866, "uuid": "67f1c207-99d0-4c33-824b-cf17ad38a15c", "comment": "Malware payload (SnakeKeylogger)", "value": "4fbc0f1e8c993bbb97372e46346b6848418b22c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031866, "uuid": "639bed9e-c57f-46a9-b3d4-6c4cb696255f", "comment": "Malware payload (SnakeKeylogger)", "value": "b03a0e277a1b731d11f76dc7c00ff84e599d84fb414dc413f0d05fa30dc4fca9fc16a372c7c1d3c64556e55723bfabba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031866, "uuid": "f88a097a-ac9a-45a2-9306-5c656640692c", "value": "T19BA4F1F2C7C015CAE0B1483A136263F0C67ED3E837A7199A7BBEBE56962D2450513973", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031866, "uuid": "db18cf4c-0f14-4b01-89dd-97c8254941e9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031866, "uuid": "7cd1cd77-17e6-4b5e-a317-70dbe6630651", "value": "12288:XeIduOHqN3ZtAdk3i14vy9o+Stj8bBG1D98ugV:5Z4/BI4vy9or8kD98uA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639031866, "uuid": "5fb8582a-3fee-4dfa-9d79-b03d7f950896", "value": 480874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639031866, "uuid": "f129b569-3976-4e19-8e00-ad615b74862a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031866, "uuid": "be700192-b486-49a7-824e-619f4751d870", "value": "40987654560--0987544567890987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb8c052-58bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639032472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032472, "uuid": "e18cefa5-3721-4cb3-ab14-5feb6f9e4491", "comment": "Malware payload (AgentTesla)", "value": "406b251b7c13293bc08f2eb37989dd23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032472, "uuid": "5c2318b4-2d08-4a16-b7b7-5e5f5aed37b8", "comment": "Malware payload (AgentTesla)", "value": "9ba8a363fc2f5ad9f6e1a7eaa63464b31e4b19a3fbd7ae8293236449f1b1cd3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032472, "uuid": "c2a0bbf9-96c4-4a47-92bf-4686b5b6684d", "comment": "Malware payload (AgentTesla)", "value": "a3c8078f40a468b474f978e0538457f19ba87d53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032472, "uuid": "8a49a548-0b21-4022-af46-a0c1f6150dde", "comment": "Malware payload (AgentTesla)", "value": "b72cbd8b0cf447815f3c20476f2600ea4702cbe1cc965e4b1595038b39cde62ddde126ce9992ba8182c52bfd0a1090b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032472, "uuid": "ab2252bc-1abc-4eb3-a006-f3c005f91b9c", "value": "T121450124887B404DE4A77AF40F597D560EAB9DB9C012865A337DF628C83E617CF2278D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032472, "uuid": "a9a714ce-526a-4250-8c28-29ee4e64a439", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032472, "uuid": "de879176-9f9d-48ab-9d1e-655d2cab20a9", "value": "24576:RiHss2juEopgf+oWIPFG3zg8nefHKDiFDDltNVr:RiHsbCE6gfrWI4Ib7rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032472, "uuid": "d06932c8-0d20-4910-b7c9-6c9579745bcc", "value": 1193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032472, "uuid": "bee2d4d2-6a41-44f2-acd8-b2bd5a57156f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032472, "uuid": "e74e54d9-69c3-4276-a629-e6897a79da1c", "value": "DHL consignment number 600595460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4076eab5-5900-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639061815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061815, "uuid": "73b50c76-b1fd-480f-9f17-0b8b2ee5a208", "comment": "Malware payload (Mirai)", "value": "4459fc200d66d7cd416921e762a211ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061815, "uuid": "868dfd86-83dc-4583-ac94-65a18e859e84", "comment": "Malware payload (Mirai)", "value": "9cc81bbc5a9ca48c255ec8702fb8e00eccc64bc0c6549c902f38a04ca399dacc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061815, "uuid": "feca93ae-f9e6-43bf-a049-125d3a90ae14", "comment": "Malware payload (Mirai)", "value": "7f520e0e13acb487fca9ff0aa7f808c0ced0dd72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061815, "uuid": "062f60a7-1a63-4b86-8657-bcb1d1b1e1b3", "comment": "Malware payload (Mirai)", "value": "ba9f55c6d2fd789d1ba7ca2f81de96c89fc98ed1da3ea8a95cc0c2e3b62b373cc1ffdba92cdb175a13b182743400918e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061815, "uuid": "cec6fd13-3c7f-437d-8a7a-f9872eba1cd1", "value": "T1D033029570047161C7703637F8361193BF491BFAD2E63437096943E4A8E94A33AF6DE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061815, "uuid": "18c1303d-4555-46c3-abfe-f19aa9a241db", "value": "768:yMte5B4PACtw/YcmRIe18D9q63TxZQbSORe7Su2QJnKE79TLr235j9q3UELbOs8D:yM84ISRX63dZQbS5rzZ235iLIVmWjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061815, "uuid": "ff0a7794-ddff-4f72-821c-b00b0b236b38", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061815, "uuid": "22a691c5-2c02-42bd-a7d0-02c717883b90", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061815, "uuid": "3c1b8901-47b2-4040-97ea-9fc03d738ebc", "value": "4459fc200d66d7cd416921e762a211ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29cae9f-58c9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639038465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038465, "uuid": "74de0848-1d18-449f-a6a1-fe4e4747cd63", "comment": "Malware payload (Formbook)", "value": "04c64045e97ab9130b6ecf13d76e8b2c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038465, "uuid": "486b06b6-7e34-42ef-8e3b-e7175b8fe04f", "comment": "Malware payload (Formbook)", "value": "9cc8b6cbd8e91bd34051a14dd7aa3ef3ada33bdd2369cf95751b700554c41918", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038465, "uuid": "cb8b2a64-dd07-42d7-b00a-2e7a79b3529b", "comment": "Malware payload (Formbook)", "value": "8d2ea3b00932a7dfa186dbafba6f05baf6a8f730", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038465, "uuid": "ed82760e-6f90-4da9-9fc2-d463bb6b46a9", "comment": "Malware payload (Formbook)", "value": "b90e16f457951e288cf6513de629be1ed3b71475d2fb6d13796e745d877d2097c267fd2868e13381d60c0731d7252639", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038465, "uuid": "0668c94f-bdda-4e40-a46f-918c84547dfe", "value": "T1485423C76B8E5CA5ACE2C48ACBEAEB063B30E1025CF524ED97C05DF552C49173D6921A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038465, "uuid": "a57d5fdd-b8ad-4a71-83a8-f989cb8c5935", "value": "6144:VSdwY8pNyKrUYnOSYuA2bU1fsMaD74K8ACUaeV4C1i/rGajA6:VSdwsKrJYuK1kLQqr8J5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038465, "uuid": "30e41946-aa48-4ebf-9cf9-217b0dc390f2", "value": 305015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038465, "uuid": "33dfb49e-54ee-4dcf-9c86-14ceed1fb92b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038465, "uuid": "7d084b90-c552-4c91-896e-5546a0672085", "value": "Pedido.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652d66ec-58bc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639032671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032671, "uuid": "0d47ba14-8562-4e2f-9017-fe57815be2a5", "comment": "Malware payload (Vjw0rm)", "value": "477b6df08c74640d43f5ac09ac6bae6b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032671, "uuid": "f818cd58-0c71-4369-8acb-b2c4eb68fb8f", "comment": "Malware payload (Vjw0rm)", "value": "9cf84fd2492267663601b1cfc2c175f0a0b26a5093cef53026dbad56f0babcb0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032671, "uuid": "5852d9c3-0073-44fc-b1c2-3f769285241f", "comment": "Malware payload (Vjw0rm)", "value": "eade134ad030e6304f72727eb91d5e9444e636ba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032671, "uuid": "628ab7e5-81a3-44df-851c-14d58fc167db", "comment": "Malware payload (Vjw0rm)", "value": "cc45edb2b2469f7b2be3c9eb9283dafb0ec1bf13b10353dbb2a5fb8425e441d86655d7481ca98b13cde2d0deb80862fb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032671, "uuid": "90e77133-1e0c-47b7-94dc-fe9d59c36a4e", "value": "T13594C030AB801EF9C6884923D0BE5A1E53F75317E412F0CCE6A3751726BFE496627E16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032671, "uuid": "224163af-55b0-41fe-92d5-8de88d2046b9", "value": "6144:Fp/dQMZ9PwNRCu2zK8qnHbpuxecBInFr0yD6k4p9U2xEIqXNInxOZJrzv43ujYcX:++eHluxeuEFrV6d9GIvnoPvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032671, "uuid": "fc8f2670-dda6-47f6-9e94-1d0571049718", "value": 425564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032671, "uuid": "f30ca856-3d80-4935-a8b2-ae16da68b265", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032671, "uuid": "7cdb414b-b139-4dec-b024-64e634067eb3", "value": "PAYMENT_PO78892.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81202ce3-58f0-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639055052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055052, "uuid": "01ac931d-fa54-4f35-9c5e-62f79d5c80fa", "comment": "Malware payload (AgentTesla)", "value": "27c48efcef63e069fe9c37cd5a2c4c07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055052, "uuid": "86d083b3-89e3-48a6-8cc3-91e47aae6c11", "comment": "Malware payload (AgentTesla)", "value": "9d11da2a0336d5e8a9791e0b87f98635fd8cb7c98db1749241df64386d02ea86", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055052, "uuid": "e575fba5-61c3-4d0c-ba2f-bb7e19548176", "comment": "Malware payload (AgentTesla)", "value": "8f63f8e73fa8e4c3f95d032e263f324a92864409", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055052, "uuid": "7508d974-cae3-4685-b06b-ee4c50df2c3e", "comment": "Malware payload (AgentTesla)", "value": "6ae7749b744fa51f183054f404552f9a067f241e97e85ee34653f2abe619348e0f8adbf6646f3e2fd2ace8d5332cc093", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055052, "uuid": "268dadca-5800-4700-8694-256ff260f9ff", "value": "T15A84EB51912E3C6FF62FE81C1593E1C8386EA57AA4F0056C939EF014DE259EAED8C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055052, "uuid": "723c2ca0-7377-4bfe-a057-dd1b711e406e", "value": "1536:i+zr5DDDDDDDpi6IWEkTMWo/XuJ5M+Ec/oY7hKfedzFz76mAg5eeVhMDw5wfLj:iwDDDDDDDIYJdzFtr5RDAw5wff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639055052, "uuid": "dae632e6-28f7-4dc7-9e52-6cbaf299a6cc", "value": 392611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639055052, "uuid": "4997bdb3-f5b8-4c73-8832-c555f6fe8007", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055052, "uuid": "0bf11130-9b4a-4c94-a6ac-336dd33ab3e2", "value": "PURCHASE ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d777e563-58a6-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639023414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639023414, "uuid": "1886a581-b3f4-48eb-a6fe-cdf700ed8d50", "comment": "Malware payload (AgentTesla)", "value": "c8f6451645f97a2b6badadcf8f3e6b05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639023414, "uuid": "c1e7cb6f-74a0-46a8-910e-e899d3756f9e", "comment": "Malware payload (AgentTesla)", "value": "9d7de8fefe46c6dc2681a5e5fdd36b47af6c9e8fce6bc8952574d611ff83819f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639023414, "uuid": "6b5b9643-461f-4745-a21c-442ac58e2cf1", "comment": "Malware payload (AgentTesla)", "value": "8c8e417e8c466e2c23291921f2f27dd7e31dadf2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639023414, "uuid": "d998b042-12eb-4689-98e1-cc06833e4812", "comment": "Malware payload (AgentTesla)", "value": "881fd99f3dfaff9c9403c2c17964559b18d88314b5c46a2b2d12c1b8d590a326f9e3df6fd67996a038b9d947bb4833b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639023414, "uuid": "9fa3374e-6017-416f-b6bc-2dcc21783ca0", "value": "T15ED4D03222569F89EE3B0FF8441122801FF57C279B2ED356AEC97DA639F3650CE51891", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639023414, "uuid": "19daa92a-6a4d-4b75-a1b0-add8559aa43d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639023414, "uuid": "38e82fe8-c497-445a-9843-70121e89377b", "value": "12288:KImyoeZ6NqJFTP9SVa+92MbcLC44hs986JubclO9R7JFgf:KImyryqJSyIcLchusbUQJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639023414, "uuid": "5d5a88c3-53ad-416f-8860-7fc0762031aa", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639023414, "uuid": "4ba111ba-3178-422f-bbf6-5b1b889e6c88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639023414, "uuid": "e550e0b9-9153-4f5b-8e59-35a78f5296dd", "value": "remitance advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048d8b74-5898-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639017047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017047, "uuid": "fdad665d-be94-4564-9087-7843d1fc55e1", "comment": "Malware payload (Heodo)", "value": "90f1019d290583454b2e9d9f0d09e82f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017047, "uuid": "ccd5453d-a574-4c0b-89df-a3b9d013028e", "comment": "Malware payload (Heodo)", "value": "9d89a5da24c3453a9f2234ee8c5e7571eff56f6ebb77a7f6f8cd0ae3e906e540", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017047, "uuid": "5b4ba755-3997-4203-8337-79585c80b0d5", "comment": "Malware payload (Heodo)", "value": "95b6d4ea7b5c8ca3ed804488e00bbd3cbaadfc63", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017047, "uuid": "4bdc2940-1093-45f2-90e6-72773a2be264", "comment": "Malware payload (Heodo)", "value": "0ce64e0380b859529b73b7e926e0c641da6bb3f5331a2e4300e7ff59755abb6ac65c84b60b0488fabad0ce0e707d6566", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017047, "uuid": "100a4dd7-ef27-46eb-b731-78de9bfc7d27", "value": "T1CB93F19BD294EE6EE5E7D438D5BBA1E927328027C1685EC1818DCE8C852C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017047, "uuid": "7180f09b-d69e-4c13-b4b0-aac2cd37b6f3", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iyS7:Gp4Z3MYeGt9sLBrGrS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639017047, "uuid": "9aa0162d-c4e4-44b0-8857-e4140e6b2022", "value": 90142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639017047, "uuid": "eb0bbed2-1288-4184-a5b2-09b14830ef23", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017047, "uuid": "54202a22-cdd3-4d7c-afe8-89c9932a4236", "value": "emotet_e4_9d89a5da24c3453a9f2234ee8c5e7571eff56f6ebb77a7f6f8cd0ae3e906e540_2021-12-09__023033914531._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5460002a-58bc-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639032643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032643, "uuid": "71ccc9da-df68-4d01-a736-bba8c7075e3d", "comment": "Malware payload", "value": "400b28bf81973aae1762d355c1d9a810", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032643, "uuid": "aebbca04-4b9f-4460-9136-aa05444c81f3", "comment": "Malware payload", "value": "9e056fa53b977613f76f3cd4af07660ff0286df9dbdb50204bc181b725932be6", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032643, "uuid": "3afaa47c-0886-4724-8f76-4e26dbf066da", "comment": "Malware payload", "value": "82f1b445f43d770ac89f0fafd686c673e131b3bf", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032643, "uuid": "182e9a6a-9e0c-4bf1-bc7a-08d1194f63b6", "comment": "Malware payload", "value": "2d380f60965b675fba508c036dccbfb93414a0b9fe084302a5684fb139f75754db3bc84926b4452ae4180a1dca09b591", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032643, "uuid": "84e35802-3a32-4104-9a4b-0a84ac4557d2", "value": "T13B72CF35E4135848E1EB77762EBD42FCF9919C4498683346E98C2D9C0CA08B7664D6BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032643, "uuid": "a44b6564-73a6-4927-b1c6-aa3548ea344e", "value": "192:ESPPLpluonifwq24Qz3qC479/9Opq4dJeuzG4EECqzm1+ndKZA3cUDWHd6q/MZS:ESPjvTPz3V8/4q2eu5nBzm1WESMUiHdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032643, "uuid": "3ae9b80c-8c75-4f6c-8ad9-9ee9ac74cc23", "value": 16281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032643, "uuid": "4b14475b-021a-49c0-a649-e11c684540b0", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032643, "uuid": "17641801-d84c-4b5c-be74-b6dd25b582b9", "value": "SANTSSWK20100001.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336a9a0a-5929-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639079403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079403, "uuid": "7c424011-5e0d-46a7-b1b0-f28f7b2089a0", "comment": "Malware payload (Mirai)", "value": "b593bf09cdef28aa8a6d57a1e1a539a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079403, "uuid": "f094c1df-2d01-4b2e-b6e2-8a83302ce158", "comment": "Malware payload (Mirai)", "value": "9e78d1612568659b19da48b1d63ac9d54c4ec3bf4f9d596f576c64ce87044e30", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079403, "uuid": "2940ccea-d391-4c0c-ae1d-1b82d1146a1b", "comment": "Malware payload (Mirai)", "value": "6a7c99f5c5a7e07b97e18b9988c91f322a201786", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079403, "uuid": "fb184c87-9620-496d-a8e8-65ffe0bf167a", "comment": "Malware payload (Mirai)", "value": "59ffffad425450a3eac9c5bc60a742119d61cd27e42235a269c00b37811b4419fab3095ad7bb5f555423ccebfbeeba6d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079403, "uuid": "ab01dd60-00b4-4ddc-856a-c4258988e431", "value": "T178D2E036D965ABD0CAA9C23219BF779BD500C7899A4422C9BFA5F06FCD00F24335D2E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079403, "uuid": "107311ad-6b74-4eff-a58f-784e427cbe4a", "value": "768:eJ55ogT+lbYM3q7140igxVBRZQTMELmag24Ez+nbcuyD7UHQRjM:K5oDlYM3mG2BRW5Lmagj0+nouy8Hyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639079403, "uuid": "816e28bc-9890-42c7-930a-198cc57c2b6d", "value": 29700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639079403, "uuid": "b93069ec-558e-42e4-9afe-a663fab78e06", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079403, "uuid": "f117d770-6c6a-4174-b6f6-6a5c5250b91d", "value": "trynagetmybinsufucker98575.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a19f2e-5907-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639064718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064718, "uuid": "14454057-be4f-45b7-b564-ba05587c690f", "comment": "Malware payload", "value": "dca23345d9000f53728d49df7dd0da8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064718, "uuid": "9c276fe4-ec41-41da-aa10-b2f0901b9e3d", "comment": "Malware payload", "value": "9e8312fc1d62f3f759a5731c8d0a9a6e459bc694e11443a60a376f8be257318a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064718, "uuid": "f562922c-821d-4c80-9232-4922b6d3fdb4", "comment": "Malware payload", "value": "c6499d9b8767b91501e7ad44037d40496c13cc11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064718, "uuid": "9eea8be2-6de7-479d-a33e-dda6e70a98bb", "comment": "Malware payload", "value": "3d36fb809aefd0e0336502b36500a7edb16eecb2a399f8ddb59896fd824e9dca2a234a8623c6f26a47c831dfb470e394", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064718, "uuid": "353b5e6f-e5c7-48f4-a23a-6a4db4ef6343", "value": "T1CDA4E11135C0C073D1A634B28229CAB54EBAB83611365BCF9FD95DB52F347A2EB1931E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064718, "uuid": "57f20701-7024-4720-92f2-1761edc5908b", "value": "12288:2vOiWhzWms0/3QK9nVUCzqZq2xNd3aug3YlvKpSJ:6shq0/19nVUCz6zVau4YEMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639064718, "uuid": "32bbd32a-5a5d-4d77-a4e7-3ecce1a26865", "value": 483445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639064718, "uuid": "9ab1ee45-7147-410e-aa8a-0d5c378fc762", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064718, "uuid": "02a1f9c1-f59b-4ab5-8f85-2f5b11b27b9f", "value": "dca23345d9000f53728d49df7dd0da8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a042358e-591c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639074002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074002, "uuid": "9b7f8432-6b6a-4c42-a9f9-8165c1cf6e58", "comment": "Malware payload (Quakbot)", "value": "f986fd7eb0bc92d8d18ba5d92dde6ea5", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074002, "uuid": "3f197f9c-bfd4-485e-b9eb-7093a3250fa0", "comment": "Malware payload (Quakbot)", "value": "9f525d99d27a8f4f8590d248a0cc4a899dd7b8f70a196289c958631fdb24fdc8", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074002, "uuid": "329c518c-edbe-4119-a3d3-9c9fb9d11385", "comment": "Malware payload (Quakbot)", "value": "2e41db1bcec6e4347a1e47f8aeb4a3c549518aca", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074002, "uuid": "7cc2126e-d62a-4f11-944f-4df78746c5f6", "comment": "Malware payload (Quakbot)", "value": "e51d63ba988ab4660f7909f6b52655b7e5c66cf7aa697018c99f8ccd22f1c17bad46bce07f03ab3e2f49107d0cc5bd8a", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074002, "uuid": "b0e919f6-3088-48bd-8fdb-464ffa9f27ba", "value": "T10953D05C1119A84EC325583DE60C2EE2D90A2193B412B51E29D9BA542BF72C77FCF1BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074002, "uuid": "4a705dd2-4c23-48e0-a5a1-de8d9991b515", "value": "1536:kvwsjZ91vqVmxJGME2Ghdf52lZP3u1AOgeM:M71yVmut2Ght5I+m/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639074002, "uuid": "d5bba948-b293-4577-b5bf-b853cee36adb", "value": 62326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639074002, "uuid": "8d04ab1b-b0ef-43d6-a7ce-f47ad6916722", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074002, "uuid": "eefc5e1f-5a9d-486f-b096-64bbddb5e164", "value": "er-1303209212.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d17fec-58ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639052645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052645, "uuid": "0270124d-41a3-413c-ac2c-875ae8598ef5", "comment": "Malware payload (Heodo)", "value": "6082040c2bff7cbcdb13dafa85b4398b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052645, "uuid": "b54d14f5-3dc4-4c4b-bc7a-dc53214f4244", "comment": "Malware payload (Heodo)", "value": "9f92097443d9cd7f68f87a9a210d085c1b83fa00b34c4fe6a1ccd07c15ad76ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052645, "uuid": "c91639e1-fa8c-489e-ac0f-68af43ef789b", "comment": "Malware payload (Heodo)", "value": "5464fd46689d2323cf1f13187eed0273ceba8961", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052645, "uuid": "36684ba3-0af0-4fb1-8348-2f0338365466", "comment": "Malware payload (Heodo)", "value": "29cea84b1980e3dc7eac40a5ae7e0c0a76fdf2e8bf6f1d2729ede0a462fd38afb7f2545efc8b215bb5880944064dbf8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052645, "uuid": "e2f67d93-dd43-4a47-9c24-c3e62b118aad", "value": "T1D244BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052645, "uuid": "cdeec424-bcd5-41c5-a6df-be85b6fcf292", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052645, "uuid": "48d38907-5423-49e5-9aae-18b5d38ce729", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBv2ypv:6jIG/pjjuLbJLmGshoCUnWTdpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052645, "uuid": "e6b061d6-1342-40ea-b05a-edfde4a3048f", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052645, "uuid": "d7773f0b-5e2a-4a5e-8b5e-b612f7892dea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052645, "uuid": "943df42c-49a3-4447-b78d-89d1eebb5aae", "value": "6082040c2bff7cbcdb13dafa85b4398b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad1681a-58b3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639029003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029003, "uuid": "79f4077f-e876-4ce9-9931-945d340d6b46", "comment": "Malware payload (Heodo)", "value": "ec58c143ca20a76e9f14a0d23f2f52ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029003, "uuid": "d9b551a8-6be0-432a-b0b0-3486d93e0d79", "comment": "Malware payload (Heodo)", "value": "a03cc882101c7afcc12f3898cd9b83768b43103cf780d2e250577c44b908ad1b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029003, "uuid": "2ac5c75a-6d55-44f9-bc33-9771d9fd0b58", "comment": "Malware payload (Heodo)", "value": "f5710d2689ed0ad5415458a2f9121bb2b59a8519", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029003, "uuid": "a21ee2a3-99bc-436c-9653-bf9e1067a98c", "comment": "Malware payload (Heodo)", "value": "1f490ee616edcc07c77603cd0cb40341adcc87ba6c81c399ad16d7828db213f243337d6daeec3699e82bfb014ec4696a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639029003, "uuid": "b6b7d8ab-c183-4448-8037-e7dd40ae45c9", "value": "T1E2358D00F781E032E4FB10B685F79A6A5A7C777017604ACF16C81AF9AB256D07D32B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639029003, "uuid": "cb368f0a-9084-40db-9219-60fbfd22726e", "value": "27ebd87b4c34eaeffb0e90fca4f81b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639029003, "uuid": "9011b06c-23c6-451a-8fd3-0b9d80614d06", "value": "24576:2pF2jdx8J654GbOXqfPBmN4TNih/+cNeTpO:s48JSf0N4TNSmcNeTpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639029003, "uuid": "d4b1e1b9-4333-4d3f-9dcd-8a5d9b9a38a8", "value": 1135104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639029003, "uuid": "1b3891d9-dae5-4744-a705-65d676533bec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639029003, "uuid": "0b87ce9d-8876-4f2f-b379-bb87d72fa203", "value": "emotet_exe_e4_cba3e57f98003ec98249c858aa44a137726a5ff5a2f8ffdce01c7988ba2d48ff_2021-12-09__054958.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff2c0d1-5925-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639077706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077706, "uuid": "8f1882ae-6a62-4161-9ce2-66dad2c45652", "comment": "Malware payload (RaccoonStealer)", "value": "0b51a56e6b3393ff04e6cc6fced4e068", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077706, "uuid": "caa2b1e2-02ea-4a08-a2b2-5bf1fb4fd5e7", "comment": "Malware payload (RaccoonStealer)", "value": "a048547702aaf89637813c4cdc925cf25ab7a3710bfc95f21046be931c1cae63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077706, "uuid": "11112b5c-fb68-44de-b1d3-24c340fcce24", "comment": "Malware payload (RaccoonStealer)", "value": "7e828cc8ef5d5bc0ec14b40850c999d92b730995", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077706, "uuid": "671bb9cf-3285-496a-9a9b-e81b07a1d695", "comment": "Malware payload (RaccoonStealer)", "value": "b39a2184423997df4f5aee05247ee0ab9d947fe65d12d3b5c98b48d63b7a193a11233408ca95abbbb50c336d3af0d7b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077706, "uuid": "9baa2e8a-02dd-4fee-a4c0-820265ae8e5e", "value": "T1C0073366BE94C0BFDE45993AB2D8F7C2417BA2890D13DCE34704A3EC967D141F12DAA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077706, "uuid": "9f30d6ef-ff1a-48e9-b555-e9e265399856", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077706, "uuid": "276fce3f-69de-458d-b092-54e921b93db4", "value": "393216:xqdgEs7bbKSU4k92BaH34ucNtOh2xDMOHdGHguuyaU/RMYWTFNt3C9:wdgEeiSUp920c/OaxruuXUaTFLC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639077706, "uuid": "9c503a72-9284-4d86-99b5-c22670782fdd", "value": 17120948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639077706, "uuid": "ee54f6a4-d752-42a9-9f0b-c14b527ec289", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077706, "uuid": "99e2289a-b9f0-4e64-9061-9c74a1fc431e", "value": "0b51a56e6b3393ff04e6cc6fced4e068.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1efd30fa-5907-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639064766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064766, "uuid": "aba1f053-9713-4fca-9ad3-b9dcd12a8249", "comment": "Malware payload (Mirai)", "value": "bdc02fe5c4e820cc750d4b5b7280f2cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064766, "uuid": "458e8b71-f7db-48ed-8a3b-23d38d7d35c1", "comment": "Malware payload (Mirai)", "value": "a06645dcacd00b2ffa5db96729241c355e012fa87a2ef16d595a4bac7a7dcd10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064766, "uuid": "75709957-fa2b-4762-b50f-afc62e5fc268", "comment": "Malware payload (Mirai)", "value": "d49ff96bbfbd990ffdb4727a809b97eb05bf1c2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064766, "uuid": "2da7f58b-3619-4227-949c-92cb9f0a8568", "comment": "Malware payload (Mirai)", "value": "d06444aae4daeb5e9e3717623225c1f290719388543f86f74eed8c9e5c9f13f200014d427510d8276bf9090d86549dc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064766, "uuid": "4cfbaf1b-d846-428f-ae53-74aeaa52f70a", "value": "T1D1E2E16FA5E42DF6DF8C483E138C1939BED6685613259F89272140C4EB6E8A8F4DC03D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064766, "uuid": "61010423-e0d5-411e-b050-6e06f2f0153d", "value": "384:X3fpCLrsjHIX69URc+hmnulY1qHprFKt6zhS45vDajssVwfyhBTla39RWGVCz0Ng:nfpWcehzJFYKgULAssKfyhB5a3LWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639064766, "uuid": "1c9c8558-315d-449e-ac49-fe4ac02ee0a6", "value": 31960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639064766, "uuid": "23d56d31-54ea-4ff7-aba1-56a75947849c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064766, "uuid": "c0092b75-0b02-4e20-b15a-8dd26219d5b5", "value": "bdc02fe5c4e820cc750d4b5b7280f2cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb93baa-58f8-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639058507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058507, "uuid": "2b48a520-6757-4b71-b58b-245a6fedcdd3", "comment": "Malware payload (AgentTesla)", "value": "912d28ea3707e9bead5b4f407dc7f32d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058507, "uuid": "b7fa34f6-0196-47e9-9c77-b8557d0313d8", "comment": "Malware payload (AgentTesla)", "value": "a09c6af12b3f55605f7673e4fce99891d181a4a6616b5502f17eb300238e2186", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058507, "uuid": "abb3f3fb-b998-4d8d-9333-65504508c97c", "comment": "Malware payload (AgentTesla)", "value": "4dc4fac3c290a907652a90e5d89ac81f0b702b4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058507, "uuid": "258a9faf-8c47-479b-a917-bf4c4422365b", "comment": "Malware payload (AgentTesla)", "value": "0d9d6ae2e929da66a1f3a5fb95af7c34c614248552ce4384a78eee2956a36fcfb18dcb29842ddfa38302d69fa0d35431", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058507, "uuid": "f9684c77-d00a-45c6-9a1a-4cf3d211fb3d", "value": "T1593523367A99CC11E7BB6636CCCE613047BCFD076403D719387CB2BE299276819B2265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058507, "uuid": "b2bb0fac-36c7-4e05-b27c-1dfa2ca61832", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058507, "uuid": "a8c984f3-1e93-48de-9caf-29d44f29fa94", "value": "24576:t+0rY6amiDu22IiqMGmlxVScyZ+HO9YyuhUIWyPry:XRXiy2LisgxVByZ+HO9YyuSIWyTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058507, "uuid": "112d26e1-ecfd-4bb2-a3a1-8b9a5917a296", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058507, "uuid": "82a71dbc-6c81-481a-aa13-386097b62bfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058507, "uuid": "05188738-4435-4117-9b9a-095418603b8b", "value": "912d28ea3707e9bead5b4f407dc7f32d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d52fa5-5925-11ec-96a4-42010a9c0029", "comment": "Malware payload (Guildma)", "timestamp": 1639077776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077776, "uuid": "90fc1eb2-bcf9-47ed-a9c1-910c98849214", "comment": "Malware payload (Guildma)", "value": "2ec489de46ffeb943326e1652fc2d142", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077776, "uuid": "1edee580-6260-4957-8d9d-33986bab2da0", "comment": "Malware payload (Guildma)", "value": "a0bbadd2420df57fa9225f44eab07c54c98cc3c2cc5cb6700d70cd25a5196fe2", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077776, "uuid": "9e6de082-f245-4b32-94a3-11ff9c7cc9e0", "comment": "Malware payload (Guildma)", "value": "8845b6f23d6a891a38ddc0a0ca47aeaec0bb0b3a", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077776, "uuid": "622f5fe4-ecfd-4bf9-a735-cd9a2d1f95bd", "comment": "Malware payload (Guildma)", "value": "c72aed33cdba411451bf40a12236a96716dce7dbfa061abc9ed2e463cfea9477d08c339a21fb8f2490ffca31dae2b002", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077776, "uuid": "5c42928e-3a7e-4537-8ffb-950f2aea541f", "value": "T1D5F0DC981B74F751D4501A32D4A28E18D4386849FF44AE28B1E03A42A6184806F9ECAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077776, "uuid": "398a4f9d-05e2-42de-a45b-2b9ca624b648", "value": "12:8DpOB+PlyWfFHEV75FVQuHF90+zdNLgEGrgS3dYOn9W:8HPlDlELl90+7LgjJCO9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639077776, "uuid": "26cc9d2c-14ed-46b0-9740-4e9a8b98f3ba", "value": 544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639077776, "uuid": "ecd86a33-d934-4e9a-8010-faca94b65e71", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077776, "uuid": "dc47a8ec-c9a2-4206-b577-fdff01e946c1", "value": "2ec489de46ffeb943326e1652fc2d142.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728d38e5-5905-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639064047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064047, "uuid": "242347f7-d467-44e4-9053-74f24b8c95fb", "comment": "Malware payload (Heodo)", "value": "042b8d5249c84dff142cbc8350beb25d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064047, "uuid": "fb1f0aa0-3c51-4a9c-a5ed-5852ee2922c0", "comment": "Malware payload (Heodo)", "value": "a0f65abd423b55e132e54f55834ea8411988acceb71234c6c6b16756477a661c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064047, "uuid": "fc387b8e-65a6-492a-85f4-267b5b28a6cd", "comment": "Malware payload (Heodo)", "value": "0cb62bce74b70eb68f769235be55dd4d3ff2eea3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064047, "uuid": "87aebd3a-2cde-4d77-a8f3-a5989f888b73", "comment": "Malware payload (Heodo)", "value": "0ce9769a443da1e27c7974741dd889b2fe6ca36c1f2ef62df59bb26afb6f2ac792db6cb1863acfb6e3ff6c0cb6519361", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064047, "uuid": "26853a27-40f4-416f-9bed-433049d01194", "value": "T11844BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064047, "uuid": "d23731a5-bd55-48a9-9a62-95a95e79ebbd", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064047, "uuid": "882f96b5-ac42-4c6b-bebe-88d7ff2efecd", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBb2ypv:6jIG/pjjuLbJLmGshoCUnWT9pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639064047, "uuid": "cdfd06ff-51e3-4f10-9aa3-57f1251f8b84", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639064047, "uuid": "519105ce-45dd-44c5-8083-49f47944dd1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064047, "uuid": "cffc3e50-bd87-4be0-b989-53dcb57894f1", "value": "SKYI.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bc028c-5918-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639072260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072260, "uuid": "648902d7-222a-4c23-8c81-e2d34778d70e", "comment": "Malware payload (Heodo)", "value": "eb86b85a7fec7fe6aade1d4f1cfc9fde", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072260, "uuid": "45078661-17a4-44de-a9ce-9dd6fc17372c", "comment": "Malware payload (Heodo)", "value": "a13717ac7014e0eb85a5d0a2d3968eb63ba14c7a18245e50d0f7e2eecc9f57dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072260, "uuid": "15a753b3-06c0-4060-a780-73637b1e4aec", "comment": "Malware payload (Heodo)", "value": "5755575afa086a7d19e4f5042cb6e54cd2e9bd53", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072260, "uuid": "d6784c6e-2215-4874-8847-c833d89bd275", "comment": "Malware payload (Heodo)", "value": "089f2a907567d9bf3b0806f99b7134790096daa077f11cad3facecc58053741214e5bc5d765a9b65ceabb0c52f8483a6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072260, "uuid": "b927deac-543c-4349-aff0-7cfcc9cf167f", "value": "T12044BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072260, "uuid": "495888d0-bd5b-4d12-b5e3-fdff732f7fe8", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072260, "uuid": "706ade91-06de-4343-9660-d758e06e8218", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBm2ypv:6jIG/pjjuLbJLmGshoCUnWTepv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639072260, "uuid": "f17cf43c-a055-4a98-939f-f9c314d82702", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639072260, "uuid": "bd143256-7d6a-4c90-a6c1-969f0be59bef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072260, "uuid": "edee8372-7dc6-4a1d-b139-5a5761c12512", "value": "xihllT5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7c5df8-58dc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639046350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046350, "uuid": "8211147f-2a2e-4731-b6d5-50764e18c713", "comment": "Malware payload (Heodo)", "value": "1d1805592bdb4069079b6d76022e4d10", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046350, "uuid": "821b44ce-2fb4-49e8-bdcf-9805cb47894b", "comment": "Malware payload (Heodo)", "value": "a14718e3ed60e6b33e58efcea76124466bd939d818f621f10c5cb248e76eaa19", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046350, "uuid": "4c2f6595-e1c2-4322-94d7-5043001ab222", "comment": "Malware payload (Heodo)", "value": "945f361aca5fbe527a71dbd22685ed1fd5f6d494", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046350, "uuid": "3a3ca4f4-4f2c-421c-8396-f74bd54896e9", "comment": "Malware payload (Heodo)", "value": "d2deae43c9da25b0272033ee18b5ce5baf922e41de3f2c3833d2ed50992446162cfacf1729a0507e036fc407b0b42e2b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046350, "uuid": "fb55708e-3d4a-4df9-a6d6-ab7567ed8543", "value": "T19D44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046350, "uuid": "8fa134c3-4a9d-45d2-8e0a-4fa63f9d2ed0", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046350, "uuid": "9776f597-ba9f-4f04-9aeb-13ffa8a77fb3", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBf2ypv:6jIG/pjjuLbJLmGshoCUnWTVpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639046350, "uuid": "2a5683b4-53e8-4476-a566-c2dceedceb4c", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639046350, "uuid": "14afc6df-de93-4b3d-b96a-fd9bb59bf8fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046350, "uuid": "ef4cd13a-c3f4-4109-be8b-c4833cf57f07", "value": "EnkIIvHAXz.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7195f131-58ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639052449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052449, "uuid": "8e7bbdd0-f9aa-4f35-bb30-9fc2afc7ff03", "comment": "Malware payload (AgentTesla)", "value": "14237d9d4db450615171f6a4fa5e19bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052449, "uuid": "e9b0ad2a-88c6-4303-93cf-ae0b550ea695", "comment": "Malware payload (AgentTesla)", "value": "a2f66541a352e0d92e2d7fd19874ba68be1335e8876c1adea7d0989537659708", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052449, "uuid": "f516ee80-f816-45b4-80f6-7befa0200f3b", "comment": "Malware payload (AgentTesla)", "value": "e4d2eb114cfce492bbb1281c87f8a2cb605ea7c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052449, "uuid": "5680ac91-4c8b-4325-bc62-73280c49af83", "comment": "Malware payload (AgentTesla)", "value": "ecc1c3cb4b53908521d542b3baa32fb7c5e74d1a410d6c08de4e4337dc0c6f35949e2fe3469daa6b4c417ced9a97c6b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052449, "uuid": "0ddf8ddc-e040-45d7-8a66-850471954eb4", "value": "T1AF4523592AE4B06BD16996F183A780A08A3DF0033DB3F7F65C8245FDB634EC99543B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052449, "uuid": "a58e970c-2125-4f66-a7fe-19fcf1026c28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052449, "uuid": "4a869875-944d-401b-ba87-d881ad5fe97e", "value": "24576:OIKjy/SYCpUuHMpfMYjfcV3pN86c3RtSHSD+aCq11O1w52BA3TQv3:8jAS8uHM6Yjf43pafSH/Pq+1gcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052449, "uuid": "bb49aaa9-1662-4d67-b3b0-f9828584f5aa", "value": 1277952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052449, "uuid": "8e65fd1b-9b60-48e4-a7fc-cee2a1b89b50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052449, "uuid": "2361482e-b856-4178-ba3b-6657a387fac2", "value": "Curriculum Vitae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fcf8ac-5925-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639077911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077911, "uuid": "4be2ef91-b80c-4add-b3be-9a1696c40247", "comment": "Malware payload", "value": "1cb787ca4f6a72f7eaf22578ff50dd85", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077911, "uuid": "8ef140f9-fca7-4cf8-9585-1c89baddc0da", "comment": "Malware payload", "value": "a35096dbb8b3f3bb0665ee03a2abf81eea7758872e0448b26d03fd42ac567be6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077911, "uuid": "00c614f7-9ad6-4931-a69c-382e06363801", "comment": "Malware payload", "value": "4fc8a8c0370dabffdf017ca315421b42379da01a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639077911, "uuid": "b89ee71a-f7f1-4b1a-95ab-23ef5d10b8f7", "comment": "Malware payload", "value": "14966acdc1b84380dcbc76d2f19d659297b192152353c2b39d5af50b77147e6140c718e12c51954f5158348b29bd7560", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077911, "uuid": "ac75d363-25e0-454f-b91a-e7186a7afda3", "value": "T190A56CCCB79B3AC311719CB74AB125A265061D32D993D8F3A759334B01391BD6FC2E8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077911, "uuid": "f049f857-8dc8-45d4-b961-3bf719521262", "value": "a199290dcbe202d1f0bd9360a8611fc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077911, "uuid": "82f33cd3-d364-4b8b-ac19-17cbd67db403", "value": "6144:58bCo3UdtKeqfyytqcAO9bIhwG8H+ktjjrn0oP:kNUdtuGS+Ejr0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639077911, "uuid": "0375610c-2c39-49ac-9cdb-526e53095f15", "value": 2215936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639077911, "uuid": "6572595e-9ff0-421a-8de7-f6bbeed14ace", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639077911, "uuid": "f07f328d-92d2-41f7-9a1e-0b5122c491d2", "value": "yellowtank.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c889998-58d8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639044709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044709, "uuid": "f8f6499c-c382-4c1c-b4b6-a7cdda705561", "comment": "Malware payload (Mirai)", "value": "747735711f7751726d355405aa38af30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044709, "uuid": "94586578-d973-44e2-8ab8-a28f060c43bd", "comment": "Malware payload (Mirai)", "value": "a37899f8626782ba3f453478b2ebd67122dc39cb77816fbf3c8397ff7642b69f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044709, "uuid": "ab97fd7a-e108-4937-a460-e1a661e29e9b", "comment": "Malware payload (Mirai)", "value": "7f1e841010c4a81c7eeaf8d54658cc97b0709d62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044709, "uuid": "98dcf87f-dc49-4853-9cea-22bcdc8cc6da", "comment": "Malware payload (Mirai)", "value": "ce3bcad9f0f8d57020f1bbe69c6085ea13efbc32c069f126086f3ef0e6e7fc92227699af41efabeb28b10bdb015f386b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639044709, "uuid": "1f681d66-cbee-4fd8-8015-399f9ae61e98", "value": "T1E8432925AD792E26C0D8B57E11F78724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639044709, "uuid": "26a9520c-34b8-48f7-a7bd-70e7d9f86b4b", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDV:eL0AxvSHfymp0xgunvCkV6vTMDau+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639044709, "uuid": "a4997547-5b63-4c87-80d9-10c572782443", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639044709, "uuid": "8bb380fc-90a9-446f-afb7-3df2a369969c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639044709, "uuid": "816111e4-828a-4c20-8759-f9714303cbf7", "value": "747735711f7751726d355405aa38af30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b6b3b1-5909-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639065607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065607, "uuid": "6f28cf91-3b19-4a30-99e7-fa83241ec4c8", "comment": "Malware payload", "value": "f15b9bf1757eb84f300441d2be57a81d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065607, "uuid": "1e44e31b-fb66-4f46-b5f7-7023dde5d092", "comment": "Malware payload", "value": "a39f54f6b883c83a5811d61e3080ae3a82c946bc5cf1aadde402acb1090601dd", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065607, "uuid": "f0102199-4aac-47ea-b824-1e2cf9df8ca8", "comment": "Malware payload", "value": "4562f6ada10825302ff5c948cccda61ee2febef4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065607, "uuid": "76070de5-3944-400c-b2dd-94fb6f22ca81", "comment": "Malware payload", "value": "907a7334772cb0f71ef79a0a107fcb69b997999e5664083a0a796bb46b055c06a453a63c95480ca666db1b2974fd4cd0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065607, "uuid": "1633c1d1-62bb-4122-9fa9-0ed336dcb744", "value": "T1A7B56D22B1D1C577D0776A7CDD5BA3999825BD201E28880F7BD43E4C9F39B803A292D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065607, "uuid": "f465dddf-39b0-4185-8843-4cdac237c4f1", "value": "24576:MiREp4F7PxW5Adm3o285/ykWlooVAy1Q4DZ+coqssPpgB39kUhFfD0/kDLWTU+8U:MiywaY2EyjONsR6+TP8FYjZ/OYS3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639065607, "uuid": "91a725ab-83ac-482e-8955-ccc3545c58b3", "value": 2393088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639065607, "uuid": "4ef111f2-a18a-4800-b656-61c7f0c70ac7", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065607, "uuid": "88562e0c-cdf4-4c54-95e8-c40816aa3d03", "value": "Archivo.EndesaFacturAdj.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1afc9e2c-58d4-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639042855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042855, "uuid": "12c9ed31-5c79-47f2-a7cd-5ccd8ef60e0b", "comment": "Malware payload (RemcosRAT)", "value": "9692e71cf8e76671e8e898f6d1e06a84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042855, "uuid": "5f29d603-9603-4055-a9a4-b887fd69c6a5", "comment": "Malware payload (RemcosRAT)", "value": "a47a1092487d103f94b468b56a20f7861c92f7385bc2de537f21b4c01c221a74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042855, "uuid": "473d95b4-5c6e-4a8c-85a8-6734df1cce9b", "comment": "Malware payload (RemcosRAT)", "value": "f2654b62e325131d1780a473739100d3705163f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042855, "uuid": "3953f958-abfe-4cd3-9442-27d54a4de598", "comment": "Malware payload (RemcosRAT)", "value": "d666a4ca296c450a698436e308b7405459007c983281d4010033c0335a16b667c542c5f166532f92ff0cefb6b5aae143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042855, "uuid": "f4cd715c-918c-4e65-9cfc-dc80dd114d7b", "value": "T1223502833A888B55D75914B1D1EF593407E2EEC3AA32F3443F4C26991C82772ED95BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042855, "uuid": "fa1921aa-b31d-4299-8e39-1923e5db998a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042855, "uuid": "f2004a82-47d2-4dd0-99f9-2326ab2224b1", "value": "24576:PEQkh3fKsTdtQnL+x1aHFaE88gQ91C3eavQ1fiE8zHI2dPaJ:PdkhenL7HFaE/D91C3ehfCVPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639042855, "uuid": "6f2819c3-a9cf-4e41-8566-7723814d086d", "value": 1083392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639042855, "uuid": "596d9845-14da-44ac-980f-cb62cea85b93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042855, "uuid": "e6b897cf-98ef-4c2b-9f12-c2378d57b337", "value": "DETALLES DEL CONTRATO pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f382683d-5902-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639062975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062975, "uuid": "1855cdd0-b42a-4805-8ac6-7dce9cae2359", "comment": "Malware payload", "value": "025053a968d4e04c2cecf817cbdad426", "object_relation": "md5", "Tag": [ { "name": "obama142", "colour": "#C90C91", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062975, "uuid": "d11d0bfe-612b-47a1-9e70-a05d142616b1", "comment": "Malware payload", "value": "a4b62877a84b5186694706d329d3bf12e1e4f175a2b7830c8a851e2cb74da6a5", "object_relation": "sha256", "Tag": [ { "name": "obama142", "colour": "#C90C91", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062975, "uuid": "a6e54ec1-7b2a-4abd-bc3a-6d75834cfec4", "comment": "Malware payload", "value": "88ec3e2598f00b706739eb5bf5875d1b15be09da", "object_relation": "sha1", "Tag": [ { "name": "obama142", "colour": "#C90C91", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062975, "uuid": "997b68e2-23c7-446e-aae7-d07c8fd131ef", "comment": "Malware payload", "value": "89b2059c8145e2edef13580db817bcf161810001bb6c9523a204522ddb1b98ebb060acbc950d44d215a3a60b8d4c07ed", "object_relation": "sha3-384", "Tag": [ { "name": "obama142", "colour": "#C90C91", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062975, "uuid": "527f5273-fe32-4eed-8974-fcf7d428c3a3", "value": "T1C1A423107286BD9327EC563D3B0EA8769E1397FD788074B041E7587E182F098A392DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062975, "uuid": "26695e5c-a12a-4435-ba83-c1642ec8f6a1", "value": "12288:XOZcW+zcmcnvLxj60Q4/vONL975m3MmV9+DpyEeQemCKti:XInvLxjE4/veL9Fm3Mc9EeQHCKti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639062975, "uuid": "897ebaf6-3d84-4a20-a8b9-97fc66b587ab", "value": 479459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639062975, "uuid": "d01a05e9-a82a-40db-bc8d-ff660e86dd25", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062975, "uuid": "00b1865e-365c-4800-b5c6-c416203e05eb", "value": "laAGWcpTo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ff4e25-5912-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639069527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069527, "uuid": "3bbb45ed-f47d-4d58-8302-da0837c9c1e5", "comment": "Malware payload (Heodo)", "value": "ae7606f8b84331654553e6a38be8e75b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069527, "uuid": "0d1e2ae9-9c04-49a2-9e88-8cd2bb65aa95", "comment": "Malware payload (Heodo)", "value": "a511af1786b5bb6d9b68fb1d7e717c72592f29bc68fb1280998b39ddfdf35402", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069527, "uuid": "cb8d13e7-7e7b-4180-8224-c5803eb7bd19", "comment": "Malware payload (Heodo)", "value": "3ada069d6264d0c3fc6327389b7b9fd4baf17681", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069527, "uuid": "fa731a5b-47d7-47b1-bd95-f10a04a7f9ec", "comment": "Malware payload (Heodo)", "value": "bba9e6d2f2af01021c209c74e1fb17a31acfeaf97b6bbb6bdc4aafda26b9fb3ec3949b1382f29db71c62657d29f20bfc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069527, "uuid": "39073cde-a764-4f6c-8430-f329f91516b9", "value": "T1929301DBD295DD7FF8E6C438E4B7A0B923728031C1581E82628DDA4C812D5C797FA2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069527, "uuid": "8f41f1e5-7c3d-4e07-abbe-323baa1f6e14", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbb:yIBQ3MYeGt9sLBrGrBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639069527, "uuid": "ada9e9d2-e699-47f6-bc98-657aaac5cce5", "value": 90157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639069527, "uuid": "d2d1ab3d-69a2-403b-9ffd-aa967020f4bc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069527, "uuid": "62a1afcd-fd35-4334-8778-260d11139ea8", "value": "emotet_e4_a511af1786b5bb6d9b68fb1d7e717c72592f29bc68fb1280998b39ddfdf35402_2021-12-09__170457388044._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5157d81d-58d4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639042946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042946, "uuid": "9725672b-a308-43be-859c-589ffc6cd557", "comment": "Malware payload (AgentTesla)", "value": "06def082d0f6691107f460043e73973e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042946, "uuid": "1007ae86-c2a3-4fb8-8deb-46adbed96afa", "comment": "Malware payload (AgentTesla)", "value": "a512bcf3b0e8c1a2dbc82aac999f0878d90b28ac7ba2fa4ef7f44f1cd3e2d420", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042946, "uuid": "bd4b5b80-a07b-42c0-a96b-80bcc0923b2d", "comment": "Malware payload (AgentTesla)", "value": "15da4004f3ca66820b40a00ea49999d00b8c97e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042946, "uuid": "5c587abb-3aba-49a2-af0e-33ef2e75024c", "comment": "Malware payload (AgentTesla)", "value": "8ab19b07ab46fb29776efecc8152374f43253f4a6b233d15864c950a7a5a230d75289d4e6669bf5c442276f82adc6e05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042946, "uuid": "73588ca4-df34-4e33-b603-126fdcd85fb7", "value": "T14A3512DC712431EFC86BC8329E986CA4EB5074BB832B4547E42709ADDA5C99BCF544F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042946, "uuid": "f2fa59a5-18b0-447d-8503-f43584850bab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042946, "uuid": "e9f8a180-a00c-4ee3-a6db-039b92477763", "value": "24576:iQcFrOaBjDXqoO8oidGm2BBlLxZ6SUBOzs:iQcFiaxD/rVdGzHZhUBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639042946, "uuid": "6a66d49d-7b9c-4641-82b1-c9ed880f9801", "value": 1112576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639042946, "uuid": "8124c9b3-30ad-4b2d-a414-58c9ef8d11b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042946, "uuid": "4729ce84-b763-427a-bb2c-d3823043594d", "value": "TT COPY 8,040.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07508e2-58bf-11ec-96a4-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1639034193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639034193, "uuid": "438ceff8-19f3-4f07-ae2d-9d08617ea4fd", "comment": "Malware payload (AZORult)", "value": "663dcb6b2c3afb1dac027cb944a01eb9", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639034193, "uuid": "fbf14c6b-fad2-49ba-bb1d-f1c0bf6d7a17", "comment": "Malware payload (AZORult)", "value": "a52f51511be77831be36bbb9eda43155c57ea2fb1653dfb25fb31972e2250e44", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639034193, "uuid": "9666e99f-01e7-4615-a95a-a704c923f74c", "comment": "Malware payload (AZORult)", "value": "b37ee8527711858fe3aa0526fb0dfe03fcbf1449", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639034193, "uuid": "42e62136-982d-4847-bb02-107d56727dac", "comment": "Malware payload (AZORult)", "value": "ea47bc5a11727ab4ae08def27b5874e7301f5473e8df41cbfa72a60692e77613736815bd3cd517c9c33fc79698acc5cb", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639034193, "uuid": "1edf4e1e-10c6-4044-838d-e10d4c228d0a", "value": "T122D4AD24687FD02EB061DAAC1ED4B6E5B9D9F372228AB47A53740E735712D41C8F313A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639034193, "uuid": "1d9433d9-70e8-40c8-b654-92e498086363", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639034193, "uuid": "f12829f3-67d1-414b-b161-6c0d707b6252", "value": "3072:qLxNGYugL68cdU4IZbLronedP8ssIbgfOev4iTJ7YZxMXv+7245TB9DD4rj1p5GG:q/GKtZrwHdGi4zwrR1TIQ4PZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639034193, "uuid": "e2912905-6fa5-4361-99fc-e13646635acb", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639034193, "uuid": "eff97d76-93a3-4737-be16-d4522ae266f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639034193, "uuid": "2ea7b125-8222-4d9c-a735-9892d0a9d560", "value": "663dcb6b2c3afb1dac027cb944a01eb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47112c8-5890-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639013906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013906, "uuid": "7f727600-16a2-4272-8d53-10b4d9208f61", "comment": "Malware payload (Heodo)", "value": "66cada2494f24c6cd9af514043256bc6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013906, "uuid": "8af0996a-37a2-48eb-92cc-4dd7a44f2893", "comment": "Malware payload (Heodo)", "value": "a536f12864017a4ef2175f05fe0906b7aa5bc783d947ba1f0fa06044969427f8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013906, "uuid": "820b3419-195d-4ca0-9b2f-6b24fec4a11c", "comment": "Malware payload (Heodo)", "value": "a9421693229c58ed37faddb414d32445e263d0d6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013906, "uuid": "55baae03-7d1d-40b3-b4ae-a363ebbe9630", "comment": "Malware payload (Heodo)", "value": "106f331c710987ed77c79b31739d8adb86ee857f611fdc2f9a8eaca70d14627f37fb0f353ab5af5854e8fb74d889986d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639013906, "uuid": "c795b55e-cc53-480f-9ffe-3d9015ae34da", "value": "T1D993F1DBD394EE6EE5E6D438D5BBA1EA27728027C1685EC181CDCE8C812C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639013906, "uuid": "463dd476-9abb-4942-8597-565566543c89", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySG:Gp4Z3MYeGt9sLBrGrSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639013906, "uuid": "75a8cf03-ab29-4010-8a6a-192db92ecfdf", "value": 90144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639013906, "uuid": "221f51df-f7a3-46df-a466-18a6e602e082", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639013906, "uuid": "7f04076a-a711-4905-a56d-767e35407ed1", "value": "emotet_e4_a536f12864017a4ef2175f05fe0906b7aa5bc783d947ba1f0fa06044969427f8_2021-12-09__013814661099._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0314707-58c9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639038461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038461, "uuid": "ee7e6f3c-09ef-4f6e-8dbe-7e1aa9d4f9bb", "comment": "Malware payload (Formbook)", "value": "722c3b9a1ffba43d83ed8619805ef372", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038461, "uuid": "8339e6ca-d7f3-4068-97c1-27e8feeb2548", "comment": "Malware payload (Formbook)", "value": "a5380d9d2893f57391adb2b022357ed440bb4e9ad93868058b1e8d073d9b66bc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038461, "uuid": "f743db31-0fdd-4f6f-ae60-59ce0008443f", "comment": "Malware payload (Formbook)", "value": "acea3749ac5db31e7d34b074750f048d150c88dc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038461, "uuid": "19297fc2-972f-4c9a-841f-8736e3b97699", "comment": "Malware payload (Formbook)", "value": "9ab6d9b9a5572da2e40140e51d0b90bf22f0cb54e9834b3e707264030d2802b4b1efe2db1643fa6cc85789b937a75b00", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038461, "uuid": "fc6af8da-32b3-4c43-94f7-bac0d52edcf9", "value": "T13D942388C348CE30101556AD642F78CEB27071A6EFEF9B27DA0AF7A618469F15B15DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038461, "uuid": "076064f5-c549-4066-a66f-5f54ab2fce4e", "value": "12288:qmoz56jgn/4qROxav5vbbFZ/zzuE7PLkxr:ql16javRJv5vP/KE/Cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038461, "uuid": "8090a573-8dba-4fe1-af14-12b5ca8acf31", "value": 410900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038461, "uuid": "80f5def7-a841-441d-b0ea-635722185575", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038461, "uuid": "933a9203-0eee-4937-9af9-26c09cba00c4", "value": "Orden adjunta.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e000ff37-58f9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639059076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059076, "uuid": "5c181f1a-bfb5-4533-9475-2604e803f1ac", "comment": "Malware payload (Formbook)", "value": "2f8156ddf1076972c3d3a76c9426ab26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059076, "uuid": "c1909f9e-7fae-4de7-ae9a-54b95081b8e4", "comment": "Malware payload (Formbook)", "value": "a5c14452ee3d997af5f74a53641019faf59b432e61ea27ec2e93869343186ec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059076, "uuid": "df557742-82b6-4d6d-8432-943315119859", "comment": "Malware payload (Formbook)", "value": "fee6da798d84626972faa86f88adb5f7b53c83b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059076, "uuid": "65cc0dd8-79f7-4a3f-944a-922a623b40da", "comment": "Malware payload (Formbook)", "value": "50429d773b069deb41e67f42dc555c8e3cbfb6e806f5aeb1ceb2362e048ebc5f276ae1875b19a5711c5cc742b7b4723f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059076, "uuid": "2c6b7ba6-d223-4af2-b682-aa0f26e0dcdb", "value": "T1AB64231BF1EA6C77E97264711B774B7AE3FBC24502A6390F17240EEA2CB36D100166D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059076, "uuid": "701892d8-109e-4f6d-960b-2a95ce63117d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059076, "uuid": "837e1756-1363-4fcc-b97b-c27c525ca5c7", "value": "6144:rGiXZNZVT5+N5QZMVbHLktFy0g8raeuV7+ms8:TPZV9+N5QZgf5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639059076, "uuid": "a4db792a-3e8e-48cd-9026-80a3fac3d1e2", "value": 311954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639059076, "uuid": "40ab5b17-1ce3-42e1-a179-de88b9cf2f82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059076, "uuid": "322a36df-17d3-4d9e-9852-43fbb4220844", "value": "2f8156ddf1076972c3d3a76c9426ab26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26f9f51-591d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639074516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074516, "uuid": "3f0f6db8-8f53-4564-a6b1-f0a5444ddb35", "comment": "Malware payload (Heodo)", "value": "9ed5941380119913e41a22e3d046a246", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074516, "uuid": "a9b07436-5ba3-4a7d-88b2-2fc68600d93e", "comment": "Malware payload (Heodo)", "value": "a62bd468d4fc575f4d077d167e6ca521d00212144dc333a47fa07089d9dd8388", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074516, "uuid": "9bfb3b0b-65c2-4f45-b0e4-baca25993a18", "comment": "Malware payload (Heodo)", "value": "7eedc8d71f03dc4c7ededd9d6e2fccc52ad1de16", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074516, "uuid": "2831801f-9cd7-4868-9c47-f8b0bd45550e", "comment": "Malware payload (Heodo)", "value": "fa7619efb685282d26c7ba73dbb5941d0cd3b73e0ec34e42941578a95bab3b3fc62bdf0a04ce70da30c719f284eb7933", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074516, "uuid": "9d401589-bd9e-42d9-90ef-e850c239c2e9", "value": "T15344BF10A181D036E5FF087A89FAD9BE466C76600B80DDDFA398187E4F6B6C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074516, "uuid": "4b470ce6-c92c-452e-a5bc-ef019ae2e80b", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074516, "uuid": "8e4aee29-78b3-4f44-991c-af3665f2b379", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBomgL/S:Wvef8+h61mRcHL+rF6l5EAQWT4L/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639074516, "uuid": "1402c3bb-343d-4eaf-9c91-bdd55cec9082", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639074516, "uuid": "2b1208ea-1122-46d2-9468-bb2253764353", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074516, "uuid": "cff201cb-0adb-4cc9-8b52-bcc31f3803ec", "value": "jxxNX5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896698e7-58ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639031873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031873, "uuid": "867b761a-ac85-4f12-be92-001aaa0982d9", "comment": "Malware payload (SnakeKeylogger)", "value": "0af8a5200a7feeb99bbe1bdef623fed6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031873, "uuid": "70c3c199-985a-4b0f-8ba5-3dfe247d8a33", "comment": "Malware payload (SnakeKeylogger)", "value": "a6740774021dfeab0ec2c6bf596ff9efda841c6e7d4af43a999a372fa4cb22d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031873, "uuid": "f2b63cf9-82c0-40d6-89d9-cb0b9cb99107", "comment": "Malware payload (SnakeKeylogger)", "value": "b9609860cbdb6c2d3db282f156a1ad2ca92f1335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031873, "uuid": "2eb1e6e1-d69a-4d41-884b-6f28f241a925", "comment": "Malware payload (SnakeKeylogger)", "value": "dd5e004944e463d955a41e36d49f99cafd284f90ef185712716fecbcaff703ed6ff06bab561d6c0daadffcd7744110cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031873, "uuid": "f2778f09-a8d3-4b99-80bb-4a3316714750", "value": "T195C4CF936DD2EDDDE3B418329A77EA3C41E32EF499328541AED7BADE60386502513037", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031873, "uuid": "5f8358d4-a7b9-4ac0-bb40-28f1f3898f92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031873, "uuid": "bec24773-e93c-494a-9e77-52a836263538", "value": "12288:h0NYvpv2TH2pjk1euDDfFnmtoYE6SRKGa79LADHh8CDc+:YYBur/1euDDNnooUSYGa7wh8p+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639031873, "uuid": "1e7307ed-7212-4438-a13b-616fdcc1ecf2", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639031873, "uuid": "6cc380b2-4cfc-4b78-b104-1f3afc706a74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031873, "uuid": "ed9308d5-39c3-48a3-9028-657e2828b2f0", "value": "0af8a5200a7feeb99bbe1bdef623fed6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f739bbd8-5906-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639064699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064699, "uuid": "373e7f0b-c3e3-4dc3-8eab-fe5ea6d5bd10", "comment": "Malware payload", "value": "7ef219dcc401a9e756f6aeed56922d1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064699, "uuid": "c2f9b047-aace-40da-9bac-937dd5ba7673", "comment": "Malware payload", "value": "a6794f02b39316d3468ec5a7c767b3d87375d77ee49a4489f3b6e14325fce423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064699, "uuid": "89576e58-e949-4ab9-bccf-63ce9773e907", "comment": "Malware payload", "value": "d2c50a04d07b3d79940a761154a3a3176036b313", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064699, "uuid": "8270f879-80d1-43f4-a1df-0a2524f34104", "comment": "Malware payload", "value": "d7c262703abe04162b465327a31ff447fc05986bbead7f1983c997c260ad155b364ec9dd9b0f99f8db28aea2cf69131e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064699, "uuid": "7be21974-326d-43ea-bb86-24823acfd4e4", "value": "T165F35A0559989FE3EB9E2577E264899AB333D10BE79DD6025BF6AC702F03F40066DB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064699, "uuid": "dbbddba1-fcb5-4a28-8143-6d4977556617", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064699, "uuid": "4a56d6a8-4293-4971-b34b-2494aa607f19", "value": "3072:V6VEf5k7fRHqEUt3N5Cs7GN6bYZyiypo39tNqllRJsm7TuB:OEhQZH1UnE/yYZOu396RtHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639064699, "uuid": "19b42ba2-6ec5-4973-9094-0659aaa9de9e", "value": 168649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639064699, "uuid": "b8d8e7c7-2592-428d-bb5f-50e5d8626255", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064699, "uuid": "bae803c7-d32b-4f7b-b2d9-f09347791260", "value": "7ef219dcc401a9e756f6aeed56922d1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a0ae39-58f0-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639055059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055059, "uuid": "58cd8175-8818-4931-b351-97939518beb4", "comment": "Malware payload (AgentTesla)", "value": "45ad0803c59a5c68b1e3487b7b330d5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055059, "uuid": "a25e20a5-fe3b-40f1-8453-17084d05a021", "comment": "Malware payload (AgentTesla)", "value": "a6f32d2c82c6ee870622b82d8307309a232c2906d555e30cd1cfbc48d489ca01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055059, "uuid": "a1a16121-5877-44a5-aeb7-1b90fb992014", "comment": "Malware payload (AgentTesla)", "value": "bbec32d2d769b5b4ced0449a126d24a215af71b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055059, "uuid": "9d0a4205-301b-4f3a-9ce4-76e182626050", "comment": "Malware payload (AgentTesla)", "value": "1f3f854c8042cd5cb7cd5d719eb511ff4aa21e09a37a850c5af2f075a51e724ba72bf3ef274ee42e4b407d51d1186d15", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055059, "uuid": "42d9ae9b-3262-44b7-a243-b79be2ab80d0", "value": "T1A184EC50912E3D6FF62FE81C1593E1C8386EA57AA4F0056C939EF014DE259EAED8C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055059, "uuid": "7059a014-9a9b-48e6-8595-d62a9a40c71a", "value": "1536:iG7lDDDDDDDDJGUprQHuEZebUio7j6BZCKsLz57hKfedzFz76mAg5eeVhMDw5wff:iwDDDDDDDDrEjdzFtr5RDAw5wff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639055059, "uuid": "0b3249df-e796-43ff-a161-40d88c2edd70", "value": 392601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639055059, "uuid": "78b55bf5-5fe9-4fd0-9359-69ad2e951025", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055059, "uuid": "1fe00f03-f30e-470d-bc78-55a309911fba", "value": "ORDEN DE COMPRA.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03b2a5c-5908-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639065546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065546, "uuid": "f883d4b0-cd34-473a-a9ae-e2673d77a04c", "comment": "Malware payload (Vjw0rm)", "value": "56949c45eb88b2185504e875a3988dce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065546, "uuid": "7f5e57ff-0e9c-4951-8d29-92ae107ab0d1", "comment": "Malware payload (Vjw0rm)", "value": "a707c0a69369c8e2d991f4e4b77ca59342deb8bfa37dd5c7138e823f20e983df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065546, "uuid": "e846832d-c254-47bc-bbcb-c738f57d38e1", "comment": "Malware payload (Vjw0rm)", "value": "354e71c9a2da8d31899baeea3dd264a74ae8ecf7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065546, "uuid": "9306ae7b-fce2-4bee-be4d-ca94d9475916", "comment": "Malware payload (Vjw0rm)", "value": "26ac20dce546987b113e32e8b45bcb2188077eaab2408b02a0af97c39c309730a31be1ce9c22a21b79e7b6669f8567b8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065546, "uuid": "4a4c0ab4-df16-46e4-9298-5aaa04228b63", "value": "T14822AFC801C5DEE65213CEEC07EC86197B8BABDE4101358C4DF6EEBBA8A430D557692D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065546, "uuid": "9d6dc4d0-1f44-40ca-9790-995b4e724850", "value": "192:pimMcYCxTcm/aowLVVjsL0j8BpBlENSriu036wr8IJCJuD:4vLCamhwLVB8G8/EJ/98Zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639065546, "uuid": "46b37e23-0b43-45ac-8a5d-250eb391fa26", "value": 9968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639065546, "uuid": "cd2a6f00-1bdb-4f8c-a4da-6dc369ab598d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065546, "uuid": "54507f62-dae9-4b31-a88f-88140b16daee", "value": "QAWSJPO267KJSHBNM.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79407d7-588d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639012623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012623, "uuid": "6aab8b4b-3dff-4f8a-bf48-948b8ded6a62", "comment": "Malware payload (Heodo)", "value": "db98e5d544803dce1173a815481046b6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012623, "uuid": "ccd4a3f5-536e-46ba-897a-50d6f91f6c4a", "comment": "Malware payload (Heodo)", "value": "a7d614352a23d91267911e3151240f844a723f25b0ceaa884898b3fdbeb336e2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012623, "uuid": "4c479e11-20b2-4cb9-8619-ed395492a506", "comment": "Malware payload (Heodo)", "value": "41aad417f047fd0084f8b6045c3b289837f5fa0d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012623, "uuid": "13a913b6-a055-4c7e-85c9-223095fbd0b1", "comment": "Malware payload (Heodo)", "value": "8dd46e3f4a6ac1bff4f641b1277d935ffa4cd590b2463125405bb8871968cb7bd4cd5067633a48e7440068443ba10505", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012623, "uuid": "58d6801f-8565-4388-9a32-b3a5d16d2ccf", "value": "T16B44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012623, "uuid": "bacc0931-cea9-480c-b55e-6c1c82fc901a", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012623, "uuid": "e86ccfac-5c33-43ae-9852-55e8d3edc401", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBN2ypv:6jIG/pjjuLbJLmGshoCUnWTfpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639012623, "uuid": "5dea3122-8a64-43a6-9107-af74ac306bfa", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639012623, "uuid": "0dbee369-21dd-4e8c-a76f-fbb9700fca70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012623, "uuid": "c8690757-ae6f-491a-b797-dec022f99b4a", "value": "emotet_exe_e4_a7d614352a23d91267911e3151240f844a723f25b0ceaa884898b3fdbeb336e2_2021-12-09__011658.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11142b9-58f1-11ec-96a4-42010a9c0029", "comment": "Malware payload (BluStealer)", "timestamp": 1639055535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055535, "uuid": "913f2b74-fd26-4469-a157-cc38d289bbde", "comment": "Malware payload (BluStealer)", "value": "cd02e44d708002d5675fd813991155c6", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055535, "uuid": "4433526a-a0b4-4bd8-b9bc-f62b29570c71", "comment": "Malware payload (BluStealer)", "value": "a80d07eab57b241042950869403a4f8a85806fd87dca25419e0399c3d589e7d3", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055535, "uuid": "d3ed57f5-4f6e-49f6-84f3-cc74f59ab032", "comment": "Malware payload (BluStealer)", "value": "8151d01a8468317565ab7865c69d16b7e4cbf462", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055535, "uuid": "419364e0-cdaf-4d36-8b07-3977f6c63724", "comment": "Malware payload (BluStealer)", "value": "a0297bf6860f3cadeafcc3aef031775ea2f63d5eeb37e67e94342ee77a0d7d67b454f1f287dfab19b207dfa1067ded5d", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055535, "uuid": "47980fa9-4d51-4fcb-a4cb-0399d28feecf", "value": "T169E312B59C7E3316C7AF597A45681D8F870B270BC314E4DA5A405F3EFBB18980B4E898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055535, "uuid": "f891757b-c019-4534-b055-3fa5e80781d6", "value": "3072:ZXKvGXQ3kJ/GTqeNbXDjQY86vIiiSP2B3PFZVERj3OKXO7R1/S0:ZXqGXQ8Gx558mIivkSk7R1/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639055535, "uuid": "2c1360bb-98db-4ce9-a1bf-235c36df60d5", "value": 148294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639055535, "uuid": "38857fbd-a360-45a9-b7e4-1fb6baea32ce", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055535, "uuid": "3e99e426-c4c7-45c3-9a6f-37b32d152514", "value": "LCL-Sea Fright Quotation.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c62264-5904-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639063468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063468, "uuid": "f5a5a908-0c5b-49ad-b01f-6955863972b9", "comment": "Malware payload (Formbook)", "value": "68d61c08c71e68d613bffee05f977aa0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063468, "uuid": "d65fdecb-ef69-41a8-88f1-c113e475ac39", "comment": "Malware payload (Formbook)", "value": "a887c606fe1f8c1bc2e35a57f583eddf5935b67ced79e9d78fe90b7819a7e998", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063468, "uuid": "0d39dadf-5c81-40e5-b0ba-7f13cf003ebd", "comment": "Malware payload (Formbook)", "value": "f61f7c37d674d51939eac12b1998d63c827c245d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063468, "uuid": "7a946099-3ce6-4ef9-8315-3d935dfa10de", "comment": "Malware payload (Formbook)", "value": "d7c12396b64e9a2b59b1b09a636b7b0bafc457e75bc6fcdd78acfdefa2bea1a22217cad19d17086d0dc48785f91ded61", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063468, "uuid": "2a5b83ad-4583-4c10-8124-360d6d46df4b", "value": "T1B8353312F7071A34C7E5A0BDBD1EA04A30D32CFCBAA11E4625507982E86DB597496CFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063468, "uuid": "1ac1996e-0fba-4b51-a5ed-ed88bfc0e6ca", "value": "24576:3EPLRL5PFrrTG+iSqHEQpbump5AU1+QT2ZjgiGWMj:3oh5P9TG715WbQyqi/Mj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639063468, "uuid": "3fe50144-5b3a-4d12-a954-a818bf16160c", "value": 1132274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639063468, "uuid": "c0c06452-1d6c-45bc-a5ba-a450e011616e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063468, "uuid": "4567849d-dc0d-4982-9858-96553f09842a", "value": "TELEX BI FOR SHIPMENT.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5285c7ac-58dd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639046813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046813, "uuid": "397c333f-67d0-4678-914c-b92414a75bc3", "comment": "Malware payload (Heodo)", "value": "80bd1682a99d75da1ee83d8cc6523686", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046813, "uuid": "c445eeb0-0253-4f8e-941a-09b506fa9e07", "comment": "Malware payload (Heodo)", "value": "a88900472ff8898f5799ba890ba8f331aee4fbf0b2c54bee9c51af62cdcd7421", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046813, "uuid": "3ba74d24-42e8-4f91-83c6-07d7843f2051", "comment": "Malware payload (Heodo)", "value": "c7bafc66c6e9a506ffff91e872f5a321ed63ce4f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046813, "uuid": "ad5ed844-77c4-444d-9997-4e39872953b8", "comment": "Malware payload (Heodo)", "value": "7e0786803737c03a61692f9d0bb00587958dd58da19740afc794b8c96cc73fbe44735e236b7b7a6e89924588161f42e8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046813, "uuid": "4a9e9d4b-8cdb-462c-8f71-1286695b891f", "value": "T19F9301CAD6A5DE7EF4E6D038E4BBA1B96723C037C0581E82914DCAC8802D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046813, "uuid": "509dc204-5b24-4c4b-9f37-b2e52e848331", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3q:psXZ3MYeGt9sLBrGrQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639046813, "uuid": "55bc2750-b505-48a8-b69e-9ce41dc6a875", "value": 90150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639046813, "uuid": "6fbbe088-1899-4992-957f-13950ac86bf8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046813, "uuid": "92cff4d3-d624-42a8-8906-46399a74f915", "value": "emotet_e4_a88900472ff8898f5799ba890ba8f331aee4fbf0b2c54bee9c51af62cdcd7421_2021-12-09__104631112156._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c357207-5892-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639014725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014725, "uuid": "7ac5a2fc-d966-4c1a-a306-af4f4a09880e", "comment": "Malware payload (Formbook)", "value": "7f325c4869233f1a8828f40110a61f8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014725, "uuid": "2a112011-6883-4cd7-9813-b71f45188fc2", "comment": "Malware payload (Formbook)", "value": "a9cd173bded5942ff767f9796b79a4a5db6b6095a860a028d0b229fb141add70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014725, "uuid": "4ce6dbee-2b97-4d1c-92ab-54d7727e3c71", "comment": "Malware payload (Formbook)", "value": "b3d0a9d5297a398aa1054feef7954ea00d7590be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014725, "uuid": "b91b8a93-3f46-40d7-b8f0-8bae7265f26a", "comment": "Malware payload (Formbook)", "value": "8e3ac773ad4a3bdd0a30e072d4cf9250e0d86eb3f9617df331c18403680a72ba1c74003ed8e90c3b8ec1f78d6b0b7323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014725, "uuid": "531e5376-3262-4e76-8504-dcf18a968e4a", "value": "T132B4D0B7B0003AA1D8FEC0B2D85F5D3F79739DEF4280164503F667668CA1132A7AE659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014725, "uuid": "27ea45f7-ace6-439d-bf45-7de6b8b9844c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014725, "uuid": "460c0b98-84ad-4ce3-99dd-a10f23bac500", "value": "12288:riEjTbUfc/SO/wbvKNFS9VK2lo8CR9y7JOsR5:umTY2NQnK2lq2JHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639014725, "uuid": "9c9909fa-a4d6-45c8-9e52-5ec926c279e3", "value": 518683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639014725, "uuid": "3451b335-221c-4219-8f61-1310b3054a77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014725, "uuid": "505ced5b-e14f-42b6-8f3e-906e050ae706", "value": "Proof of payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09735af-58de-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639047427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047427, "uuid": "950b2b21-72e3-44da-8c6c-2ce500f3548a", "comment": "Malware payload (Quakbot)", "value": "372f17eac16053e13b5ba1e633b8e4bd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TLGM ApS", "colour": "#F1F4F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047427, "uuid": "9d52b9ad-eda9-4006-9990-336463d75eae", "comment": "Malware payload (Quakbot)", "value": "a9d8cbc4a06edfe55eb0a7c0af8066ad34f78e30b809b9a9193fbabdfedfa22d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TLGM ApS", "colour": "#F1F4F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047427, "uuid": "c58fc9cd-fad6-4937-afbf-dc0345621575", "comment": "Malware payload (Quakbot)", "value": "e59c01229a2d8132a601b1870dde17533ed7ebad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TLGM ApS", "colour": "#F1F4F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047427, "uuid": "7badfbf0-e777-4611-b3ca-fc3b34ee8704", "comment": "Malware payload (Quakbot)", "value": "4fdc66aec91f0fe4d8d86ea24a35cdb8778a5951968d681ca4cc7d69f1e22b2c161dac6624761d18bcdd3d1ae185a97b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TLGM ApS", "colour": "#F1F4F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047427, "uuid": "871800af-5f4e-4986-8659-5a5ace93f0ec", "value": "T1FDC49F26B2D04837D1672A788D1B5369DC37BE012D38A84D3FE51E4CDF396813A76297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047427, "uuid": "17df9ebe-8ffb-4c1c-9891-57aee3b027db", "value": "91139ccb2a3b59e812fc4cd4988e2acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047427, "uuid": "ff3be5a3-25fb-45ed-b527-127735fd1b08", "value": "12288:NYYoFUdPEUPzWbJf+oMDAAYFVfpAVqtxEJg01/RZK7NSb6Vh:SpOEEWdfMUPzWVqtxkg01/mgbOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639047427, "uuid": "a82447be-0f33-46d7-aa79-ac99033f4476", "value": 592784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639047427, "uuid": "c78d29f1-7fc1-4fab-b283-d37a5852cc31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047427, "uuid": "2c9ac5d5-1fbd-46f5-b20f-64dbb63004a1", "value": "a9d8cbc4a06edfe55eb0a7c0af8066ad34f78e30b809b9a9193fbabdfedfa22d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2312a0-58ff-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639061432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061432, "uuid": "32861082-b032-4904-93ed-3503b40e8076", "comment": "Malware payload (Formbook)", "value": "0a3f146c9241e6034fee42acba30ea97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061432, "uuid": "5675e039-9b73-4e85-8858-7c53ce972023", "comment": "Malware payload (Formbook)", "value": "aa29f6df069018a9bf3d75a149ff4d061656ac07c97b5d2dd44bf0a983fb9b77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061432, "uuid": "c3cde183-21c7-449f-a9c3-4a216cf0ea71", "comment": "Malware payload (Formbook)", "value": "ec62859f490996968c74b2bb137122044e092b30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061432, "uuid": "db359d86-05be-48ad-8ea6-49ac691b8222", "comment": "Malware payload (Formbook)", "value": "3b7e4b3ad4647e2ac86be65dde2e59b35799ab4be7a38280273e8bc871ea31d73974580021337b1ec679fb988691b5d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061432, "uuid": "95c19f16-d745-4c08-8595-f716fd88b5c8", "value": "T11464129954C0697BE2604EB006B3A671F7BBDE89214B40D707B0EFEC643B7539A742D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061432, "uuid": "67f8e8c9-0efa-43e2-9dfc-1b15d02efeca", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061432, "uuid": "5fc7e0f3-5385-4e81-9e87-b603facf8f50", "value": "6144:rGizSWufA6OlBm2+B1GA4Q/yxMZqbw2ZfFG9lRltWorAvLBvNZc:yjA6j2+vGAZ/LZERNFURluvVFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061432, "uuid": "ea9d4bdf-4ba7-426c-8bda-d02917beb8c5", "value": 312718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061432, "uuid": "e483d8ed-0ac5-40b5-a6c2-35718787ba00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061432, "uuid": "8aa6b0ac-d571-47f6-b169-0565423ef834", "value": "0a3f146c9241e6034fee42acba30ea97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cd392d-58ef-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639054650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054650, "uuid": "588afeae-8868-4393-bbb0-a8db8dd82e43", "comment": "Malware payload (Formbook)", "value": "1af046007d6b208702f5dfe1f6643c3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054650, "uuid": "b19c461f-f013-43d8-bce6-b37c4626e7eb", "comment": "Malware payload (Formbook)", "value": "aa85d2160753107b6fc338aae8be9f1bb9d9dcc20f2589556141005dfc75409b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054650, "uuid": "53615ca2-8892-42f3-9cd0-7e8da83a20a4", "comment": "Malware payload (Formbook)", "value": "d7755edaab803d7360f174b785185123fea00ff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054650, "uuid": "c47dcb75-538d-4e70-a959-4fc162b36359", "comment": "Malware payload (Formbook)", "value": "752c7686016668ee20a2fcb0fe7f8596ea61e784a2bc9b34fff629bfabb18c739ab3a7ca945f0e95bb9b9b7b9b29bcfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054650, "uuid": "8776dc00-e59f-48e9-bc10-a3a4e8c24466", "value": "T1C635012085AB805CE91B32F40F15BD5A0E6BDD79C4059A4A237EF268593EB17CF223DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054650, "uuid": "4c9c09db-4c0b-4fd7-a7c0-5931f5dc2928", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054650, "uuid": "c5c6e29b-3d39-4eef-8244-09c241b884d7", "value": "24576:swhxbH7Zu8abedEazLcd3juzOcQvCHY7qONRTUgd4gN8JXy:swhV708a62eIsicdH2qONqgd4EOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054650, "uuid": "f8bf30a1-c2d9-40b8-be81-6338f91f5c9c", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054650, "uuid": "2338b105-6558-494c-862c-31ba7df0b8af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054650, "uuid": "35420aa9-301d-42a0-b906-6c346c62d5a7", "value": "New order for PO-4600056709.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3518049a-58e2-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639048911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048911, "uuid": "9c86c565-b021-4622-9c05-5a1656b52fc4", "comment": "Malware payload (AgentTesla)", "value": "e9c1fbe3d366823c46a33cc4f258f177", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048911, "uuid": "06d5bb8a-7d58-40c9-9833-f60b5694c334", "comment": "Malware payload (AgentTesla)", "value": "ab425cf03e6d0f60106981818df4f33ad7f9164581069002c333d42676872d55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048911, "uuid": "1cbe25ca-d434-46c4-a0af-404e2fe268e2", "comment": "Malware payload (AgentTesla)", "value": "de816cab16dc933a9abe4aeb2da389653cf6045a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048911, "uuid": "efaed45a-d11a-4f5c-9e92-9225b106a1a1", "comment": "Malware payload (AgentTesla)", "value": "cea8f1bb012488e435f8726cd42dbb62d303d13eaf0ebe4492b409f75cabb20dc202009c8679202f70188d5d6ad7afb8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048911, "uuid": "3073ad05-ae16-4793-bbd6-3cd696456bb6", "value": "T15694235FD8DA452B1938ACC4B264965D81EEBABF7B97C9C8FF50F3AF01654394280D02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048911, "uuid": "d6ee3b81-2bc6-4a51-9ee6-4114bb59db32", "value": "6144:zrtdkEbu97gbFmR3yHgKyAJDUpPSzkc/s2J9fASdEw9RdYhd0AXEl8l7IHU3M:9dA1gbFmdyA3AJIpPok4r748T6l7I0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639048911, "uuid": "f2d31b9a-e19d-4136-bf78-f8ef640a0948", "value": 445504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639048911, "uuid": "ba477dab-9227-46e2-b852-57f16cfb6eab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048911, "uuid": "dde23f80-5cd5-41a7-a45c-49e2806672ce", "value": "pagamento.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17b1571-58d0-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639041443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041443, "uuid": "a785c0fe-5306-4fdf-9a7c-3cfe2bf989ec", "comment": "Malware payload (AgentTesla)", "value": "9bcf09aee12eafd6fcc55f5931a24351", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041443, "uuid": "01e84236-999c-4fc8-88e0-3716ceebdde4", "comment": "Malware payload (AgentTesla)", "value": "aba7d992922abf046302e3e1d88114f5f045edc66875fb415a342e41543e5f2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041443, "uuid": "04ac95a1-cd18-422d-9bf6-965134d3caa1", "comment": "Malware payload (AgentTesla)", "value": "e395cabf88236ef683e2f56d10efe8fd55c99056", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041443, "uuid": "e5e9fffa-97d6-4b07-86d0-0ec639ca7320", "comment": "Malware payload (AgentTesla)", "value": "5c13d5e8e1e8195db08dded2bfce474a5977a59ed7c70b214fa3df28b85715d62e1a09a24609f9bbe0ff45c748c92a20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041443, "uuid": "ac1e2478-4f5b-40eb-bd90-49af53a522a2", "value": "T16255131D3DE5E06FD17A09B9C307D0604AB9E04B3D63F3B55C8A61AEB6389C9D643682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041443, "uuid": "7562c063-ea3e-43e3-9653-7964d4dc3acd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041443, "uuid": "0f8633b6-17e8-4d15-983f-85adac83213d", "value": "24576:2IKjy/SYCpPd5HKe34M1Lx43Eoga6D9id59Whqkj1xcBQW/YV9PJtwVijnt:EjAS3drIKi0Lar+IioBan5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639041443, "uuid": "5a613b69-efb1-4f72-a68e-ad57e23cf2dd", "value": 1309184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639041443, "uuid": "39da6b18-f1e5-4e0c-bafd-9965e1996c95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041443, "uuid": "9612a157-514a-4bf0-bfdc-1fb16afb32a0", "value": "new bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb3fc39-5911-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639069084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069084, "uuid": "eb00392e-e09b-409e-b095-08a07a35fb4e", "comment": "Malware payload (Heodo)", "value": "828611f39bb6a821fa6ba31a46263fe0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069084, "uuid": "65b1dccc-1cc3-48ed-9528-6de4405a6c29", "comment": "Malware payload (Heodo)", "value": "abff6c4c0576b6f1dc50478dd91cf8aa9c1ffd442f54bf6afa9e46585c6b507b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069084, "uuid": "0a23b839-6597-4c12-87e1-5afbfbeb2b47", "comment": "Malware payload (Heodo)", "value": "d9823cd7c71bc4b333a23d1513c535fe4958f705", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069084, "uuid": "ba13efae-937d-428f-ba7b-0a61ce77abe4", "comment": "Malware payload (Heodo)", "value": "1d5643e96b25758b35273b55328b0edd8d9adbb85723d9e5df55fb6eb8b5b7d93638e6d9aa44d8d6727a2dbdb72140b4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069084, "uuid": "d6e040c5-52ab-4c6f-a9e2-17186a23643e", "value": "T11A9301DBD295DD7EF8E6D438E4BBA0B92732C071C15C1E82628DDA48812D5C757FA2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069084, "uuid": "d4f3e77a-a8af-4539-b80f-5de8102ae0cf", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbt:yIBQ3MYeGt9sLBrGrBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639069084, "uuid": "7a2699cb-2ec3-408a-acbc-7d6d94c7e17d", "value": 90157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639069084, "uuid": "d04dd21e-1afb-4454-a65c-0691fc3739e1", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069084, "uuid": "a3300119-c083-4bdf-b184-48c45db56373", "value": "emotet_e4_abff6c4c0576b6f1dc50478dd91cf8aa9c1ffd442f54bf6afa9e46585c6b507b_2021-12-09__165735679535._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36206200-588b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639011547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011547, "uuid": "64765b20-fff4-4909-b440-3b23324abf8b", "comment": "Malware payload (Heodo)", "value": "573eabd987172fed6aa1e710bdc57b14", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011547, "uuid": "9ac9b770-1d34-48a9-af54-4eeea00c667a", "comment": "Malware payload (Heodo)", "value": "ac2dfca8f482a96ef4fdfbc8152767f2b414c374863f26137dcc329880678155", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011547, "uuid": "ad6189b4-5a70-4daf-9002-970ae984b0d7", "comment": "Malware payload (Heodo)", "value": "2a2c16d3ebf6aace0b976b0ce0b21329f09f20b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011547, "uuid": "1ac73054-3b95-4738-9337-c9e5a09a42b4", "comment": "Malware payload (Heodo)", "value": "ce7d46018215d3b513e0a86563c96bfc0349d3190fb7c3f4209e44d7f0ec3e7cb4646af57d627aba50b247c2b4c394d5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011547, "uuid": "d587e628-873e-423e-ad05-d73253f6cd4d", "value": "T1BB44BF10A181D036E5FF087A85FAD9BE466C76600B80DDDFA398187E4F6B5C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011547, "uuid": "89eb5423-306c-4360-9df3-858767ab12bd", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011547, "uuid": "a320dcf1-7de4-4992-8549-762afcdd4401", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBrmgL/S:Wvef8+h61mRcHL+rF6l5EAQWTjL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639011547, "uuid": "3fc335ac-c195-4f0c-8e0f-031b656d691a", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639011547, "uuid": "31145cd4-97f5-4d6e-868a-5e33042e9efc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011547, "uuid": "5c7aba1a-52fe-451a-9564-d86bf02601c1", "value": "emotet_exe_e4_ac2dfca8f482a96ef4fdfbc8152767f2b414c374863f26137dcc329880678155_2021-12-09__005902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1369354b-5888-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639010200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639010200, "uuid": "c8af48a8-b46a-46da-a012-8be34a94055d", "comment": "Malware payload (Heodo)", "value": "4237b5a8d15f1b11b642f0cc2e01f9ef", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639010200, "uuid": "909fb132-78a2-444d-ba4a-9277fbbd7410", "comment": "Malware payload (Heodo)", "value": "ac37481af6b0e8c81173ca606f1243e239cbe4255c7f950b2d034c8c05e384b5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639010200, "uuid": "d059ec63-e78d-4cb7-87fa-e6cef4258839", "comment": "Malware payload (Heodo)", "value": "74d9c0014646b87233ff901f70ee295fecb667f6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639010200, "uuid": "ccfdbab8-c473-4b06-abc3-b36e13f9f706", "comment": "Malware payload (Heodo)", "value": "12a052f208a30eeb31534c1a50acfc7515abd23b4490c48b94f66aa3c53e0ed07d41f33a7866a9d850219339c990bcb0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639010200, "uuid": "52f83b73-3289-40b8-bdbb-0cd84e230222", "value": "T16393F1DBD394EE6EE4E7D438D5BBA1E927628027C1685EC181CDCE8C812C5C657F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639010200, "uuid": "317ebc0e-7a1c-44e4-aa71-be388dcc6889", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySN:Gp4Z3MYeGt9sLBrGrSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639010200, "uuid": "56da458d-1e8f-4e46-a67d-0d2ff6c04705", "value": 90141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639010200, "uuid": "448ccaa9-4fb7-4dc9-b0ef-38e5416c9965", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639010200, "uuid": "885e7d47-972e-4088-9204-bb8f80796062", "value": "emotet_e4_ac37481af6b0e8c81173ca606f1243e239cbe4255c7f950b2d034c8c05e384b5_2021-12-09__003629127530._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858d24e1-5917-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639071810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639071810, "uuid": "c5246a51-06ea-4c14-9480-48830007506a", "comment": "Malware payload (AgentTesla)", "value": "cb746501178aaccfeb95c34529422d25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639071810, "uuid": "87c6ccdc-769e-4fdb-ab84-24a63a8d3442", "comment": "Malware payload (AgentTesla)", "value": "ac632eb6ae55aca6708abfe49a03026e4d45c9263b749aec32f3504919c5ae64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639071810, "uuid": "76ef01b3-bfd9-4919-8697-4f96892c1276", "comment": "Malware payload (AgentTesla)", "value": "9a76e4307cea7514e8c56b59377c313229c4b158", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639071810, "uuid": "091fa3ac-d632-456b-ad0f-8d1dfd69b8e4", "comment": "Malware payload (AgentTesla)", "value": "e7b25eaf49a2b77e12d298e35ff68a776877309030c902d31efe00df83df50805549f059b561a4da1f3b9a4b53470105", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639071810, "uuid": "e08edc13-8c6f-4fa1-bc2b-d88fb7bcf555", "value": "T17645232929F5E8ABE6288BB1D397C050CEB9E0462DF2F2755CD241EDA7346C4D913B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639071810, "uuid": "579cd264-56b0-45e2-81e4-6782f7a86179", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639071810, "uuid": "8d0e2032-23dd-48b4-8116-ad72a5e93c60", "value": "24576:SIKjy/SYCpsHvz0772WVtne9GGehKxTdKe2Y0nicgNytnN9ubTCSaRk:AjASUP3WTeoGehWTdJ70FtnTiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639071810, "uuid": "d51170c5-d3ac-4e4b-ab44-ed1a6cdcbf60", "value": 1274880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639071810, "uuid": "e604352a-a973-4fae-890c-cd23011d5baa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639071810, "uuid": "0aec633a-57e9-432e-9ca6-aa7eca71f1d1", "value": "Bank details___________________________________________________________________________________________.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636ce73e-5883-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639008187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008187, "uuid": "02e71ccd-1559-4f96-9e11-615ee1b32772", "comment": "Malware payload (Heodo)", "value": "9f86b97269c151347bc57cd52b7a9569", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008187, "uuid": "6ca99e18-6196-4993-ac66-8af45b3ecd79", "comment": "Malware payload (Heodo)", "value": "aca015bd1cf9737c273f44f4ee398e745f7627905ca0d7c545e4d57e19535394", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008187, "uuid": "0baed287-b1d2-45c9-bb5f-9aa3f50c9a32", "comment": "Malware payload (Heodo)", "value": "9c638c5bf1d521686b305c3308942724b9a47c62", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008187, "uuid": "15e3a701-0474-4d4a-8923-9a2679c7abb1", "comment": "Malware payload (Heodo)", "value": "161a25c4a618e200feba92cfdee71831d5fffd460b5271daa028ee9b551f8ed8c5b9d0c9ed90dbacc91165640ecec325", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008187, "uuid": "18a9c962-2e62-48f3-98dd-8a6f1ea45b95", "value": "T12B356B00E741A127E9E700F681FB86B9957C6730236149CF16C86BF9EB256D4BE31B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008187, "uuid": "637bf10c-45e2-470c-ac6b-18a14ef4c4a3", "value": "62078d7879a78bd152de3e9b45102cc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008187, "uuid": "61162268-0d94-478f-8e68-201da0b106f9", "value": "24576:m0PH4PvkgtgfeJfhM9nYG7uAyfKtTH5TTY:b+lgGvM94Str5TTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639008187, "uuid": "0542dfac-8883-42c4-a20d-d2c16fa292c6", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639008187, "uuid": "e7be8820-9fe1-434a-abd2-8bc9465c664f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008187, "uuid": "d098f83b-29f9-461b-9f1b-1578a506dcf1", "value": "emotet_exe_e4_aca015bd1cf9737c273f44f4ee398e745f7627905ca0d7c545e4d57e19535394_2021-12-09__000302.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad00e1c-58ad-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639026158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639026158, "uuid": "39d4696d-5f3e-48e0-9913-58e5178f1865", "comment": "Malware payload", "value": "3dd30a926c66fd99475732993bcfa208", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639026158, "uuid": "b7b0ace6-80a1-4289-9d85-214b364bb797", "comment": "Malware payload", "value": "ad114ebdaba07beb21532b492be53301adbadf524dce64dad70eb55f13d12ad5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639026158, "uuid": "dedb9105-cc43-4edf-84c5-1e23dd0d5123", "comment": "Malware payload", "value": "07a959bd48906e0a0c76a8081436e44be3c3e15f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639026158, "uuid": "f3fc3074-938c-4a3c-a226-c12a2475028e", "comment": "Malware payload", "value": "fb1670f96a6dfd74794404d7090539fb08b38d08ad367276f7d9b06dd958671c36627aab4bc97d5964983f999d025372", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639026158, "uuid": "d4391fdb-5eba-43e9-b840-35d5dfab6444", "value": "T1E093F064E1DE6D9BDF2B437511DED2E5D383B214996D4BD07C61B0EB8CE2CA960383A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639026158, "uuid": "f3ad1979-21df-43dd-a34d-2a5487763573", "value": "1536:hbDQddfUed5L4fwIsxJOudbxqC/kHpl9uKHVL3ovR7en4uIZkkGkx4kOk3kHkAkv:hbcffUXwhJd0+y7ukYe4uYum1Gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639026158, "uuid": "d1006f6a-b7a1-4aca-bab8-03bbb57ff509", "value": 95779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639026158, "uuid": "59a612c5-610e-412e-be7d-b996d975900f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639026158, "uuid": "a161b5bc-0217-49e5-85ca-a7abc9ba64bc", "value": "emotet_e4_ad114ebdaba07beb21532b492be53301adbadf524dce64dad70eb55f13d12ad5.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc96cfa5-5891-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639014376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014376, "uuid": "9bc92f88-2cdd-4924-8bff-0008ec63eb2b", "comment": "Malware payload (Heodo)", "value": "c7d0eb679b6618107b8d597db226315a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014376, "uuid": "cb296102-d7f0-4be8-8f8d-1d796d2e5511", "comment": "Malware payload (Heodo)", "value": "ae0c4c272ff393af97c3e5474aee98cc04cf59b7d191ee33637d503b4f8ce3d5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014376, "uuid": "0ec24580-9fef-4104-bce1-7d1fe47984e5", "comment": "Malware payload (Heodo)", "value": "3a09623c47f4df343ca36ee29b40bc2b7a2c26c8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014376, "uuid": "4f7f3770-5723-47a1-a98c-66ba62719c63", "comment": "Malware payload (Heodo)", "value": "5f271dde32c42ad23edd8db050f7e2ad60ca2b518e95797634a88f1287d877dfd4f97c9693cf5f00f9ca800dbcd294b0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014376, "uuid": "3a884dfd-907d-476d-aead-274ca0e9e807", "value": "T1DE93F1DBD295EE6EE4E7D038D5BBA1E927728027C1685EC181CDCE8C852C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014376, "uuid": "989b7238-6ad9-49fe-9252-982076134589", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySK:Gp4Z3MYeGt9sLBrGrSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639014376, "uuid": "e3ca2080-f1e8-4d48-b501-c47e47babbbf", "value": 90144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639014376, "uuid": "415d2ace-b408-494c-88f6-0c13fb2dd2d1", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014376, "uuid": "6f20b3b2-a637-4612-8429-36bb1b9c7d7d", "value": "emotet_e4_ae0c4c272ff393af97c3e5474aee98cc04cf59b7d191ee33637d503b4f8ce3d5_2021-12-09__014603891198._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22259bc6-5883-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639008077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "9ecc6f2c-dfb2-4e77-9989-e5bb196af862", "comment": "Malware payload (Heodo)", "value": "2e4d287ed3ebf2b6c66f994dab440e79", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "192a9e7a-8408-4e54-b08a-281825604233", "comment": "Malware payload (Heodo)", "value": "ae6e7c4580ac8ea30db6bf460f75a82af041350343e1742e1e0f548236b2aee3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "67675327-71af-41da-9dc9-3ebcda33f1eb", "comment": "Malware payload (Heodo)", "value": "e1a4fd71c6d2beb6077b50b57cd498074008803d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "99680ad1-b967-44dd-9c2c-28c166c7ffbe", "comment": "Malware payload (Heodo)", "value": "7a10bc63f5d345e008b675dfd6adf5fcb457394c21606c901d5917412a2428336b965dc4f9aca23d9f7b9b1093282fe0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "0e39b353-727f-4bd0-8a6a-7240c4172a80", "value": "T16B44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "632d9a0d-98f2-415f-a0f0-7f74bf1303bb", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "879c2f00-b4ec-428f-ba99-0d35a63922a8", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBW2ypv:6jIG/pjjuLbJLmGshoCUnWTapv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639008077, "uuid": "cf4ab0d5-cca4-40fa-b086-2b6a99721420", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639008077, "uuid": "b00160fe-7d18-41a8-b9e0-45724117f5ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "ba179aba-2603-41f0-9ab3-f337dc1eef0d", "value": "emotet_exe_e5_ae6e7c4580ac8ea30db6bf460f75a82af041350343e1742e1e0f548236b2aee3_2021-12-09__000113.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c145d559-58f4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639056877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056877, "uuid": "1861d014-4cb9-45cd-841f-bab37b5b482f", "comment": "Malware payload", "value": "aefbdcf509f3b52860d18feccd53db14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056877, "uuid": "df73dad5-107a-4eb0-bb2a-fcf5d84bdb4c", "comment": "Malware payload", "value": "ae7ac855beea658b0a5eee122cc252c2148ff3581fb3ffe52c793159de158a5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056877, "uuid": "1a88a14f-5cdd-4afc-9226-c0c6dd430a21", "comment": "Malware payload", "value": "21d7f1c844cc4ba0a38593fa9cac3160695b9b5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056877, "uuid": "5bb31ae7-4d6d-44ef-80f6-c371ba0ac03e", "comment": "Malware payload", "value": "ea470d0097e4fa485e14889a6aec69b0e7f14188508983eecd740e11cd187f0a149b505b6aa01610f75becef7b788ad4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056877, "uuid": "f405bc1d-cc46-4703-add4-2f78e637dab2", "value": "T1F08527A716D31A6ED01AE2F85252FCBE93AFB17A1005BECF9579B131AD53D003E91306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056877, "uuid": "ca3e6b3b-5fa3-41a3-b86a-cc3b276621fb", "value": "9a5d4dec95bc4d69b8926ad2dd159e2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056877, "uuid": "c847676a-26ed-45f9-903d-1335bcd499b9", "value": "24576:Dp2DpFrYRC60VboLYjBmwtOXoaTLlvms1J9Hdb8+:lkYRb0VbSloaFvLHd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639056877, "uuid": "828ba9a7-2308-4a05-9d75-85deb691fa02", "value": 1858463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639056877, "uuid": "dc16238f-df60-4267-8978-a02299c01fcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056877, "uuid": "d5efda4b-e0a9-4708-a45e-d6b186a8f8f2", "value": "aefbdcf509f3b52860d18feccd53db14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91820e4d-591e-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639074836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074836, "uuid": "86323265-3e59-4fb3-9321-1d224a121cea", "comment": "Malware payload (AgentTesla)", "value": "d977789e789dad24af7ca8135c6c50ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074836, "uuid": "c866048e-d5fd-450e-9bea-741cb933209d", "comment": "Malware payload (AgentTesla)", "value": "ae97468f8b8d1438f541184e4fe60aae5d9281807d8a9eab59a996ad33cd52e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074836, "uuid": "078f29c3-9874-41de-bff4-026a8d2bd69e", "comment": "Malware payload (AgentTesla)", "value": "2a51e4e0127036f59962daa16fd6dbabfbe525b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074836, "uuid": "c4e26a35-ffa5-4c15-ad1a-0e090b735229", "comment": "Malware payload (AgentTesla)", "value": "248884bf0bbcd8186d64a2091eb369bc55658560444804aeb0826e5506ea4e17e26ca88f8d64bf166505e3489cd8d2ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074836, "uuid": "8ce9b3c1-d27c-4f57-b460-027905aec79d", "value": "T1EE45131A3AA4E56AD1295B71CBFB8010C73CF0473DF2E2777D9513AD6138BDA9A03186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074836, "uuid": "7feee49d-91ab-466b-ace9-00d10de752a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074836, "uuid": "fa384e70-7a7c-41fb-a4b7-4ae9ef7c1b9f", "value": "24576:TIKjy/SYCpDEs/HrSVOiH3vUpQnIP0Q/CX8rPf3/C/bY:TjAS7E4ShfUpQnIcIQ8zCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639074836, "uuid": "335a5251-af91-462d-8088-7bf95839399b", "value": 1260032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639074836, "uuid": "c074c870-42ee-4e27-a1fa-7c6ac21c4f26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074836, "uuid": "a2b16f75-328a-4eb7-8a82-b1156b3f8c48", "value": "Lp8sdmrGGU7Gw40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08605aeb-5902-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639062580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062580, "uuid": "9f897e42-94ed-45db-8dff-b197e3813f27", "comment": "Malware payload (Mirai)", "value": "2c4d9292870f62e5b24ad1e8263912b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062580, "uuid": "2f417160-a586-4a06-83ae-44dc7cda6f5c", "comment": "Malware payload (Mirai)", "value": "ae9b2743dfd59ed087d70782135c7219472536b9381db8369d3248ce613b5472", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062580, "uuid": "4210f277-0d4e-40c3-8292-9733d5f8703e", "comment": "Malware payload (Mirai)", "value": "2fdbdd36c276dceb7ff9fb495d780646371615c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062580, "uuid": "95b16332-0fb1-4667-a3f7-66491ae58cac", "comment": "Malware payload (Mirai)", "value": "41e6f42acd33fdbbd72de1e8ae59511ad19199cc29280d4f7c9479b386f70714d0af3fc85ac1dc51931f3f30d93c2167", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062580, "uuid": "b2cfc7cf-cd1e-4067-8684-c35903d62c8c", "value": "T1F7D2E1B5EFBE464FE88A623C8D9EDC89256C7C651B79864A06011F673038991F3ECCC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062580, "uuid": "a9af0d28-880d-41fb-adc5-6ad636719e33", "value": "768:EN8fWlfoQmQAXV7E/QciiRcLprDKluEqV:YMNXFl76N4PMu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639062580, "uuid": "d149fbcf-933c-47fc-98c6-67a78bf86be0", "value": 29912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639062580, "uuid": "ff4adce8-c4f2-49a0-958a-d68b2f33d4c2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062580, "uuid": "d66c48cd-000d-4013-b21f-6afe93f03116", "value": "2c4d9292870f62e5b24ad1e8263912b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31a909d-5901-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639062545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062545, "uuid": "42ceca29-6500-4d89-b924-b1aa1abc8c81", "comment": "Malware payload (Mirai)", "value": "8989fd1f45c09500b75a3e13911490eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062545, "uuid": "45fa2786-2c30-473b-beb1-19d9e9be0811", "comment": "Malware payload (Mirai)", "value": "af3b4c6f8afac731b105a635e65d9d47ff557bb2e405bd429e9f9f1c12057530", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062545, "uuid": "a4bcf0a1-f823-4fe6-b457-4c778f16d85b", "comment": "Malware payload (Mirai)", "value": "db62e753a57980f518a5ab85662cf1d0345172bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062545, "uuid": "66601a48-8b45-4e29-a51b-77085a383008", "comment": "Malware payload (Mirai)", "value": "5b3dbaa6182315be87e75019ac99a0a069ae4a0abfaa34565cb6ec028608cffef7d85990d453543f61f77f9c68f42f4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062545, "uuid": "7a8d5b1a-a743-409b-adb3-41adffe5fba7", "value": "T18A332A8A64112E6DE9DA5CB981764F0ACE541210B093171FB3BBFDC33933368FE66949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062545, "uuid": "0d169eed-6f30-4164-9f5b-b9f67fd0f3f0", "value": "768:UaRTre1lS2oueg2me2nPQCHEM/ArPwqLWHG2TqOhRol7gSu9+f1prZadIi0eNia:Ua0zoRg2mew4ChAVLzF7gSyg1pVa6Ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639062545, "uuid": "113e40fc-d4d9-474a-8c1c-b33a14d3519e", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639062545, "uuid": "98b8090e-2c90-4a4d-b519-5665a8949925", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062545, "uuid": "0d3cbafc-1776-4008-a0d3-5612f01edc13", "value": "8989fd1f45c09500b75a3e13911490eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84232c3c-58f0-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639055057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055057, "uuid": "80734269-2a6f-4362-9932-41f1a65f42e9", "comment": "Malware payload (AgentTesla)", "value": "5a05c8b95363756eff88e6d3b4092a3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055057, "uuid": "23cfb3a5-2558-446f-94ef-f307e8563123", "comment": "Malware payload (AgentTesla)", "value": "b089a10e4021402f3754065f81cdcbf723efe85e1782b1b811ed39959593207f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055057, "uuid": "4f88ac38-5f75-48e2-918f-222bcf9fc2bc", "comment": "Malware payload (AgentTesla)", "value": "db3619e6c410374c5260ab5c0af9618aec36efa8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055057, "uuid": "ababffb0-0104-4e27-a11f-940629d7b048", "comment": "Malware payload (AgentTesla)", "value": "bfccb0f09236d458985cd1481ada363279139be37e56603f1c606dd9262aa0a59a5fe80c814cb15fe95e670a7ba524aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055057, "uuid": "10a06782-e7a4-4f33-b230-3a6968700f69", "value": "T14E84EC50912E3D6FF62FE81C1593E1C8386EA57AA4F0056C939EF014DE259EAED8C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055057, "uuid": "b47db1b7-f989-45b8-8d46-ad54be2c8016", "value": "1536:iV7lDDDDDDDDJGUprQHuEZebUio7j6BZCKsLz57hKfedzFz76mAg5eeVhMDw5wff:i7DDDDDDDDrEjdzFtr5RDAw5wff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639055057, "uuid": "b4c2304f-94d5-40e4-b63f-caf56e6dd94f", "value": 392601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639055057, "uuid": "708eb648-3c4e-4efe-860d-865126accc09", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055057, "uuid": "0bbd8fcc-1e2f-4964-88f4-9ab97c53839a", "value": "Details Needs To Be Reconfirmed Urgent Remark.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db41528-58cd-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639039987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039987, "uuid": "f625eed3-2a04-46d5-a748-bb76d4dfa88a", "comment": "Malware payload (SnakeKeylogger)", "value": "24a8e8323117fdfb1cba6dd19c774b86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039987, "uuid": "b5b61a4b-b88d-472c-b7e6-c368d28facea", "comment": "Malware payload (SnakeKeylogger)", "value": "b0dba7432767097f7a516c22537252dcd9694ec249c1cf5b44d53c842657bbfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039987, "uuid": "e7a3b17d-d56e-429b-bef8-93534b012fc2", "comment": "Malware payload (SnakeKeylogger)", "value": "5e676ce8021fd0ca15ec316c34d3fb7e5bfcc2a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039987, "uuid": "6e02241a-08cc-4d36-84cb-3af4e5a1d3fa", "comment": "Malware payload (SnakeKeylogger)", "value": "be3236898cc0051de78478bd1bc17e03e8bd174ef7118816dfe471032e8adb5c4debe70c1cb7eae7daab8f11ede2e6b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039987, "uuid": "4ec28067-a9e8-4ad7-b956-c182ec0c0eb0", "value": "T1884558205613C418F68632F64A6369F66B7F7D27F840C99A22B9B526003D6C3EF1778D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039987, "uuid": "ef20bfe3-28f5-4e67-9c11-b5a51950dcc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039987, "uuid": "7a67f91f-5b31-4bd2-8c9c-c9063dc31ee3", "value": "24576:Gk2svtzBgd3or86vI3P8yxnjTZX87BtKcZdbZ9kA9uL9r:G4gdeNv0P8y9V8rt9l9uR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639039987, "uuid": "17cd8b6a-6642-43ca-ac69-cf01d7065226", "value": 1204224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639039987, "uuid": "7cca9dd3-961c-4639-85da-0877faeafc2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039987, "uuid": "14b753ed-1441-42a3-bdd6-8106fa9cc215", "value": "REVISED INVOICE FOR PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce37278-58f9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639059018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059018, "uuid": "a2ab46ce-fd5a-4d46-b1a3-e2d3c595bc6b", "comment": "Malware payload (AgentTesla)", "value": "ffb4d30088a98fe41feef5a6be841987", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059018, "uuid": "21ffb295-7d42-4e07-b337-db2dd470bf75", "comment": "Malware payload (AgentTesla)", "value": "b20ff2d671025d4bdb33514bf2ff3cc32382ee6aeccf4b1d9c4a120bc4a73c3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059018, "uuid": "2f163ea4-88c5-4790-9b76-1361f38e672f", "comment": "Malware payload (AgentTesla)", "value": "7abd7802bd7ad1efc34ec32ca4b159aeea752b04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059018, "uuid": "fbcd6c02-45f4-45cf-bb76-37f82603e48c", "comment": "Malware payload (AgentTesla)", "value": "03561f515afb115f70115b658562fbf69f4fd772ff7bb0e4c26996a14fec5e2fda65233cb8a5446e52d6b3a0e8de5696", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059018, "uuid": "96e93113-80c7-4870-8c8a-3dccb0b68e9a", "value": "T1D45522291DF5916BD62D97F182D3C0708BB9F0132E52F3FA5DC101EE763898A9943A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059018, "uuid": "61893d3e-5d30-4e2a-bc46-21f4bfa90181", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059018, "uuid": "35be15ee-2027-41e7-b033-a7f2bfbfcb47", "value": "24576:qIKjy/SYCpTQEtX5UL9idTdMle65ugTCLaDasWibIUUmY8G5+EWbGG:4jASbH5UZidoe4PCe1WsRnnbGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639059018, "uuid": "a0effd33-0e71-4ddb-87d1-cbef7debf430", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639059018, "uuid": "0e058be3-e125-44e7-8ef0-b26bc984ad78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059018, "uuid": "ad4e7007-a97b-4396-82c7-6fffa1bbab21", "value": "ffb4d30088a98fe41feef5a6be841987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6c0566-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639054213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054213, "uuid": "5c84b708-f7d0-4795-bc44-1bb56c1381ba", "comment": "Malware payload (Mirai)", "value": "c28ca9e19238c99b64e05815fd231ddb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054213, "uuid": "1ad30cb9-ee83-4a95-a22b-f59ca86fb786", "comment": "Malware payload (Mirai)", "value": "b350bf869f90d80715b71f5dd293d70ca72ebb62b90deb827bc579fe57c30dd4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054213, "uuid": "f5c286c5-32f2-4dc6-aa7b-6a02d7c47169", "comment": "Malware payload (Mirai)", "value": "a50fdf4d053065305b690d230f51133ac8358f62", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054213, "uuid": "df9ffe97-97fe-4696-a190-436b3ec3da14", "comment": "Malware payload (Mirai)", "value": "cb89a2a9277640e8ae8f3a7b75e7ec9c78659c6ee38cb96e2d373f4c5e1c5bc4158633b7ec58f93ca872bc5aedf49bca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054213, "uuid": "bab888e8-a44f-46b0-b082-83a9a373f616", "value": "T1FD33F112A2321F729C798C77F5B441466ADD8BBC51CAF6B34108C99C4662B4BF0AE4D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054213, "uuid": "7194179f-032f-44d0-bc0f-a8c5c0f04778", "value": "1536:kOIlMtSFSIhqUXKpdhi41Hf/ZV3Lv8WHi:kOmMoBlapbief/ZVLFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054213, "uuid": "a9d5825d-9757-4048-b6bc-776d39f176a4", "value": 53636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054213, "uuid": "8c2fdedc-45ef-4011-af7a-83fc4ce1584f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054213, "uuid": "ab639eb5-0b58-428e-bfdd-d94e070a9516", "value": "z3hir.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f025ffb-58ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639031829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031829, "uuid": "9ce11dff-1f23-44df-a508-92aaebbbbf2d", "comment": "Malware payload (ArkeiStealer)", "value": "711804d52059940327359ce6aa728588", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031829, "uuid": "56366208-d956-44f8-a5fe-0252f550f8fa", "comment": "Malware payload (ArkeiStealer)", "value": "b41125bef1aeda6f830ec1d7bf7fd25bd055a43f8e345ec1f7b087a7bed1a9d4", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031829, "uuid": "586307d7-3372-49ea-a418-1f95cb4c98b0", "comment": "Malware payload (ArkeiStealer)", "value": "79bd7559a6d1804456dd427b5a7fc54700fd0079", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639031829, "uuid": "4e604644-d46f-4a6b-a2f0-4e55797ec64f", "comment": "Malware payload (ArkeiStealer)", "value": "696f6a93575d37f4a7c73981130bec74caf652ad08e709ee3250880752bd5261e8508186b4047e1378f2a4c8eb8a0ebf", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031829, "uuid": "6ee08ee3-ca00-4cd9-913c-1f6e3db035b2", "value": "T13144BEF176AC9871D5532E30882187A12A3BFC12D920A11EB6745F9E1FB3BDC46E531E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031829, "uuid": "b9754815-90da-4647-a2fa-a49be4f997cb", "value": "22a152a1f20a665e41e955875a1692f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031829, "uuid": "9ec6fbb6-466f-4f37-a369-dc4bbcd85e03", "value": "6144:db7LU8q/piwrldTLTmeuzbgwu6L7ITsqSigaTwVfr:d74jrldnZunnn7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639031829, "uuid": "3f47d867-b8e7-42f2-9d8a-3a9ecf6f16cf", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639031829, "uuid": "ace6357d-e1f3-4433-a25e-27f7195ba269", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639031829, "uuid": "e44a1ee3-aaa5-4305-8e81-5084b9c27dec", "value": "711804d52059940327359ce6aa728588.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f1a3d0-58f8-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639058496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058496, "uuid": "19f8c756-d0fb-42eb-bde0-61c0b210e640", "comment": "Malware payload (AgentTesla)", "value": "e6d4d499cac6b451e48172eb4ac016af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058496, "uuid": "7777ce15-67c2-417e-80ac-eff5cd60d890", "comment": "Malware payload (AgentTesla)", "value": "b4d9f1c7f9c27fcff496f443ecc5e1c3c1547a7394b73c974417b380e0a86cff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058496, "uuid": "755602d0-9ad6-42c2-b2ee-9840fa5981b5", "comment": "Malware payload (AgentTesla)", "value": "b17815b24fb603f6b933e3cb200281f8c3eaba2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058496, "uuid": "5b476058-950c-410f-a423-7bbacf9d2e6a", "comment": "Malware payload (AgentTesla)", "value": "7a36ddd390ab3e0a6304d3abc8d9e08a828db8696d41ea9751983ddd0318c39534cdfa670f439ad1b4a6e1d9c537a782", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058496, "uuid": "ad0c525b-e42c-4b3c-882c-e1b6332d5aee", "value": "T1C935237C769396CEE49A82B6375A906862BA7D36414BC19CF89E324F5C377483133B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058496, "uuid": "cbd89e9a-843d-4a21-8f56-acf84e090705", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058496, "uuid": "ebd70267-8ebf-4bbe-857d-bff6ccc0cc94", "value": "24576:Uaoa9mmoehK/HavXNkSisHl07G8pCAZRss:UqoehK/HavrHlw1hCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058496, "uuid": "23a62d49-9f31-4bbb-ab4e-631eea3bf573", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058496, "uuid": "bb91da4f-3499-4a3f-974e-7d163ac39b3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058496, "uuid": "c726858d-1ddc-4491-9c2f-fa299bb0d2c2", "value": "e6d4d499cac6b451e48172eb4ac016af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f312b5bb-5922-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639076718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639076718, "uuid": "06879cab-609a-48db-957f-8ea8f990404f", "comment": "Malware payload (Quakbot)", "value": "b33909bab350fc3f680556b5ea714e18", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639076718, "uuid": "45b35743-c28a-49fd-aa03-8970cebc8215", "comment": "Malware payload (Quakbot)", "value": "b525557732a28973a313e95a9152bf32e9b2ccbe873bcb6b3cebd9e9765cf04b", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639076718, "uuid": "bbb871ed-6401-4b59-b149-07c546184453", "comment": "Malware payload (Quakbot)", "value": "d9945a4759f58df53872eea0e043b5482904f83e", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639076718, "uuid": "102b9b20-0523-47c2-8849-621c95e9d34c", "comment": "Malware payload (Quakbot)", "value": "ef15208f891f3bdb5ea18e1f7dadc22d5c080514655cc506ce17cf16ec2444442b49ed77fd6fa8e6bc4967e7effbb8a2", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639076718, "uuid": "0ab05061-6afd-4ed5-bcd0-c81eea9f1e1f", "value": "T1D7240249683CE8CECB1B1432C708BFEB860B506199C27C2EA5C9794D5955EFB7B8C14D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639076718, "uuid": "de68e9cf-eb67-4d4c-a341-c94a3d5c87f6", "value": "3072:IcfEIz6t8weEGc33rk590Du99wpFlUz7o8NXKRlzpG7/UQXIqdtKcmIDYPIZE8D4:IcfEw6R9537k5WSOeME6rGj/m/58DD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639076718, "uuid": "85cd28c4-3ae4-4dab-a1e7-0bc180b3ea44", "value": 211228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639076718, "uuid": "96749509-05fe-464a-b7a9-de57991028a3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639076718, "uuid": "c9c476f8-90c3-418d-8678-995c7c8f38a4", "value": "sw-1161129701.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7dd2a20-5894-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639015657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015657, "uuid": "eeef8e62-1dc4-4c75-917e-463fac970aa9", "comment": "Malware payload (Heodo)", "value": "8ba059c2436bb98836c0b251c608f6a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015657, "uuid": "c8a23b8a-6905-4939-a072-d4fea85eb158", "comment": "Malware payload (Heodo)", "value": "b5f9c5a8b4af1d937bc9e3b187329d5a61e43aa719825ff3f70904c02f293709", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015657, "uuid": "481478a8-dcdd-4ca4-b528-7d945b480723", "comment": "Malware payload (Heodo)", "value": "757f60fa670afdafb536dae6404d0184bd0e9ef8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015657, "uuid": "78f281b8-a48b-4624-b7f0-9b34afe42d09", "comment": "Malware payload (Heodo)", "value": "423b92dc6bb4033947db46ed663d1506b9efad01d07fb83515610f7e059f88e241aac34828ec523811483909332fcc37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015657, "uuid": "36b40f28-3ff2-40a9-b332-565817483e91", "value": "T1CD44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015657, "uuid": "1e87c605-a26d-4e2f-88ec-85c65180c433", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015657, "uuid": "1474f099-6e28-49fb-bf29-04037ebd89c0", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTB/2ypv:6jIG/pjjuLbJLmGshoCUnWTxpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639015657, "uuid": "8b0a16c8-d796-4374-a9cd-5e02dd798432", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639015657, "uuid": "2a19b250-9795-42b9-baaa-9fb14520ecb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015657, "uuid": "97fdc23c-20d9-4dd7-84a1-282787012210", "value": "8ba059c2436bb98836c0b251c608f6a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114da701-58ce-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639040261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040261, "uuid": "5dcda501-652a-4c5c-bd4e-7476591219e8", "comment": "Malware payload (Heodo)", "value": "769f54c9b64e7151534c4a961d082994", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040261, "uuid": "3f9a96c1-e887-4c07-9224-3c1ef88839c9", "comment": "Malware payload (Heodo)", "value": "b637fbc8db97edbcbcf5b9cb861598976a4946f7bdb73f632b089a25e2e75ce4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040261, "uuid": "08ea4d84-80f4-42c6-91f0-0716994d48c5", "comment": "Malware payload (Heodo)", "value": "9b403b4d59a16304e73cd442aa4125c3b52012f0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040261, "uuid": "e3d742ba-d66e-46ef-89e7-b07a8fc6e995", "comment": "Malware payload (Heodo)", "value": "ef812a2e2acdf13d9f2d23adb683e03b0ebc6891e1d7cdb4cc381c11363e7f1b5242d5d533a0d19972b4de62faac3dd8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040261, "uuid": "64f6e355-bde5-4078-a7d9-79ca40963d08", "value": "T1DC93F1CAD6A5DE7EF4E69438E4BBA1B97333C037C0481E42918DDAC8812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040261, "uuid": "f81d8a79-c5f1-44ba-be48-78fac239e136", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3K:psXZ3MYeGt9sLBrGrQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639040261, "uuid": "59ca4c89-d02a-41d1-940c-c107a328d714", "value": 90149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639040261, "uuid": "5ceb13f2-4e0b-402d-a676-65c5861a9e1c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040261, "uuid": "dfc65d7a-3eb4-4815-9ccf-7405daeff9c2", "value": "emotet_e4_b637fbc8db97edbcbcf5b9cb861598976a4946f7bdb73f632b089a25e2e75ce4_2021-12-09__085719580757._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedfce76-58dd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639046968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046968, "uuid": "28c2b7a4-948f-4b20-9083-d29f1e16b9f6", "comment": "Malware payload (Heodo)", "value": "ecf42c7bd334b481d7d82a1e7c626587", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046968, "uuid": "62188c5c-be7a-4bc4-9365-53cc62e77499", "comment": "Malware payload (Heodo)", "value": "b686a2a27d4060e8449649268808f123dd6221556d3e38e515c9f518e607e648", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046968, "uuid": "7d1ded24-43fb-4357-80ff-2ce65c6dc0f4", "comment": "Malware payload (Heodo)", "value": "bc29aba6cf4342a0976f7b19488d17dbd641544b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046968, "uuid": "4321349f-e72e-4c09-9250-3deaf5355047", "comment": "Malware payload (Heodo)", "value": "7c6fa08a3b03c6d0181665fb5403941b51df94e9ff3fc1ad3a127075dc351eac4f3d48aacceb80c110c5ba3791f5de51", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046968, "uuid": "e4148e9e-b80b-48c7-b510-9246227d1d41", "value": "T1919301CAD6A5DE7EF4E69078E4BBA1B96323C037C05C1E42914DCACC812C5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046968, "uuid": "d592081e-a89b-4fce-af15-ac8a6b3ceec7", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3FK:psXZ3MYeGt9sLBrGrQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639046968, "uuid": "04e7c80a-a344-420c-914f-b1bf6e3d2407", "value": 90153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639046968, "uuid": "8b68ec21-e33d-48e3-8749-01d4ecefd9a4", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046968, "uuid": "ece27317-2a84-48b3-bb5b-4d3d22fd2905", "value": "emotet_e4_b686a2a27d4060e8449649268808f123dd6221556d3e38e515c9f518e607e648_2021-12-09__104904449589._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344810f2-5936-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639084988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084988, "uuid": "8e4483dc-1553-46c6-a88a-62a06935408f", "comment": "Malware payload", "value": "48e940d2e1a709ad3c6672d7a09c2993", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084988, "uuid": "e6f28b1f-700d-4c02-ab8a-9a0a2fcde8f9", "comment": "Malware payload", "value": "b7e2110f58b55841828c604815da9539cd24465b1f66e4bed82b5b33370229e3", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084988, "uuid": "89adf6e2-8c5d-49bc-8943-7d6da835deef", "comment": "Malware payload", "value": "46d123c22d3ad668fb7309cdfe2fb715bd8fdf9f", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084988, "uuid": "a1660711-1546-4273-bf41-55306779c4c4", "comment": "Malware payload", "value": "fc5468531998f52457fa6f92f20d080fbfa0d9a5e3401b9b566b32e7fda716fe59e5373201502efeb14587c8400ec112", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084988, "uuid": "2e1ec323-240f-4171-838f-555d2ab753ba", "value": "T10BA4239576E59D0BC37C15386B1EA8D73E03229EB400FA1A929EB13D012B5DE42C7EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084988, "uuid": "62cad5e9-959a-465e-8036-870599e97798", "value": "12288:QbZao+zcm0lTvLeK60sI+B/VONLb15i3amcYVspp3waIrWOOt5i:QBTvLeKoIK/VeLb3i3a8Vk9Bt5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639084988, "uuid": "59b07b56-e52e-465a-b8e8-f8e6a00d9d3f", "value": 484013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639084988, "uuid": "c7752580-780b-4082-a5c1-4dfd01e8a9fe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084988, "uuid": "c8be2a70-4267-4ff8-aab0-29888ed7bc84", "value": "ReservationDetails-750012735-Dec-08.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab91132a-58f2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639055982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055982, "uuid": "5c0cf72b-0bbe-415e-b472-e3b8311585d7", "comment": "Malware payload (Quakbot)", "value": "6de046c8baf2d1bbcf2a34876b4b4d5b", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055982, "uuid": "2b28bae1-ed13-439f-8a44-4d985811dfd6", "comment": "Malware payload (Quakbot)", "value": "b8b328270f7a8d71b800a386402cff6784035057fcf1229bc1a0fd633cd1fba6", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055982, "uuid": "dfa0e8b4-d136-4cfc-ac78-f0c61635a02c", "comment": "Malware payload (Quakbot)", "value": "87e5906751cd29abc86a2f3e95fde43ac55d3414", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055982, "uuid": "c992c35a-c677-4427-b129-024a54231a39", "comment": "Malware payload (Quakbot)", "value": "f8b35f4b8167a992f236770ecc6bc354e844b993528dac471d6c2cd1dac1b5244f78e7a0a2d1779f45b97c1a80b9c7a5", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055982, "uuid": "086e8e12-d0ca-4ce5-86e5-3650bd266c6a", "value": "T1CDA3BF2AB219900AC217543C921755B0E0D4BFA2E70CA5EB68D3AF533F3D9D35BBE845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055982, "uuid": "fc60129a-3f1f-4240-973b-6470a03abd2f", "value": "1536:wTj+NHtWI81QLBDcKeQ0gtA/lJxrbRf49SOpUC3bjZRLqQzR:wTj+NG1yVcKeiA/R/DUUi/zLqQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639055982, "uuid": "a3760d38-068c-4ac2-b822-bcc3b5504b69", "value": 98705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639055982, "uuid": "b57417de-cfa6-4a6c-acb7-6a0bd927d94d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055982, "uuid": "f98fda56-08a6-4433-b436-9455a782061f", "value": "j-2361542.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3ed21b-5913-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639070053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070053, "uuid": "9e152e98-9bb5-4098-8de1-8d6b71b835e7", "comment": "Malware payload", "value": "8b1f124962ddab7f9a28763fa1640021", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070053, "uuid": "f5e0363f-f8cd-4460-85cd-284955250886", "comment": "Malware payload", "value": "b8fdda162fe769a0cc4aa5f2bc880c05eca1ee2643cfb72c22fb2be91f4a6381", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070053, "uuid": "602f6329-9135-4b95-a68e-024cc2df993e", "comment": "Malware payload", "value": "d2eb78b4bf80986d9ca10a946f818954739f8c45", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070053, "uuid": "c534bc48-fe1c-4d56-99c1-c214d0790910", "comment": "Malware payload", "value": "deac3b16a72fb663b56431c873703659e91b84f9e5c429f432f63bdc343702135d2fa2830cbc1b2de6e8cc18c625ec65", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639070053, "uuid": "f3e7c0f1-b247-40db-a12e-08565432135c", "value": "T1B1330102BAFBFC5E54B20EE8880D39301845799E45F42D9E45B9B8F5B920ACD1B8DC3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639070053, "uuid": "3e075651-389a-45a8-a9a4-e11ac0223c11", "value": "768:1ct6B4ZIQjRH5p0ELiCo9vvpONjEhWOOvaDjBb3ErJaCniqa2sX8LFDOgBCJ94pU:1vBj8RziC2XpWjVaZb3m48im08QFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639070053, "uuid": "fe89d627-829f-4e5f-933f-4c1049fa425e", "value": 52563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639070053, "uuid": "fad57689-53bc-440b-9f99-d2ce5337ab1b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639070053, "uuid": "f8b51ce4-d3d5-46e7-9307-b9868a1d4306", "value": "cumdolorumnatus.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70abab16-5918-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639072204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072204, "uuid": "d28acfa7-3e1d-4f7f-bbe4-f52c946e8136", "comment": "Malware payload (Mirai)", "value": "784eb9a9be7707ea6f27a633946def60", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072204, "uuid": "c19bc91f-b5fd-411c-8cce-b4d4578e71a7", "comment": "Malware payload (Mirai)", "value": "b941a4d4e97a71d99f05ed659891b0813a9c86e89aa2ec9081627e4a2ea86c87", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072204, "uuid": "30d72bc3-b2ee-4c66-ab04-628b6a27cb1d", "comment": "Malware payload (Mirai)", "value": "77f240f57dbdc11cb3af49490b64b92b9c76c09c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072204, "uuid": "f12bf838-d6e9-4bc8-b4c8-3667d7597adb", "comment": "Malware payload (Mirai)", "value": "4be9469fd7df2e907e753afdc094aa6c1eb3031d2a2136f10476b7beb497e970e6ce692ceddfc64f35283b6bee92f4ed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072204, "uuid": "f20df8e1-6f42-4582-94a8-456288e85fb8", "value": "T19733F116C7DE84A6CE200E77F1BF5145B47FA7BCC0A6768A03AC98907DDB2C676B4112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072204, "uuid": "b9cb980e-1139-4830-97b0-99008cda4e25", "value": "1536:TAPtoKBLM7wUJSZsd+CL8r1/t4iBpYu68JFJY:TAPtcPLIV4iBpYu68JFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639072204, "uuid": "572909f2-4a57-4d03-9af8-a92881cb0b9d", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639072204, "uuid": "fcb37de4-03e2-4b7f-9a66-430d7b1096ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072204, "uuid": "c782530f-cf73-47c2-96ff-a5496b897eea", "value": "trynagetmybinsufucker98575.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5c09cf-58a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639023640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639023640, "uuid": "d61e396b-7eba-472c-b5e2-db29b69e89b7", "comment": "Malware payload (Formbook)", "value": "ca0d7b52d537773db4598a25fdf5cf22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639023640, "uuid": "791c40d0-f9b5-4ea4-b72c-7fb2c5bde809", "comment": "Malware payload (Formbook)", "value": "b9829a5660b2dcf188de5595741b42380f091c30bb3be299e131b61171d7b513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639023640, "uuid": "fd131616-8ae2-451a-ad5f-56bc0be68c30", "comment": "Malware payload (Formbook)", "value": "f971b4ac64190312edfd3830dd40a257316c7e8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639023640, "uuid": "eed573d1-7a6d-4c35-90e9-7f02fa7591ee", "comment": "Malware payload (Formbook)", "value": "69af2d2a20cc0a3e57787d07d444d3d48b8f40da872e2444e2c9ea51dbcaffc892d061357a4f16c825bc4f9066441fd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639023640, "uuid": "35c4daca-7ae2-490b-9282-c64ceb963872", "value": "T11AB4F1D2CD801C83DD380275A0738E554A9B3D659A7835317BE83BBA69B3D0B9A37713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639023640, "uuid": "1678eab6-5cac-4b6a-9969-00a1af4b9dcd", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639023640, "uuid": "da3a51ba-a198-4903-a69b-a9a9de708c3e", "value": "12288:AjbEhStY6jsFnj9yYQf9gyGqVYW9WF9+m8BCLxRo:AjbWMjsVj9yYQf9txVYWY6BCtRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639023640, "uuid": "6dd7b375-bdd7-43c2-9b70-c3bd773cd349", "value": 520851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639023640, "uuid": "20a5cd9d-d8e7-40e1-9d00-af47dff40d36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639023640, "uuid": "04e715a8-76e9-4c00-a326-b0d5d9b5b67d", "value": "Bill of Lading & Shipping Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a59bb6-58c3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639035843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035843, "uuid": "12a4bc66-10cf-4b01-9132-f90c3442595d", "comment": "Malware payload (Formbook)", "value": "35cba6887bbfec435d5756c7cc594e46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035843, "uuid": "17f1635a-a966-4f62-bf49-ca8e03168e58", "comment": "Malware payload (Formbook)", "value": "b9899f8fb99acdf4315b884d1289bab11aa6d7935e3b3d4744898c4aa88f8eaf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035843, "uuid": "6b4e3443-4e26-4c4d-b74c-d23be37b0b41", "comment": "Malware payload (Formbook)", "value": "091cf75c18fe06b74e0ab9df38bac6319046b35e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035843, "uuid": "871aeb7c-94f8-4d3d-89de-3bae6cf19431", "comment": "Malware payload (Formbook)", "value": "e38fa75b1fb0ce8102fa5c6008ac1998fa14d63689576b710f709024f2ba08e13e54d18e60078b32ab12893eb0c39f9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035843, "uuid": "6385940a-f4f0-47cc-8800-08e4d63f9a25", "value": "T17445221E29A0D16FD0ADDBF5CB57C0918A7EF0063DA6F2BA698520FE7B346864403743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035843, "uuid": "dff19ee5-276c-4441-99fc-ab8420fac481", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035843, "uuid": "e635d1f4-5476-4470-a009-71df110696fe", "value": "24576:vIKjy/SYCpskWxYCTBnk0kvzAtPZWKFN3KzlC9hY:fjAS0k/knk0kv8qKFwZuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639035843, "uuid": "8fa4eae6-d0fd-407b-b0e2-a59c2335064e", "value": 1193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639035843, "uuid": "1281856d-36f4-4192-b972-ad0dd170558c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035843, "uuid": "86ba8d42-a806-4230-a248-441df7343b92", "value": "35cba6887bbfec435d5756c7cc594e46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1050bb80-58de-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639047132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047132, "uuid": "3e377dcd-bb48-4557-bd40-313c307165c8", "comment": "Malware payload (Heodo)", "value": "531995d08ef9c802b619fb675a4a1e7d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047132, "uuid": "b1e0b152-18c4-4975-a22a-a83211f794f7", "comment": "Malware payload (Heodo)", "value": "ba758c64519be23b5abe7991b71cdcece30525f14e225f2fa07bbffdf406e539", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047132, "uuid": "3dd2c574-bb99-447e-88e1-6f8364c857d4", "comment": "Malware payload (Heodo)", "value": "44aed6c8dc1cfaa74e92ed2340a0857f3d7ca945", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047132, "uuid": "ff39f0f4-d6a3-4237-9eae-894766abe748", "comment": "Malware payload (Heodo)", "value": "d5548ce485f1fb9bc47950c04fb0085ea0fabc997a25c52bd55ecbfdfd98a30338a6fbcd5e4933ebcbd3010bab89e0a1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047132, "uuid": "d6d5fab7-8046-4d96-98b0-3179be66b39f", "value": "T156E34B01F78381F7DC960CF219B6B22ECB7D1E037034EE9547980F57ADB6646A2A990D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047132, "uuid": "126b96ec-0b0e-4908-9b48-e7fa91617ec4", "value": "3072:Iw2rPPBHaDJRCP5otSUrUXk4bAtcryyYbQ0ngzJKYF5Q:ArPPyJgPuU3bAZFn8F5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639047132, "uuid": "6ea51fcc-7cac-41b9-babf-0a12168da376", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639047132, "uuid": "4ae54504-2424-4b66-b53f-b8cc01d02418", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047132, "uuid": "eb66963d-bfdc-4f0b-908d-277226448848", "value": "ba758c64519be23b5abe7991b71cdcece30525f14e225f2fa07bbffdf406e539.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da50951f-58c2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639035445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035445, "uuid": "a424cd1a-8f9e-4d09-8851-019fa787310c", "comment": "Malware payload (Formbook)", "value": "45db1afb368ce2ba3d6da069e08e2856", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035445, "uuid": "24559e7a-2dc8-4aa6-89cf-aa28692da528", "comment": "Malware payload (Formbook)", "value": "baa6c0d95345936cfa15289e60aebd590fcea005d546d40e6e6933657508a277", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035445, "uuid": "3f341ab1-55ea-458c-bf05-0f502c319f59", "comment": "Malware payload (Formbook)", "value": "b6ee861c86ebec1b338238d2ebbd69b1bf8f5efe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035445, "uuid": "8f8a1add-5de1-4207-8b79-15c053875d1d", "comment": "Malware payload (Formbook)", "value": "4103b47673d930ef25c126f7b0d00facf97ff5e9261462cbb45fbc3cd41953f221cca8000a4579b1d185fb8ac6f9164d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035445, "uuid": "d3cf7309-0449-4742-9abf-7d82e08543f8", "value": "T12735F121A96B884CE86331F50F5A79820FAFAC78D401861A377EB259553E757CF263CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035445, "uuid": "080c4b93-ebe5-4ba2-a25c-d7404462521a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035445, "uuid": "898a2384-e294-420a-87bd-8b835048a2c7", "value": "24576:AEDxuzBB3r7i5tm9MYnlmi45qCzXaNo9YH3/I+Gw6:D6+kMYnsi459eoiHPsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639035445, "uuid": "7d38263d-5fa6-4f59-9a72-a6438f4c4663", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639035445, "uuid": "021f87aa-ff00-4f42-862c-6e218d7221f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035445, "uuid": "9d6e045b-57ec-49e8-b3f8-b5025b0ecb51", "value": "45db1afb368ce2ba3d6da069e08e2856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ade7ea-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639054383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054383, "uuid": "27310583-6617-41c0-a3f2-5faf791416e3", "comment": "Malware payload", "value": "a3e070dd8e9294a786ad537d91b57f31", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054383, "uuid": "d5aaec12-4440-49e1-884d-59a6221a001e", "comment": "Malware payload", "value": "baccd3d2cd02286e08b6739dfc786f67bd64b5da6bfca6ba93ddf21f8e9d8359", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054383, "uuid": "a24d9657-a382-4952-a2aa-b93d8423fc8e", "comment": "Malware payload", "value": "1d1002dfb43f870ef2c6697e2271a0e5ec4dbcbb", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054383, "uuid": "61d19399-c22a-41fa-8ecf-b216b5271d8e", "comment": "Malware payload", "value": "5a75f9bc78c7ad1c065e491d89318bff4e706571db6cad168328fa03e6ed663be0038b578f2e207549d8d8f45df1d6a4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054383, "uuid": "82d927bd-fbdf-4511-a243-b12e6b38c4b9", "value": "T15F15AFA6D1E01C36C0AF11B9AC4BAFE455277E203E289C461FF83D8D8F367A1741956B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054383, "uuid": "8c9f69e7-d747-46fb-bdcd-4fe3e42f62bc", "value": "939d8f743f99c748d946de3c81bddd31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054383, "uuid": "549078a4-cbe7-4b43-ae2d-6876d95a6a63", "value": "24576:muRQsAJcBdZF0bE25chN+QIe3c13TOqamxypnUXfGe:mL9JO08b+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054383, "uuid": "d70ae205-164d-4e68-a71a-13e7c72c8bfe", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054383, "uuid": "14f4961e-56a6-478b-a64a-b0dc439571db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054383, "uuid": "82d798f8-d7fc-4b6a-9ccc-e5b87b6ded06", "value": "\u0625\u064a\u0635\u0627\u0644 \u0645\u0633\u062a\u0646\u062f \u0627\u0644\u0634\u062d\u0646 DHL_119040 ,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67684aac-58fc-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1639060163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060163, "uuid": "19f28abe-5046-460f-baad-c62c080b8230", "comment": "Malware payload (IcedID)", "value": "71c8eb081c33fd6b2c10effa92154a18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Stolen_Images_Evidence", "colour": "#9759D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060163, "uuid": "a484a4dc-611d-4688-b839-872a05483108", "comment": "Malware payload (IcedID)", "value": "baeb13eea3a71cfaba9d20ef373dcea69cf31f2ec21f45b83f29f699330cb3e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Stolen_Images_Evidence", "colour": "#9759D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060163, "uuid": "ea293455-6b6d-4384-998e-4d901f3c7b6d", "comment": "Malware payload (IcedID)", "value": "8222ed4fcac2c7408e7fbb748af1752e72bb9b01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Stolen_Images_Evidence", "colour": "#9759D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060163, "uuid": "aa9d2c07-8f20-4562-9b49-208949f69dd2", "comment": "Malware payload (IcedID)", "value": "f8ccb0c0367014962b6675704efa418e3ed196c051aba4c1c7998d14469df500d7850ef1d2145cea29184a2687ad576e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Stolen_Images_Evidence", "colour": "#9759D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060163, "uuid": "c9bfbc5b-c329-483a-bfb9-dae8d55f7824", "value": "T1AF549E56F29610B9E06BC13CC6534A61B7B67C505B22FEEF2660A2353E23BD05E3E750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060163, "uuid": "2a161449-7bc2-4903-9b08-edad028cb047", "value": "250afdf6e481982814b553e7d757233c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060163, "uuid": "77db2130-6b10-4083-9ff5-89b9bd01d1d8", "value": "6144:zNd2jNirWCeCVLdWLNd+R/6f1NAdcDvCz8Mo0y8yV:r2jNiaCHozUG7AtE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639060163, "uuid": "175227d0-5f42-4fcc-8287-eee828809bc5", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639060163, "uuid": "0ecb12ec-4da8-4348-ae8e-44995efee4dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060163, "uuid": "2a7b3617-8883-4435-9684-ef376891e93a", "value": "data.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808bcdef-58df-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639047749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047749, "uuid": "a9b8ece0-c151-43e9-9e52-300682cf8bea", "comment": "Malware payload (Formbook)", "value": "6942f6a1a94f1e5d294eaea343edac0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047749, "uuid": "4c455eaf-f5c5-4041-aae1-a21acfd997a6", "comment": "Malware payload (Formbook)", "value": "bb7b1d4809ebb37c43cf7f27a50068990ed4a0d26fca6c03592bda0e0868bdd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047749, "uuid": "f0bcd904-ecb1-4338-857b-8d3dd99b378b", "comment": "Malware payload (Formbook)", "value": "8db0eedb52d00a6a61cfbdf994009b66ab428de1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047749, "uuid": "80096168-d0b2-412a-915f-efe35a3cdd8e", "comment": "Malware payload (Formbook)", "value": "20457d5c32745c7bc09b96e81c657330685b1300ef89b413964355e3635ed142fbd26b9bdcd6b41bd972ea1d7cd08dcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047749, "uuid": "d84c7896-aaf2-471a-931f-0ed3295090c6", "value": "T1D66422927D964EF3CAA055B224B7E77AC3345AE80123F227AFA48F7F09073534558587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047749, "uuid": "80ebebfb-2894-4d3d-bbfd-d44162dacdd2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047749, "uuid": "401c026d-e0b7-436b-8e7c-5bcf05c012bb", "value": "6144:rGiT3f21RkkwwpfZXWvziVPK6S7oPQsVjBKgC4yKe0qRj:Ov7wwN1W7iVPrPQerTcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639047749, "uuid": "b7e356f8-af2b-42b6-8ad7-cfe7fcff69f1", "value": 314247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639047749, "uuid": "be3d4528-6a37-43dc-ba99-0635a81081c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047749, "uuid": "2011a192-55f5-4c45-b61b-2542d0df57a3", "value": "000-52_20211208_C_BG_214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d39c28f-58cd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639039879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039879, "uuid": "9efd89ad-35b0-438f-b69b-edb09d2870a2", "comment": "Malware payload (Heodo)", "value": "c9eee2e2b81d6380875bdb542bd8730f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039879, "uuid": "26d68690-1202-450f-a640-335559e7cd7b", "comment": "Malware payload (Heodo)", "value": "bbf2c0adc0daeed0d3a4f362e12631d3c5659695a8549e4035b7c9baf8cbe2ba", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039879, "uuid": "058a3287-0c32-4748-bc59-671d03071bf2", "comment": "Malware payload (Heodo)", "value": "f9cd549460b2460723e5579bd5a5bbfcec435979", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039879, "uuid": "51e235c5-9257-4214-b221-3ff58dc7be07", "comment": "Malware payload (Heodo)", "value": "5cff4b0f4c04e1edc0e61aa37950a90a6b1f884e24f0395717d974eec2bbf9f2ea3e374eebed44c2f247a762d3233826", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039879, "uuid": "5e5b1d76-a5a8-4abd-a3d9-035ccbca8d08", "value": "T1C69301DAD6A5DE7EE4EAD038E4BBA1B97333C037C0481D82914DCAC8812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039879, "uuid": "9925489d-89fb-4b96-b241-fe41a4bcb634", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3fQb:psXZ3MYeGt9sLBrGrQfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639039879, "uuid": "f8d8b09a-0db8-460d-949f-117d1425de1b", "value": 90151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639039879, "uuid": "93e8c465-66a1-49b2-a432-237a9a730415", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039879, "uuid": "2bbc3e41-e76c-495d-8fd7-cc404fc98bc7", "value": "emotet_e4_bbf2c0adc0daeed0d3a4f362e12631d3c5659695a8549e4035b7c9baf8cbe2ba_2021-12-09__085058102978._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d28f495-58f6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639057649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057649, "uuid": "53a061e4-e064-4e14-bfb3-b2d1e9432ccd", "comment": "Malware payload (Heodo)", "value": "649810900d6d5b313a63e75d4d38863c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057649, "uuid": "ec24dd68-b43b-4ca3-831a-2b5d8471c1c7", "comment": "Malware payload (Heodo)", "value": "bc3805e4e77eeded9cff3f13d29e65a90c1be2e2961b7260fc638783fc5cda7c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057649, "uuid": "3e1e2861-89ce-42ee-a6f4-85d799800f6e", "comment": "Malware payload (Heodo)", "value": "4280afb53d4f2348792431a1d5f6916c9e25abbe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057649, "uuid": "21f02b9b-0b73-4540-8d0d-ca5eb64e6648", "comment": "Malware payload (Heodo)", "value": "bbbd26635209fb580168192bafb7041c3b993df340ddccae55692e693492c0a2c63003c0f97aedaf6b19cf98418b313d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057649, "uuid": "acede131-eea9-49d0-83ff-2d8571655d32", "value": "T16444BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057649, "uuid": "ddc218a9-2735-492d-9191-ddd7b41d36df", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057649, "uuid": "702151a5-95bd-41e9-acde-90b3c554c9a1", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBl2ypv:6jIG/pjjuLbJLmGshoCUnWTfpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639057649, "uuid": "c884a9b9-1e14-40c7-93bd-c2c8b3c32fb9", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639057649, "uuid": "45ec8fb0-8216-417c-89e9-ae10052531bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057649, "uuid": "abc8868f-d671-4f19-a2ae-6f8fcee5b775", "value": "DUnHW7HnJVY527FakNsuW.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03340aa2-5902-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639062572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062572, "uuid": "0406d000-73fe-45b3-9fcf-7446fb5e6cc5", "comment": "Malware payload (Mirai)", "value": "3d7c4043fa5cdb9fb83f13b3357eec11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062572, "uuid": "5d58748f-124d-4ebe-8dd2-d92da3986c21", "comment": "Malware payload (Mirai)", "value": "bc8176aadff64c159ef27cb15eda69653d413a33090ab53855154cc096be6e34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062572, "uuid": "57093ebd-213b-4676-9981-eb9a12de7beb", "comment": "Malware payload (Mirai)", "value": "c10a920330d6325186c6b0bf9739ffeecac4f446", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062572, "uuid": "08cdbcf1-b261-466f-b4be-6663c2c2058d", "comment": "Malware payload (Mirai)", "value": "de16cec35d31ac0c7ba5f0459667e0f31a891b776d2578f4ca8d171c8a8b085e93305433860d411b6ed4970049c1bd0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062572, "uuid": "260855aa-8c8d-4513-93c2-53725ab3c4af", "value": "T1C5C2E184D3042F9DFFDFBCB45E2690C47B2B1B5F974754A37278552365A2D2B5800AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062572, "uuid": "1d346c8c-72d8-49a9-b924-3e007eaae69e", "value": "768:BUbgeS1f8Dnz+AHyRas6JAshPV/94uVcqgw09z:BUbfaAQGAiN/94u+qgw09z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639062572, "uuid": "e240c1a0-e8dd-4dac-8e11-f07d47eae986", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639062572, "uuid": "5d2802d4-bcff-4271-a52a-a47c90bc3acc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062572, "uuid": "5d5fe969-98df-4e3a-a3ed-72445f6f87e1", "value": "3d7c4043fa5cdb9fb83f13b3357eec11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591bf008-58bc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639032651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032651, "uuid": "23e74122-d73d-4d18-ae94-bdf2eb59595d", "comment": "Malware payload (Vjw0rm)", "value": "ed6574999b2277dae2c322d08de349f1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032651, "uuid": "9df1a150-cb03-433e-81aa-1e055679e9e4", "comment": "Malware payload (Vjw0rm)", "value": "bd7de167ffee33b3abca17c579ca2b38c9c46b02d7e05da4cc3b0362d9331b1a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032651, "uuid": "75477ace-e552-4cc4-b01f-13ed39083254", "comment": "Malware payload (Vjw0rm)", "value": "bf71edb9c1c324c4534acdd46395b5ab67f268d0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032651, "uuid": "544ad4e8-9d4a-4534-9090-ba62bc219a61", "comment": "Malware payload (Vjw0rm)", "value": "0cde2f9f3f187ced5b4d4ed883afdce2bd5f38b79868cf8b92c9be717c81bf7039834ddb90045b2a453f2a007a7d993e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032651, "uuid": "c2f0a676-07d8-496f-b272-6d77685b096a", "value": "T15C94C060ABC01E64EA888813D0FF550E52F7471AF912B1CCD7A275272AEFE895B07D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032651, "uuid": "0163653f-43a4-41f6-b676-3656fdfb88e3", "value": "6144:Fp/dQMSn5z3o+qPzwwgpdsEUsGcmS3JLPa4Nua+Juk6VP2u2G4Mx8W+BZIFhA0uz:qUmpdpUslr3Jm4+Juk5uSMSZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032651, "uuid": "dfc5991b-88ca-4163-a3f8-6781afa541e0", "value": 425566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032651, "uuid": "01e35afc-4ede-435f-a889-9cf9c95939d2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032651, "uuid": "f4d69fa3-b038-4c75-8d78-d34e51614ae3", "value": "PAYMENT_PO78893.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e784d457-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639054365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054365, "uuid": "4a5d125d-e6ba-4c3d-9ba4-341429623f77", "comment": "Malware payload (AgentTesla)", "value": "0207ed178548424d63c8e9625707ca9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054365, "uuid": "73d3fda8-07e7-497a-8d53-d539cabf4a13", "comment": "Malware payload (AgentTesla)", "value": "bd85af6f1cffc52bcec61cca29b8c5521d8d64052c4628622dbbd1f363ea3f56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054365, "uuid": "9539eb61-009c-4197-b9d4-a22e6719ec0d", "comment": "Malware payload (AgentTesla)", "value": "dced2b015c0e8dceeba416e5220f9d33847c1e74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054365, "uuid": "28eae427-fdad-4b6e-b692-8642a3531ab2", "comment": "Malware payload (AgentTesla)", "value": "ef9344b48edea123b9f8ec854d278cfcfa3a9a2ee8714ffc76501969da10f7f395fe4185308110f9161d0a6ee5ba4ab0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054365, "uuid": "ed6431b7-c843-4e7d-bbeb-a456b1393432", "value": "T18545131A29F0A5A7D5BD8FF2C757C09186BCF0062D22F37A5DD251AD67389C9C912B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054365, "uuid": "6967c8b8-89c5-42ac-97fd-b9dc2fba8822", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054365, "uuid": "fec17957-7b69-457b-acbe-c65acb67cc34", "value": "24576:gIKjy/SYCpsGeB43Sj/KqHReWsXhKJJLlVumpmhv3acPITMuxLzrBI:ejASkPB43SuqHRcUBlVu8msRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054365, "uuid": "fe6c7e82-1f1b-437a-a345-8ae41a2bc7dc", "value": 1260032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054365, "uuid": "58e27dd5-0430-4f07-8ec1-f4ea0424778f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054365, "uuid": "5f521a5c-ec38-4f52-8456-7e956d936896", "value": "DHL Documentos De Expedicao Originais.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a815653f-58d3-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639042662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042662, "uuid": "de1aaf31-8c5f-4793-b108-038151986a0e", "comment": "Malware payload (AgentTesla)", "value": "e44d5090ca4aecdf926911a4f13d109a", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042662, "uuid": "b1a107c5-92a8-4d71-8aa9-62bc40f5e4e7", "comment": "Malware payload (AgentTesla)", "value": "bdb96da743e4455e7102befb0ace345c123a842cff68ff6e261b48c61117a935", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042662, "uuid": "ef0814d4-95a7-4341-a410-8e0e099bb41a", "comment": "Malware payload (AgentTesla)", "value": "4eb1656bc86469e3c5a83270dfe02db0fff4a72c", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042662, "uuid": "39230e45-93ad-4daa-b437-d93d259f7b65", "comment": "Malware payload (AgentTesla)", "value": "365d9ee3afbe97c50d8519795e698bb2cf3c8da21bfc8c72aeaf982de85045e15da6009002b968f2018d0841bd04cf90", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042662, "uuid": "c9293580-ad5b-433d-b909-b632231cf845", "value": "T12D2533A7DE0F7789BF88047EF3F58E46C48661A96B9C17E98D4D48846EF104106EF8D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042662, "uuid": "1e714fbe-a8d7-4fa7-940e-62f04115eee2", "value": "24576:R2NU4QECekmeWkBe5FuckIoKneEhuCG6FCF/:ReU4FCedkBqMcR7neIuvdF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639042662, "uuid": "ab92a0c5-a88f-4976-a932-ae385256daf6", "value": 1047511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639042662, "uuid": "7cfb04e4-ad17-4a0d-94c6-a40bc3a5e4b2", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042662, "uuid": "eb43e522-0566-47ed-bca9-f2600d916932", "value": "FedEx Billing invoice no. 380454605.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177ff4f4-5921-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639075920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639075920, "uuid": "7b696c8c-a01c-44ff-9521-9f84e9d9531d", "comment": "Malware payload (AgentTesla)", "value": "8b0d6e46a45b3e4db4f944db20253f3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639075920, "uuid": "5c3e0814-aa35-4467-885c-872771aca2e3", "comment": "Malware payload (AgentTesla)", "value": "be32df490bd257c36511d039fa680613e1cc735635fb3cb26032819cc6897867", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639075920, "uuid": "0b4dc831-5b59-4b35-ba9c-e775a693bef6", "comment": "Malware payload (AgentTesla)", "value": "ce66e96e4a76357fa44f6bae3154a89fe55703bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639075920, "uuid": "b2f27efb-bf5e-41f1-8ab3-e558bfac8063", "comment": "Malware payload (AgentTesla)", "value": "04bf5e766d9195e381f6ec084c741cb543168323b5dc1923d9ce43d4e49deb489713ffd451f7a97b9ee5cd96c684c5a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639075920, "uuid": "465b86b1-5449-48ee-b58e-0958087089e0", "value": "T18EC4AE2C26C7D6DCF83ED7B43AB4609803F4BCF5E603E59EF895315B6973A506A22121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639075920, "uuid": "03a54bff-5957-434d-8729-2e210e7d4f2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639075920, "uuid": "c48ac5f4-bfd9-476b-a7f8-9548d39ecb16", "value": "12288:8HN0wOGsGjLhW6En7TVCxuRyxPGigFRsTJY4BpK:dwOGsGjLbEn/VCxBxPDgrsFBpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639075920, "uuid": "668f95ed-0b7c-40f3-bc4f-a76e0b35d793", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639075920, "uuid": "7e22b925-5b91-4cf2-91f7-29444558442c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639075920, "uuid": "0cd32e22-51cb-4755-9e60-13f63f11671d", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed366331-58c8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639038053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038053, "uuid": "6ffd8e89-112f-4559-8b87-196b3d3e5ad4", "comment": "Malware payload (Formbook)", "value": "d7122cdaeccec52ebf5e5a2606a6e407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038053, "uuid": "06fc79eb-39e6-499c-b311-4327c2498f68", "comment": "Malware payload (Formbook)", "value": "bf4e018e1442fb7815901e53bccc699ee5634e2fcc3ba73327e123ae3d89a65b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038053, "uuid": "387c7192-43e3-4603-a236-5b8c8d6a4448", "comment": "Malware payload (Formbook)", "value": "a6df9888a58bf5bf2c222279b1ba324e0e821029", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038053, "uuid": "5c32cc47-d829-4239-bd04-a11ce8bd3932", "comment": "Malware payload (Formbook)", "value": "8682a8cc4efabfb097f9f173da74c7d533fa44702cd4b76ffbc96b170a46fe61fd114e9d39294be13a8274beb68848d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038053, "uuid": "ac2a821b-b78b-4c58-9619-cba62bbfcde6", "value": "T1D735F020AA67941CE85736F04F167D960E5B8DBEC5029A0623BEF269053E757CF223DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038053, "uuid": "58d59cda-01eb-4c9a-9af5-8ee6ce76ad09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038053, "uuid": "39413775-4b94-4937-8a14-9559d0e9103a", "value": "24576:Z7BE9nYc6svyXqIXcj/lGApmwcY4jOhbesvpwLXd:Z7BE9Yc5vyBXDCmxY/dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038053, "uuid": "84b237f0-e0f8-4767-80ef-d43be32c8868", "value": 1072128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038053, "uuid": "dd9f8192-2ff7-483b-b0da-4b99bb929339", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038053, "uuid": "cce4dfbe-b6f7-4bec-b781-d46f4df00029", "value": "PO21120008.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6986a0-58eb-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639053116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053116, "uuid": "b599fa17-4145-4c89-a758-954868a16b6c", "comment": "Malware payload (DCRat)", "value": "b3875e42a0c202657fc69ad2f1072310", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053116, "uuid": "39d36daa-1f9d-4509-9127-ec0d57fdc40b", "comment": "Malware payload (DCRat)", "value": "c012a4552eb9f478347971e30c7fa675561031cfbaefb79f795a9ba7c385bd54", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053116, "uuid": "da5cbd75-4ffd-4563-84b7-5301b89a91b6", "comment": "Malware payload (DCRat)", "value": "4c59a82aada42d99522676efdf6186b01c830c36", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053116, "uuid": "d49fe029-a564-4731-82b7-ccdf9105be49", "comment": "Malware payload (DCRat)", "value": "c2d90c7b871383912fc3818996a88e62e71d04afe7b930725049c47e353039cad44af4ec196a6f622994b99c97cbdd3d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053116, "uuid": "1818f53c-7158-46a1-abdc-f73334997882", "value": "T17CD5DF113A44CE13D229163AC9FF805447ECED556B67DB2A7EAB336C66013A75E0E0CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053116, "uuid": "ab1391f4-b3f2-4c24-8c78-6cc43abcc9c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053116, "uuid": "1c8928f6-9f84-42f0-9f68-94351c327d82", "value": "49152:YLhtOAfqZOGI14XzICwdFAJzbFn+xzTwwbW1CvxNZzj3B+kAxQw:Yl8OqEERwdsn+5S1CFzj3BHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053116, "uuid": "cc331767-e96c-4d75-a6a3-d1318db66276", "value": 2786304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053116, "uuid": "db16e60c-7a05-4ea0-8b55-e5a71ca5b208", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053116, "uuid": "b4192e0e-d655-4ed4-8320-97a10ba5aba8", "value": "b3875e42a0c202657fc69ad2f1072310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016195a5-58ed-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639053549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053549, "uuid": "d64ccffc-8f78-4e08-a8ac-9b7670449e74", "comment": "Malware payload (AgentTesla)", "value": "e9add2666c66f8ffde4cda952eb46f19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053549, "uuid": "e7828c93-af26-44ec-9d0b-e6a24cfc8ded", "comment": "Malware payload (AgentTesla)", "value": "c0261d5cce3544e89142136698d198cfc78ba86ebf684205ae865f12d973128a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053549, "uuid": "296e9908-4e37-4988-a243-35e164eb8a75", "comment": "Malware payload (AgentTesla)", "value": "6a692c221836193ec3ba2ecb089fdea9f6ad9cd4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053549, "uuid": "bb111224-cadd-4928-bdb5-1aa9d35c6fee", "comment": "Malware payload (AgentTesla)", "value": "b0efca1b785e3c01689f7cb133ece28e2f9f2b1b8a24739c56ce462bf39a5672e781908a36c60180306dfa876512f6c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053549, "uuid": "01d08b91-a7ad-4be8-b949-344ffee7436d", "value": "T19A350124997B801CD41B35F81F16BC921E6BDE7AD4029A1A277EF225163D607CF22BCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053549, "uuid": "1be82485-3cbf-43e0-aafd-f13633a2b102", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053549, "uuid": "749b3cbf-5880-42b9-a5de-61013cc04685", "value": "24576:N+0mXvhq5iZesO2/cx8SmJU4FLdBIhQ6ejvAXj:456iZ02/c+9ZLdahQ/jkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053549, "uuid": "c6f3f2dc-0941-481d-9d15-cfa7b33bace7", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053549, "uuid": "0e803873-89f1-4e36-b108-38be17a9961b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053549, "uuid": "619069a9-1980-4f71-b09e-2b9ab5896e39", "value": "Scan09-12-21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7726bc22-590d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639067491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067491, "uuid": "6a228c8a-ea16-4e20-9baf-833b902bc797", "comment": "Malware payload (Formbook)", "value": "62533e696b6d0b88adc8f975630079c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067491, "uuid": "2d5bf794-9500-4d40-bbe5-998f95dbd8c3", "comment": "Malware payload (Formbook)", "value": "c07d31aae9f9676664b312e521c8bf0e22e08262d5b531b7010069f844100d3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067491, "uuid": "82319ece-b16a-463b-8d44-517e8c4e2002", "comment": "Malware payload (Formbook)", "value": "d750759e8d4de9e52a9c1de95565308b2e0e5426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067491, "uuid": "39921432-f729-4cfc-9f19-c87d61be4a5b", "comment": "Malware payload (Formbook)", "value": "628d50ae4749b164029694de8eb3f9118655fc01c74c45471a756fb9d97d02ea90c44a2d38dcfc0200b31b9c61ffc17f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067491, "uuid": "3888a894-e3cf-4a04-ad78-81bf02c00139", "value": "T15264234AAAC25AF7DB644E711572B6B8F3BC43D022930663CB3C1C66D9F6B17D520682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067491, "uuid": "4ad2718d-0ec2-47e5-8c00-db37590596da", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067491, "uuid": "76a33385-e52c-4996-b30b-bf75824fd7c1", "value": "6144:rGiqQGrlDdWo1pso15zFgN5vWdGnB/fjhC436xxzl5mnXw2V:fG9dT7so1Y3Wd6CI6xTkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639067491, "uuid": "8522879d-0d63-429a-92aa-f7e164434fc6", "value": 313941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639067491, "uuid": "1e92090e-dc28-4bab-9237-7de3c327101d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067491, "uuid": "a6b5e616-c9ac-4012-9488-cd63d10770bf", "value": "solicitud.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a89627-58f5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639057079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057079, "uuid": "2e211482-fed5-4106-841e-b95342d563db", "comment": "Malware payload (Formbook)", "value": "77227284ba98bd6797ea455b4fbd75a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057079, "uuid": "6267cff7-a655-454f-918f-7cbd580ca831", "comment": "Malware payload (Formbook)", "value": "c0814f4b2eea236f39eb77aca6179f66639538b9dd83b4d406b5ea82240a2fa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057079, "uuid": "f03efde8-055d-4bd4-a978-4538cd89ffe7", "comment": "Malware payload (Formbook)", "value": "959c1369fc2a81b16cb56760169c13cbe8e61690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057079, "uuid": "b2c81474-affb-4acc-8644-83dacb52c6ec", "comment": "Malware payload (Formbook)", "value": "f0b747c860079662e96f8df78063efda1613f5d290a077d706e2a2b5cb18a8ff55ee0043541918f0c858d750e0223dde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057079, "uuid": "d8327d2d-da7d-4851-9ce0-ffb6cbeaf858", "value": "T1B3642282BAB982A7D9530DB10DF66B7BE7F047955AC2176B2F240F2F7801357B806065", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057079, "uuid": "2085e1c6-1af1-43b6-8cf0-db576ff6ec0e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057079, "uuid": "505750be-913a-4f66-873d-791589f18641", "value": "6144:rGi0OrVIk3pH2reeNBg0ai45IFNiEY1Uv8yGBdIaOr33tTnw:tVIkZH2reeNuzi7WftyadIb9Tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639057079, "uuid": "4bfaba02-257d-4838-a5df-39a348e752e4", "value": 311501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639057079, "uuid": "7bf3a215-a445-406f-a116-d3698c49cebf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057079, "uuid": "1c87672f-c8b6-43c4-9a0c-23f807f4de78", "value": "77227284ba98bd6797ea455b4fbd75a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cde03a-58e2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639048859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048859, "uuid": "e990fe90-b272-4acf-8088-4178e038eeda", "comment": "Malware payload (Heodo)", "value": "c941fb0ab32e73b85c9ed142310f0cf4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048859, "uuid": "8b42370f-de96-4a3b-9a44-0b3d2e8dc7fa", "comment": "Malware payload (Heodo)", "value": "c0aae33c298bffcb74e4ef5d1cbeab82f111eb9de9a57a16f63c5b0db9744663", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048859, "uuid": "c4429d24-105f-45c6-afd5-a23ad7c3dc56", "comment": "Malware payload (Heodo)", "value": "fbbf99de34c6e7c1811209926fa1eb4d98e9ee92", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048859, "uuid": "dddda063-e2c3-4266-9fef-cd322c79810c", "comment": "Malware payload (Heodo)", "value": "041f2a04059bda6d770164c2eb6c0c25e13779319d1a43de0699c87c5629378b2a3c11fec75a4af33e128d6b6bd87e63", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048859, "uuid": "4292918d-921f-48ca-a7b9-977d348cf272", "value": "T1869301DAD2A5DE7EF4E6D038E4BBA1F97323C036C1581D42914DCAC8812C5C657F61C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048859, "uuid": "bcc0ba1c-7f58-4d88-bff5-eb6b9cbe3bc7", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q30:psXZ3MYeGt9sLBrGrQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639048859, "uuid": "5c5670a0-3ca5-4b6b-a7e0-62fac7824696", "value": 90150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639048859, "uuid": "c0309743-2196-45a8-823a-5dd368a87b61", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048859, "uuid": "64637826-4730-4672-942e-d46e2aa7b4ad", "value": "emotet_e4_c0aae33c298bffcb74e4ef5d1cbeab82f111eb9de9a57a16f63c5b0db9744663_2021-12-09__112033267239._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebffe213-5893-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639015288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015288, "uuid": "17dc8b44-612d-4199-8611-ab3934fda386", "comment": "Malware payload (Heodo)", "value": "bbc869ac8aa0351c8a62d945ff33dc98", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015288, "uuid": "a34d01cf-25de-43fb-9616-daa140bb3dc0", "comment": "Malware payload (Heodo)", "value": "c130f18d2e17ceae5652115dade68d010e7b9f513e33efb212eec52af5e57187", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015288, "uuid": "a3f06bbe-f434-4bea-aea3-5d4fe21b1eb3", "comment": "Malware payload (Heodo)", "value": "a8162e9a0c8e00a7f0669be6b946dc668825216a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015288, "uuid": "193b0216-2f0c-414d-a3fb-4b72aba39e46", "comment": "Malware payload (Heodo)", "value": "a370d1d7b9178d4e931c9e126a9ace4117576792609aca7628f21106038b4600bed2fb7ee6b463d0ab8da878bc6474bc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015288, "uuid": "8d1e66c6-4d7c-426d-af07-ee07d97b9eb9", "value": "T12493F1DBD399EE6EE5E7D438D5BBA1E927228027C1685EC181CDCE8C812C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015288, "uuid": "52ebc402-3ca4-4d7d-97bf-4b58fb9c7d83", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySm:Gp4Z3MYeGt9sLBrGrSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639015288, "uuid": "473a8ce9-f748-4c38-9b5f-c6fb5d503eac", "value": 90143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639015288, "uuid": "9c07b2ef-a283-45e2-ad78-9c0f64f8ff24", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015288, "uuid": "a8c295d2-887e-40a2-9419-d916e24e36b1", "value": "emotet_e4_c130f18d2e17ceae5652115dade68d010e7b9f513e33efb212eec52af5e57187_2021-12-09__020112723593._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e536dc-5948-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639092715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639092715, "uuid": "2d7ac73e-1950-4b4f-a9d3-9e95a8c61e72", "comment": "Malware payload (RaccoonStealer)", "value": "0fdc442597f8faf1a1de73f544ef6cf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639092715, "uuid": "960f3d0e-9eec-4d09-8575-a157c05649f3", "comment": "Malware payload (RaccoonStealer)", "value": "c15dbd956b786253f061b4289e6de41fb9350069922629c32874ee23f8870d8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639092715, "uuid": "8530f651-b1f4-4131-ad18-7efddcfb8968", "comment": "Malware payload (RaccoonStealer)", "value": "26df652d322f965a7d767ab69dbe8ea25c70763b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639092715, "uuid": "dce6e0cf-0301-44e8-a9cf-943421edab64", "comment": "Malware payload (RaccoonStealer)", "value": "283b93ddba9a6821d6bfedaeff125d3fa4b34f179bfea96936b0b0e0fa73755c1550c9a598beb37e4c3d88b78e227d75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639092715, "uuid": "25d872ab-dde3-4016-b68e-51ee97f41a5b", "value": "T19BF49D30A76C60ACD07F5E7B3BE9B5A4991B36903335E0C759EA19D902FCBA5C630643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639092715, "uuid": "0b150e1e-a1f4-4b56-bc76-6e7d6a423701", "value": "9a4fc332982336bed32e6b1dc80be347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639092715, "uuid": "47989a46-721f-4c0b-aff4-2a252c16037d", "value": "12288:1/cNmfzF2142zq/8ljmvF7v6r4IqnEwpHJP3z+LkmuuG1KDjnV7hI83l:yYkzfUF23q1pHJPqQmuu4KHVDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639092715, "uuid": "79148b36-1865-4f7d-87ee-a3b7f006993e", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639092715, "uuid": "9eada32d-affe-4070-88fb-37ea123f0d0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639092715, "uuid": "4cfb0be0-1274-4ac2-9935-5dfe9d1edfbd", "value": "0fdc442597f8faf1a1de73f544ef6cf2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82aa4540-58f0-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639055054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055054, "uuid": "4a8d6d35-2c60-42c7-a9e3-8b2958dc0c65", "comment": "Malware payload", "value": "2c8781d207498674a3512fd42a4b093f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055054, "uuid": "7197e983-e41a-46dd-b265-89b9e1a6292e", "comment": "Malware payload", "value": "c189a5878c860c3172b87a193414ea838ac970b132636a22336b9d7726f59f34", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055054, "uuid": "4216a67b-00c6-4511-8301-c312a1358283", "comment": "Malware payload", "value": "c7145a8dd8dd20b7f87c3798ba1cd696b727637b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055054, "uuid": "b68ce809-fdc2-4018-b0c8-5242594e61c0", "comment": "Malware payload", "value": "09e66acfc261ba524b82f1909f48cee5a15e1877cd0b51ed41f014ddcf63c8288ec65e94ab5de159d9e0174860247f53", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055054, "uuid": "9e157de5-2ed5-4e5a-bccd-4f49c327bfae", "value": "T13284EB51912E3C6FF62FE81C1593E1C8386EA57AA4F0056C939EF014DE259EAED8C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055054, "uuid": "d75054fa-3f6c-4b26-92e6-cc15a5b4ecf8", "value": "1536:ijDDdDDDDDDDDYrNnlwr++pz3qYsRs9FVfNb7hKfedzFz76mAg5eeVhMDw5wfLj:iBDDDDDDDDAMXdzFtr5RDAw5wff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639055054, "uuid": "d2046683-0f74-41cb-8782-9b383cefa546", "value": 392635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639055054, "uuid": "1e456b64-f68e-4426-9c3b-bb79a30b0945", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055054, "uuid": "91efbd74-87f6-4c6a-9e5e-0db2733ceb4d", "value": "Conditions of Purchase - Schedule A.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b35290-5936-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639084992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084992, "uuid": "6d4ae256-45a8-4271-a189-e8bd0f96b06b", "comment": "Malware payload", "value": "f175d0b6a0808bce473aa0ae47fa01b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084992, "uuid": "b9954426-57dd-48ba-a6bb-47fcfdc8942d", "comment": "Malware payload", "value": "c1a6565f3f81efca37159f4ed315623cc1defc395c738fba77d8c24d1f207cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084992, "uuid": "7592c224-56f4-4f47-b5bc-8ca347faeac3", "comment": "Malware payload", "value": "8da7b1bc07922d24b5b73060814119b5db5cdea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084992, "uuid": "298568a7-728d-4058-91f7-4a50d67a9137", "comment": "Malware payload", "value": "008cdd91a6ab95070404e9ff80d43cd9ed837692828292f242e7458ecdc505c714189912ae104f65e051870058fed56b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084992, "uuid": "76f68e54-2662-4928-87f8-04795095846f", "value": "T1DA353912A7225B57DA3B13F4C0394B34B7F198DE9620CE9F7FA278AB18207419637953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084992, "uuid": "01b1e73d-a9b8-489f-b0f8-37c065bd6557", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084992, "uuid": "dd93797d-0e89-4036-af46-15d5fb39e7de", "value": "12288:T5ViZGmqdjCZ1SpwGRVnoG4Vsn3n+qTYEsdyvtebmifZnoDm7PqxKuKsdzEe51I6:T0MAbSpP4rQYPIIuCtsdUsDwAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639084992, "uuid": "fb30693a-ee82-434b-bd8a-462800b992c7", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639084992, "uuid": "e382cb72-5029-463c-8dbe-d1b4a7c7b7e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084992, "uuid": "ba4fe630-fb31-43bb-b586-3cec4a64c69a", "value": "Dmg~2345678765-09876789.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226ec01d-58f8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Stop)", "timestamp": 1639058329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058329, "uuid": "c4c40113-f108-4379-b7da-02a6342cc871", "comment": "Malware payload (Stop)", "value": "1cb01babaff09c3c5e27038f42c257f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058329, "uuid": "e45b5dae-89c1-4d44-ba10-61beb3cdc839", "comment": "Malware payload (Stop)", "value": "c23d3534818e4daba25a1fc610f99b0c0cd5713be5cf3e8e8f290c6dadb2f0ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058329, "uuid": "fd71b3be-14dc-4b76-9973-328b40d3fc2d", "comment": "Malware payload (Stop)", "value": "acafec37748aae2ea3c3fd053052efd4a191e035", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058329, "uuid": "048ed402-6cfe-44b9-8b65-43b783c04775", "comment": "Malware payload (Stop)", "value": "f546f6d87ad0692a3e2434e60c5bdd6f89fc4dd4aec860facdaeabb6e3d9eee82922f904f7bbcf0c957bde915c4e145e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058329, "uuid": "f5bd419b-744b-4803-8fe5-a80a027bab4e", "value": "T139050210A7A0D036E5F726F88AB69369A43E7DA09B3894CF52D057EA47745E0FC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058329, "uuid": "5ff4786e-05da-4050-bec5-8a4d4a2ec703", "value": "4eb02e1fe9496df33596532c6e671ce9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058329, "uuid": "98c719d7-81c5-4bc6-8804-06579cbf450e", "value": "12288:pYda3E4DbP+3Dp4+M8z8yV2EhNFo2jcAMKNmeYIt4gTBxEFixrKGiw76W6Y9uuyh:mKGTpdh4EN8It9/WGivgOan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058329, "uuid": "f1809ca2-ed63-403e-8941-09ef4e64f270", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058329, "uuid": "770f15b0-2375-477b-81ce-5e611368d257", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058329, "uuid": "0677037e-5747-4df1-a194-0cf7e628f2f3", "value": "c23d3534818e4daba25a1fc610f99b0c0cd5713be5cf3e8e8f290c6dadb2f0ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09df248-58e6-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639050944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050944, "uuid": "8651e5ce-569e-4006-910e-5c46ce13bd82", "comment": "Malware payload (RemcosRAT)", "value": "cb30b0668fd34a7d5839eec1528e62e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050944, "uuid": "67e10702-490b-4b04-93db-34319e4c6cd7", "comment": "Malware payload (RemcosRAT)", "value": "c3e06052cbfbbf225d9d3052bb3478e1c72111d4cb18240806f32f517be86b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050944, "uuid": "edccd77f-e41f-43c6-be89-50da1ab7affd", "comment": "Malware payload (RemcosRAT)", "value": "14c3be30b437be2b924ebd6f2ab3d17c7e8fbd2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050944, "uuid": "7a17a6ef-74d1-4bea-b546-46a75f9c8349", "comment": "Malware payload (RemcosRAT)", "value": "cd573d4a4ec609a966ae563dbde200c76d6a0045696d3b8aab37dd50021a6795f2d72ae0a849cb7b4a64e2c3a474f664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639050944, "uuid": "677d19dc-ff84-44ea-8be2-707d27e1ea66", "value": "T1BC159DA3D2D01C76C06F15B8AD0BEFE4652B7E103E289C465FE82D8D9F367A0341956B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639050944, "uuid": "e6e57a7a-c65a-4ae5-8b4b-6e7f0ef51505", "value": "939d8f743f99c748d946de3c81bddd31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639050944, "uuid": "759d486d-10b8-448c-b54e-5924211cbd12", "value": "24576:muRQsAJcBdZF0bE25chN+QIC3c13TOqamxypnUXfGe:mL9JO08b+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639050944, "uuid": "59aecdd6-09c4-4ed6-b3c2-7fecad66e3bb", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639050944, "uuid": "42d0c5ba-da68-4aec-9acb-62cf618458cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639050944, "uuid": "548a698d-d086-4476-9884-65439924ef32", "value": "STEUERZAHLUNGSRECHNUNG MITTWOCH, 9. DEZEMBER 2021,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955aa7f1-58a0-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639020726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639020726, "uuid": "e7f3f7b1-0865-40e5-943b-30611c06dcbd", "comment": "Malware payload", "value": "e8567b8500a073a3e2c130a5c9623108", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639020726, "uuid": "b9df37a2-1572-420d-92fb-08c996a83a2f", "comment": "Malware payload", "value": "c3ec61773a3c844708d0c2e4d27ddd06a98f742ab7c047476978e3d742d0fbe8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639020726, "uuid": "b306aeb2-3e54-47b3-beb2-a5efefe2da23", "comment": "Malware payload", "value": "c71bf17de144797ba204f8a30d96b2e2cf32d27f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639020726, "uuid": "ab7275ad-0f53-43d6-b131-551c7b089b1d", "comment": "Malware payload", "value": "8bf708bf5c015248bf2a5e357a8f6db71f76c55ccc9f87ff6549c627da05ac84185cef319dd338466072025539c87dbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639020726, "uuid": "c3f9d79c-5d0e-476b-804e-fb25ee55d178", "value": "T1CEC3271276418471F70D0B304946FAE04AAA9D3D5AE4E48FFA7C7E7A29312C31A7725F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639020726, "uuid": "584bd4b5-56bc-436e-b2ac-9253778f3dae", "value": "d8130762549d8ab8e3c12e25d2f5f0e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639020726, "uuid": "14b91926-24b6-44f4-88a3-b2570b739f63", "value": "768:4Ke6r0NVnxxS6vobyOlWUpN3RdO6jVTBR2r/A7izRGUR/lHJ/d2uoe5N1Eyw0tr6:b3aV2xblpbOUf2U7Y1P/dfLttr1pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639020726, "uuid": "035b8269-6684-4d42-ae93-576d9b1a09fe", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639020726, "uuid": "e9e05b0f-d134-41f8-8a89-be9280bfe95a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639020726, "uuid": "1d8cac91-7efd-4496-8909-55ae7c3b55d4", "value": "e8567b8500a073a3e2c130a5c9623108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f3b3fc-58f0-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639054949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054949, "uuid": "9abfb1ab-96ad-49ef-a984-4acd94458e0c", "comment": "Malware payload (AgentTesla)", "value": "6a4357525c85f761ec86f91e77e4d70e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054949, "uuid": "9d7b0156-aa48-486d-ad7e-5b2e5512aeab", "comment": "Malware payload (AgentTesla)", "value": "c47f57ef3460203feba13648813b27f04f8b91bf3e0f9639bb57f6d547442787", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054949, "uuid": "a6fe6508-5b94-44eb-ac28-9c2c90cc6f48", "comment": "Malware payload (AgentTesla)", "value": "ebb0ce749ffbcca3a3a18282f3af7740d1e7abd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054949, "uuid": "8cf1f16d-e698-4ff8-8ea7-d6be94226469", "comment": "Malware payload (AgentTesla)", "value": "63a810a1388900436f96354b0599df3f71ff3eb036b37b58f2a2c51e230867513d375e32984625476916e3c8fbf5a391", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054949, "uuid": "6f924266-8851-4576-970e-46833a36af31", "value": "T128F4C0336622FCD90B7D3C8498543E550C587D67EBA8976CFDC405EA69FA240EF290B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054949, "uuid": "4f44128d-c09a-4d1e-bea9-5242575d91cb", "value": "12288:Ql9U40h++XQ0eI13DJRE5EOCYyXi6dvVSRymWwWcKejChh6K:KU40h++XQTI1V65E5YyXi6d9a43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054949, "uuid": "36205862-77c6-41ae-a391-d6e5abc83fad", "value": 743012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054949, "uuid": "f985ad6e-6629-42e3-820c-d080da1b5ead", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054949, "uuid": "78f45e1d-10fc-410f-8475-58de0835b837", "value": "Login details for 10 days trial version to our Cvresume database.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3648e328-58fa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639059221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059221, "uuid": "7741d8b0-eb8b-45a4-bf7b-f677d89f9523", "comment": "Malware payload (Formbook)", "value": "bcb3b3ec8dbc467183894e46c47f81b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059221, "uuid": "1e308baf-d875-4c9a-bb5b-718dff32f79d", "comment": "Malware payload (Formbook)", "value": "c59080f52c17a26a96ca4c5aff0e0505a61c05cf78b36c31f2e7db7af160a9e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059221, "uuid": "4d94b204-ec1d-4ff3-b724-738d0d9b27b1", "comment": "Malware payload (Formbook)", "value": "534dfa11d587f6c9b6e8bbeb680448213f6a21f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059221, "uuid": "cc1f1dd0-fb37-46d7-abc8-07aea8636c82", "comment": "Malware payload (Formbook)", "value": "91a6e1a98ad292f6f110bff3ac0c31db0b9e1a0677afd0854328ab77a3a7c5110bea6717283398a4d88b680cf1b0493c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059221, "uuid": "b0d369c9-1bd2-422e-a502-a12e5036083c", "value": "T111A4E1516142840FCA802275C09FC2606043AF9D3DD4F997AA333EB9BB6D9D7BC3A597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059221, "uuid": "2202151c-8098-4f25-8ea5-92b8c8ab2e9e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059221, "uuid": "e97ea21d-b913-48ed-a5ce-4b8f8e9a586a", "value": "12288:f6XTFI7zR9zqUlEdrR/GYIeFUu1p2/u+ydNVb:f6XTFI7zRBqUidxG9eLGrcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639059221, "uuid": "358bce03-2a5e-4513-aeb5-8a8c10903d1e", "value": 478393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639059221, "uuid": "0c818b77-39a5-4bbc-ab92-8781ac40c314", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059221, "uuid": "d99166bc-f44c-453d-bcb8-418a6645feec", "value": "bcb3b3ec8dbc467183894e46c47f81b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7144aa03-5918-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639072205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072205, "uuid": "c154be10-00f8-465f-943e-36c06b0e5bad", "comment": "Malware payload (Mirai)", "value": "af8c070d7c5349bf5e2b9a0781860869", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072205, "uuid": "4671ec60-50b0-444c-9aef-58815ce50bd9", "comment": "Malware payload (Mirai)", "value": "c5abdb80dc43987e30215c02cf9bebb2829a65dab1841544e6291a4ccd7fd277", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072205, "uuid": "a742340e-35d1-423b-8b55-e9cdf0588ee0", "comment": "Malware payload (Mirai)", "value": "c178e96544ec128d527ee7bab4458fd5ee0268fe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072205, "uuid": "f36c30cb-1327-466a-af00-8488a9a53028", "comment": "Malware payload (Mirai)", "value": "64ef393a7d9ad95ff9bc494c78c083077797ddf3aa7147cd68ec16292b880dd9de3b017ed0dedceb385fafb231778e16", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072205, "uuid": "415371d6-b347-44e7-a6c7-be1d7ac4d207", "value": "T130D2E16AD9A6AB94C9A8813219FFB756A510C389998512C5BFE9F01FCC04F71371E2E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072205, "uuid": "2e0a84e3-9208-4240-8f0d-075a612356e3", "value": "768:eJ55ogT+lbYM3q7140igxVBRZQTMELmag24ijnbcuyD7UHQRja:K5oDlYM3mG2BRW5Lmagjijnouy8Hye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639072205, "uuid": "2abb10cf-fe09-4962-92e0-db4ec3607645", "value": 29700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639072205, "uuid": "a21944ed-890a-453a-8b2d-25a0f993d65f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072205, "uuid": "64c2f4d9-007e-4bda-8a0e-d6b6e35b7c71", "value": "trynagetmybinsufucker98575.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17835bf-58ec-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639053442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053442, "uuid": "09b0fccc-0cc6-484b-bf3f-e1124efad9a6", "comment": "Malware payload (RedLineStealer)", "value": "b4988a88bd743475101fa25eb80bb794", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053442, "uuid": "543b8f07-6a0c-4047-82e9-f085cf5924e5", "comment": "Malware payload (RedLineStealer)", "value": "c777ab04fe5b53dd7571bec57ec5e9cdf86ccaac69a2c8a5d53217b035d8c4ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053442, "uuid": "ce65af47-c003-4e74-87e6-eb45894f6e9d", "comment": "Malware payload (RedLineStealer)", "value": "fd8bf0fcc49313f1f7198ef2c2ca82c77ee694d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053442, "uuid": "487819bf-2fd4-4497-ae75-f8eb2d314844", "comment": "Malware payload (RedLineStealer)", "value": "0cfc6adbe47c4a9a2418e5261f158dd056b898b58ab6129b793a1c2ebe437ee71f3005600c2e62c4c991e5ba9b79e182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053442, "uuid": "06f2b1bb-4052-422b-b175-968dfa23cead", "value": "T110652321A1A380CFEC4B5B33961BD430989A3EEE7D31D2F92591BF2AF7735D9045A805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053442, "uuid": "8ae13c87-4def-4659-bcf4-75ef75e87d7f", "value": "84bb1ac192dd1d591766b467b12ade64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053442, "uuid": "a8ce3161-b272-4633-84fd-afb951ff3c3f", "value": "24576:wYHKsZqA13kG0gXWFuvtTllS6Ibp+t6RZnrG4YCMFsG7hn7GvilEh+N2F6IMJNy:FHZDk3JSTl4GaasMhREYw6TNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053442, "uuid": "09364daa-43c3-4e2a-860b-b15a55fc6aef", "value": 1415096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053442, "uuid": "3d2567cf-a2fd-4ab9-8d9d-0278f99df569", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053442, "uuid": "4f3bc33a-65dc-40aa-b5dc-d31c86a84834", "value": "b4988a88bd743475101fa25eb80bb794.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384f61eb-58c6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matanbuchus)", "timestamp": 1639036891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036891, "uuid": "d9f6c997-98d6-4fca-8963-28465b80041e", "comment": "Malware payload (Matanbuchus)", "value": "b6cc218da80cbce30de9357ca4a270ff", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036891, "uuid": "026a1b64-c8ed-41ba-a403-325c88d3bbf0", "comment": "Malware payload (Matanbuchus)", "value": "c96f83482ad1a84a8892217fb3d8b5f0c0f95061ffd01c994a8169ef10cecfd4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036891, "uuid": "be12c86b-9435-471c-9e8b-2e296b699cbb", "comment": "Malware payload (Matanbuchus)", "value": "04516383fa0fa7dc594bf9137707a6f943ceebe5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036891, "uuid": "c2ea07eb-8940-4054-9b67-edcfae75dfe6", "comment": "Malware payload (Matanbuchus)", "value": "4839835cabdc90409beca4339b885caace6167ef5a872ae8699fe99212c3cd27a1417c81adccaf924b79f725b4d0902c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639036891, "uuid": "b41a5a7f-c717-4f6e-b8d8-fd68682c95e3", "value": "T12EC48E76B6C08837D12325389C5B6664AC35BE503D2858856BE42ECC7FB97813F3729B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639036891, "uuid": "885ea439-a9e0-424f-9f40-462a7bc552fe", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639036891, "uuid": "1220051a-c158-4be2-92b1-26a2a46798b9", "value": "12288:rWXcaMsRJed93y4JPIkFdHl1L8G394aar6Q8ai4efNQao:rkrMwi37Tp1Im5vQ8aZfao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639036891, "uuid": "4534e943-0803-4ee6-9b76-535d9ecd1d91", "value": 576416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639036891, "uuid": "fa092a53-c323-4029-9ba4-ead3b4d4514a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639036891, "uuid": "b82adf92-883f-4a5b-b335-0968baabf40d", "value": "44537.7815862269.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5989b6-58d0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639041221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041221, "uuid": "00b0e69d-b1df-472f-9e3c-1382c8ee07d8", "comment": "Malware payload (Heodo)", "value": "ed062a4d4ff5a5bd7878c44c4a4ed254", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041221, "uuid": "37968bec-2a7d-4240-b777-487ac392b52d", "comment": "Malware payload (Heodo)", "value": "c9d72a364fc932e0640d75bf31c594c0b095b54ad6d551c12c07bdf369657c2e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041221, "uuid": "262af312-39e0-4e53-bb51-ad38fdff86e5", "comment": "Malware payload (Heodo)", "value": "24496614a02c4358d76d80313a04f0ad6fe85c82", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041221, "uuid": "26411a77-2268-4291-8b92-db3b071c9663", "comment": "Malware payload (Heodo)", "value": "ccd2ca65d4f69fc42762f13ab39123dd59f3a8562d41de3c4d876bfc1f0f2c44dcab13cea2f4d9db24ded5e516e650af", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041221, "uuid": "2963f2ca-b989-4257-b6c9-1948e3d681ad", "value": "T1409301CAD6A5DE7EF4E6D078E4BBA1B96723C037C0481E82918DCEC8812D5C657FA1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041221, "uuid": "0fd6a770-ced5-4c8e-a1ce-30fd3da696e6", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3x:psXZ3MYeGt9sLBrGrQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639041221, "uuid": "c91a2a81-2409-42ac-a1ca-a390f4347394", "value": 90151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639041221, "uuid": "79c3a735-15e2-42a0-8a07-dfb4ace902e1", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041221, "uuid": "1e423e51-c299-4ef5-868b-7e8d9b8a58ab", "value": "emotet_e4_c9d72a364fc932e0640d75bf31c594c0b095b54ad6d551c12c07bdf369657c2e_2021-12-09__091317601282._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076c958e-5911-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639069021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069021, "uuid": "e3ae3c79-9696-4da5-8ea1-838919e81f6d", "comment": "Malware payload (Heodo)", "value": "6549fef8397ad95162e63bad82ea81b0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069021, "uuid": "d9b03df1-5130-4e73-ad96-3f22fb7c692d", "comment": "Malware payload (Heodo)", "value": "ca4a4035c518c27d6d0a384f7132629002dc98f5a51dd4ad44f14787ab104386", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069021, "uuid": "1c43aa74-df2a-4a13-9de9-84823ff425f2", "comment": "Malware payload (Heodo)", "value": "e6a7a218a3f817ff53f3cbad9d8cdf8739a6620c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069021, "uuid": "96098c7f-e830-451c-b96d-1524c949af3c", "comment": "Malware payload (Heodo)", "value": "183cf0b3e17a96ae0aa2e3e1fdef04f31339a5230e520ca821ce048942072549210cd7cdf1fe3aad1c61b64a05b254ea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069021, "uuid": "f4257f9a-c30a-4355-bb5d-9cb62d543bec", "value": "T1D044BF10A181D036E5FF087A89FAD9BE466C76600B80DDDFA398187E4F6B6C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069021, "uuid": "77c3d43d-6add-46c5-8b61-616e41e697f0", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069021, "uuid": "f7b89068-0436-495a-aadc-57dec69716a0", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBwmgL/S:Wvef8+h61mRcHL+rF6l5EAQWTQL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639069021, "uuid": "fbd2e752-9231-4ad7-b47d-946f037d94ab", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639069021, "uuid": "10905019-b820-47c9-a5f6-efdcfffecfa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069021, "uuid": "99f97238-801c-4f12-a3e5-c92bca910921", "value": "Z.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4793478-58c9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639038468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038468, "uuid": "e8fd072d-8df6-4bba-9adc-b7f221edcd3a", "comment": "Malware payload (Formbook)", "value": "5df14cb789ee01b67735ba23305de747", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038468, "uuid": "37c04164-fc85-4478-86d0-f274efb10a5b", "comment": "Malware payload (Formbook)", "value": "cb836996444ea64cbbc74d40ae7a98f45a0ba279176f9b453ab7bcf62a144ded", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038468, "uuid": "83339bdb-8c54-4558-ba6e-a84f462a32b9", "comment": "Malware payload (Formbook)", "value": "5a4625123ef72011c598811b56c29879aebc38af", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038468, "uuid": "ffb60bcc-fe70-4ae4-8581-d7e5e21f651c", "comment": "Malware payload (Formbook)", "value": "43837e596ace2730d78387c1eb325bf60a81bf6f4ec8989133606f8d1e238b695abe487923ea24a3853702845cd9179f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038468, "uuid": "c517d917-6ef0-4281-a965-30e0817c84fe", "value": "T1E084EB51912E3C6FF62FE81C1593E1C8386EA57AA4F0056C939EF014DE259EAED8C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038468, "uuid": "6be86c9e-974e-4fe2-8ed5-f99b91fd6653", "value": "1536:iIzr5DDDDDDDpi6IWEkTMWo/XuJ5M+Ec/oY7hKfedzFz76mAg5eeVhMDw5wfLj:iuDDDDDDDIYJdzFtr5RDAw5wff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038468, "uuid": "ecca2dcc-66f0-43f5-b5de-f6d8d85cbbd8", "value": 392611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038468, "uuid": "8be6212c-4671-49d1-8649-624ae5ff371d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038468, "uuid": "8572a3ca-428b-4d9c-a6ac-85127466f44e", "value": "Quotation-RFQ-HL51L05.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae87b158-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639054269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054269, "uuid": "db143ad8-5e22-4fea-a19b-db5db0d33ea0", "comment": "Malware payload (Formbook)", "value": "52bad49ed6b84316cbec003684875b26", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054269, "uuid": "c0c00b95-e556-4f17-9a3b-cebdc70bac5d", "comment": "Malware payload (Formbook)", "value": "cb8ae099d543f64bf9cb3241befbbc2d3d07796c006d03834bc9042f07066148", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054269, "uuid": "79809ed6-4692-4331-815c-2354a26c6da2", "comment": "Malware payload (Formbook)", "value": "372c9c77ababe6727751381f7af818c3d955bc75", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054269, "uuid": "5138f5ea-975a-4706-ada2-5f8860ccc25e", "comment": "Malware payload (Formbook)", "value": "4367dc6e1ad75f2c2d2920e955a4d166510f9932d281a7a615eec8253ab01ca8bdc077b83ab2cd3bf6b940541bb00f76", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054269, "uuid": "ea5f3f44-0c6e-4aaf-98f3-64412500fe24", "value": "T130342225755EC1D4C1BBDBB78F2696409F20FF23EC2952672456BA43B5F1B8021DE2B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054269, "uuid": "b00550b1-b568-42fa-81f5-5bc11ae1faaf", "value": "6144:oWshOsjZglZwWAUszVHKXKeFxaxhbnA44rS:GzRWAUm2xaxNAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054269, "uuid": "47bc9ee8-8133-4cee-acfc-cf3d787a569c", "value": 234376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054269, "uuid": "a7b2a0ca-ceab-4231-99a5-4387d0269114", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054269, "uuid": "0dded0ec-742b-4a75-8cd5-40754fa25073", "value": "BANK SWIFT_MT-103.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c08cf25-5940-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639089376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639089376, "uuid": "5339e530-9c7c-4bf1-a2e0-9686dd1ede07", "comment": "Malware payload (RedLineStealer)", "value": "0861f27463c8f77c2246ed75be489247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639089376, "uuid": "552e099a-676f-4447-9927-36a3a6bc3b73", "comment": "Malware payload (RedLineStealer)", "value": "cbf057204ccce21c2d0ba592bcba7ccef2d17fb87885775080ec0e68ee14436e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639089376, "uuid": "093b1038-f228-4aaf-83f6-1993b2ab5744", "comment": "Malware payload (RedLineStealer)", "value": "18344b3048dd9db3da62d191d5b07b70bca1281c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639089376, "uuid": "d9b077ba-3a53-4e69-aafb-e2b918c82718", "comment": "Malware payload (RedLineStealer)", "value": "511d5be82855213d8e1ef450f7d027980926bfc4d7cdcdb55299b23a132bf4ef76dcf9947afb47207a012fa2c02dd35f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639089376, "uuid": "fe7d0c72-b3fd-4d64-8ad4-bda7f1ee67fd", "value": "T17555EA49B8C398B7DE33833A410756F0FAE96551AF711F2450482FE6E1A4B89FD1C1AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639089376, "uuid": "ad3bd1ff-ba69-4deb-a031-6471675bb0be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639089376, "uuid": "051a4224-1c4d-4198-bab9-bb9f5f6a5efb", "value": "24576:GvBKbmT28Y6VFzOV4NbyQbIYLLRepUNb:Yhepg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639089376, "uuid": "03117761-15ff-4068-a48a-0fda5f724f6d", "value": 1292288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639089376, "uuid": "5998936a-ee60-4bbe-83d0-cff43b8bd9b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639089376, "uuid": "6c20751a-bc63-41f5-91e0-3a9746dbe9f5", "value": "0861f27463c8f77c2246ed75be489247.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b50bb88-58cf-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639040922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040922, "uuid": "bd343e7b-3ebc-402c-84b1-cd1cb2a98bb2", "comment": "Malware payload (Heodo)", "value": "046a2a8ca66ccb4a1cfd99a5befe721f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040922, "uuid": "f5f4b52f-595b-405f-bd3b-bba8d09cb6c8", "comment": "Malware payload (Heodo)", "value": "cd1ea8af51f9a123bb2d33fdc34cfaae4db38a389f31d57a7acfac513eba59f3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040922, "uuid": "b8b0ae74-36c1-48b8-a337-e0f61fc52a65", "comment": "Malware payload (Heodo)", "value": "00475a332b67f5020aebf081b3967c411a348060", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040922, "uuid": "3d29e9b5-248c-4a38-aa7f-c40813a73fdb", "comment": "Malware payload (Heodo)", "value": "7aee006a9090ccc31f9cd4e5457a54cfeaa43f32bd2f9e13ff3477c919ad5dfa9179987f4d30b99fd201cf0f28e25d69", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040922, "uuid": "a62e5869-5318-4dc5-ac5e-56e7c0123175", "value": "T1E19302DAD2A5DE7EF4E6D438E4BBA1B97723C037C0481E82918DCAC8812D5C657F61C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040922, "uuid": "08d5b1a2-cb2b-49a6-a5cb-11fbb888acf3", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3Z:psXZ3MYeGt9sLBrGrQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639040922, "uuid": "70bd0a88-bc2a-4f67-9ad9-dd515044ccd4", "value": 90151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639040922, "uuid": "75ebaaec-7b17-4952-8436-9a4fa8b0f58e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040922, "uuid": "3e75c203-27b5-4e55-b56c-fd8954661961", "value": "emotet_e4_cd1ea8af51f9a123bb2d33fdc34cfaae4db38a389f31d57a7acfac513eba59f3_2021-12-09__090819647088._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d53c6f8-58c8-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639037839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037839, "uuid": "afb41603-0a0b-4e11-b98f-5b9d640e095d", "comment": "Malware payload (AgentTesla)", "value": "65cdb93212d7d0d036e1c19eb7b93e2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037839, "uuid": "4700ceed-c438-4423-b781-e3164b091c8b", "comment": "Malware payload (AgentTesla)", "value": "cdf0b5feeb458ef721d0b6f505942f358b4afb85b68302c408dfe3601934a1f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037839, "uuid": "7f9e67c5-fb91-44a0-b563-50c5eba349ba", "comment": "Malware payload (AgentTesla)", "value": "d7150b436f323deebf5ed634cb55a668a17cb6a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037839, "uuid": "94837326-60e4-403d-a94a-45160032c063", "comment": "Malware payload (AgentTesla)", "value": "a64cd3468d5142fa3846eeff3e3454bb8128472a7ee4388b95e93e1e684b3ebbce47cac62878a5928623f1a0c6beab11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037839, "uuid": "c12d8d59-14eb-4984-b930-8b41f35a07b7", "value": "T1E3058EA86082D7D9F43EC7B9A7103160D7F2ACF6DB52E188FC9670964573E01A722637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037839, "uuid": "65169e11-9044-4df2-825b-48ab7730f00e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037839, "uuid": "6371e201-62f1-4c5a-9659-edfe3bd01de0", "value": "12288:i13Su/NwP99oX3pwPm1rB2d/0pLUGhgld9Hn2YQBmIsx6pV1HXL+Yevh9GMlXEtJ:iNSc2d/0mGWxHn2YQBzYTY/tJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639037839, "uuid": "3887cc64-8333-459b-8b36-3b84245a60ca", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639037839, "uuid": "e348501c-bea9-48e6-b736-911e82dc37c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037839, "uuid": "e3ad932c-f6e0-4bba-a272-229853367469", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fa555f-58c7-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639037283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037283, "uuid": "90e61cb8-deb8-4546-8daa-0063ec20a8cc", "comment": "Malware payload (AgentTesla)", "value": "5a15d3b1f6a6e5d44c22eaf3286672ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037283, "uuid": "6c508740-7a40-4e23-8c11-d8e24260ca96", "comment": "Malware payload (AgentTesla)", "value": "ce35fdced286e6f2a5016536a6011b0c81f4778ac4fb264e073a0fbfed6a9a85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037283, "uuid": "b539e8c1-a3b4-4d79-b492-ed6f64963a03", "comment": "Malware payload (AgentTesla)", "value": "4f47db2a4ec367f5d1f35226bf97ed06d65e3d9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037283, "uuid": "816bd96b-01a0-4130-886f-1afa90c3b497", "comment": "Malware payload (AgentTesla)", "value": "8ce9a452e490aae05e2dfa22d648e463a9f87f77c946491eb81d3b6f215b6f8af534232261d427b75e9cd9ed869341a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037283, "uuid": "ebb9d7cd-8132-4b50-af58-82003fef86d7", "value": "T172A523B1CE893C658F4C869834A587D1E32B98445B61298F2B16F8CDD37E8609735E3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037283, "uuid": "345e7c17-d4be-4f28-97ec-35a7b7728f53", "value": "49152:jB1tcpwvf9Ft+i9b8B1tcpwvf9Ft+i9bZ:KpwvbF1pwvbFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639037283, "uuid": "9a919dea-1846-4582-ae06-942d1d6fc452", "value": 2122946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639037283, "uuid": "2e73294a-536b-45dc-97e2-e8a87f80778f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037283, "uuid": "ce83cb0d-a2bf-498a-868d-6a0ec69700f7", "value": "Dhl Bill Of Lading Docs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a9f259-58bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639032434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032434, "uuid": "2a991a57-eeb3-4580-b889-77af58afcc0c", "comment": "Malware payload (Loki)", "value": "7b87aa9fed1605ab3eaf5602291ad499", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032434, "uuid": "bbd7f19c-5a39-4cdd-bb5f-891d63884872", "comment": "Malware payload (Loki)", "value": "ce436b0c872329b10cee18860347ba76a1954d8518cac2199f4e22ab9454e658", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032434, "uuid": "5ec2e857-6808-4be3-9373-fb900b0b7ccb", "comment": "Malware payload (Loki)", "value": "c94741c2e9e87b292036441e798057a999c1b93c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032434, "uuid": "bda4adbc-abfe-4718-b1ae-65385c201789", "comment": "Malware payload (Loki)", "value": "c91d5d926d83f07647ec704982e27bcdd2b8168d70b7a92e1dcb5bfd9c793c1aa1a44396c445cdc4ab3cf31490e37b9c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032434, "uuid": "b2a713b6-4c53-4911-8be5-b586a0702758", "value": "T1BFF44A88B580A19DFC3ADB314D71DC7496227DF9D636900EE4DB3D1B7BBE6924A100B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032434, "uuid": "3b84747e-7bc9-4b79-883d-b5ba4fde0ca0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032434, "uuid": "5fbb318e-337a-4a2f-b874-b5985bfda74a", "value": "12288:zwwzQ4c2bf5jNIjypsLQwSe9MufAVK0e7QIz5tSGk0syvPYDA1netqP7r9r/+pph:zhzsaf59pSQwSealo9z5v1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032434, "uuid": "8a517842-323a-4e4e-b185-a54f190cc4a8", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032434, "uuid": "051db525-5bc0-4bea-b85c-fe61b5d5cf31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032434, "uuid": "486c0f2e-34e8-4aea-be5b-b412c6966022", "value": "DOCUMENTOS DE ENV\u00cdO DHL.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479c8948-5946-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639091892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091892, "uuid": "0e0126ed-0f1f-4886-a7e5-7673e716863d", "comment": "Malware payload", "value": "ff56e700d15f3d944424c295eae926d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091892, "uuid": "ad7a8ec0-3780-4e75-88ed-952ab4fae81b", "comment": "Malware payload", "value": "cefea76dfdbb48cfe1a3db2c8df34e898e29bec9b2c13e79ef40655c637833ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091892, "uuid": "ff77cd0c-b163-4059-a525-7403dce83557", "comment": "Malware payload", "value": "e17dc8062742878b0b5ced2145311929f6f77abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639091892, "uuid": "db495c0d-9b05-43e1-a4ce-3695c32022f8", "comment": "Malware payload", "value": "7d97c78774e051237d3b721a54f581ac355d5888e1464bb32766b993392c0954f13dac8437161b8990003c520c0039b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091892, "uuid": "2b4b09f4-9534-48bf-973b-ec8392a381fa", "value": "T11AB57C45F66391FDCD672930301EB23BE7301919421E9FA7EBED9D60FB2EB011909A19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091892, "uuid": "47fe4df6-354b-49c2-aa8f-484057bd5d84", "value": "2c3e267ae163c15bfc251e74ea5319b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091892, "uuid": "541e2726-b125-47f7-84de-338698e3bdb0", "value": "49152:BEqvaaAjc2hdKjb8WXqE1PiEbE/TKMt+/RgaJ2wW:BbyaALKjwWXV1P9o4vwwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639091892, "uuid": "2b269db8-df8e-4246-aea5-12a532d453ef", "value": 2281472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639091892, "uuid": "0eb5a2de-ee0b-4cdf-b11e-2a1dfffdead9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639091892, "uuid": "fb52a2bd-d1c6-4504-af72-cf310adbeb02", "value": "cefea76dfdbb48cfe1a3db2c8df34e898e29bec9b2c13e79ef40655c637833ae.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c210a8f4-58dd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639047000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047000, "uuid": "154002d4-9731-41b3-b185-b9fb4f4d5f96", "comment": "Malware payload (Loki)", "value": "272b0eaba3154dfb07b8af47cdf8ee49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047000, "uuid": "189c0250-4cfe-40ec-8c0c-3db7fc4b0e9c", "comment": "Malware payload (Loki)", "value": "cf05c45bd2958ec348c478bf47f1b841625fac71ea6a671f93af815efb11ddc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047000, "uuid": "11535657-34a0-4f26-b61c-2c74959fee61", "comment": "Malware payload (Loki)", "value": "26297201a1ecc4f52aa60c66d38b6a7acbd53177", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047000, "uuid": "2e82f47c-d32d-489e-a694-6b5b17e5d198", "comment": "Malware payload (Loki)", "value": "78e82a8676f28926c06ecc7b56d945efc4c079a11a39e0567245ba9a30a60c73babc86b400471882f7afc4342e7be3a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047000, "uuid": "d9b7a614-91fb-4047-a05d-d575ee09dbb4", "value": "T18135121929E0A67BD57C97F4C6AB80508FBDF0032D62F6B64D9311FE6A34AC89942713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047000, "uuid": "8d851a5e-9841-4674-8979-ddb926a74746", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047000, "uuid": "4fb6fe4f-cd49-412b-a471-c2cfac987a33", "value": "24576:pIKjy/SYCpGMQX1UFfPSBFB+1NrsWRinRZbz2qo4U2jWIbzyp:hjASOBFEXSBFBePRVQU2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639047000, "uuid": "f079743f-db7e-4d03-9787-199a91fdcd3e", "value": 1124864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639047000, "uuid": "6e9f97f2-6d01-43ed-9d0a-38d04fbc00f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047000, "uuid": "4bae11e3-e66e-4c1b-a579-59085a43f7d6", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f424a2c4-5904-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639063835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063835, "uuid": "82ec444d-f52b-4ad3-86bb-9382174c4836", "comment": "Malware payload (Heodo)", "value": "14a4614c9ea752fd2f4b1d08ffd10e68", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063835, "uuid": "83163998-57a8-4e5e-b391-3a40791f1d41", "comment": "Malware payload (Heodo)", "value": "cfdfbb87ab0a60fd4474fa7927e86011291e90e78e3ef77ea6745655f608b7c5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063835, "uuid": "c4953144-ce51-4c25-b711-2b589cd67d36", "comment": "Malware payload (Heodo)", "value": "30dcac53652db7982973ca3e07096fe10e37b7da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063835, "uuid": "5fccad46-d0ed-4f4b-8879-4bd4a27137fb", "comment": "Malware payload (Heodo)", "value": "d6d6c4fd87cafb3f227625879c04929b451b269d8ba2cb162a71d52fb11898b157693d49c78701c1a2390cb4874e4d78", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063835, "uuid": "dc5e379a-b562-46da-91fe-23fe88541daa", "value": "T1AD344A00F1619139FDE611FBCAFB49BC89AC5B00134865CBC3C568A5E7568E93D32A6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063835, "uuid": "0c9de590-2f5d-48fd-ac6b-614394c6ec00", "value": "6144:m09MHnGC7LRzxzVZYsuOa31UvQV8yMcSWUMuEp7:me+n9DJGtOal5V8yMcztuEp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639063835, "uuid": "49aae8ed-a5a7-4884-bf05-9fe7c7320126", "value": 234047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639063835, "uuid": "0cfb3454-ce00-472d-bb08-7aecf3c43285", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063835, "uuid": "553f027d-7374-4ed2-81a2-2945c66892fc", "value": "emotet_exe_e5_cfdfbb87ab0a60fd4474fa7927e86011291e90e78e3ef77ea6745655f608b7c5_2021-12-09__153030.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61180311-58fd-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639060582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060582, "uuid": "3cda1fa3-1fbd-4782-9c0e-dcd43ca79a48", "comment": "Malware payload (AgentTesla)", "value": "35eb25538b6d3ad6868155daa83cadb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060582, "uuid": "c47fc255-68fd-4a39-b536-992d5076fd43", "comment": "Malware payload (AgentTesla)", "value": "d013b72e65acc37cd24febd99d03ac68297e59a00aed83903a48ac0eb536c1dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060582, "uuid": "f70f911b-e30b-4487-bccf-5f5f923ea553", "comment": "Malware payload (AgentTesla)", "value": "ba15719c6e46e40b0435d5e273e670a20f5ed7d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060582, "uuid": "5009bee8-62bd-4f2a-b874-de68e494d138", "comment": "Malware payload (AgentTesla)", "value": "dc7145188e760b5a717031926986bc10ec36249daf7599ae35c587fe75891589e6d02391a31c13e6052894cd9c12e3f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060582, "uuid": "4b34bb5b-1ed5-46b6-9c8d-6583483f51e7", "value": "T1E445131B29F0A56FE13987F5DB8BC0608EB8E0022D72E6791C9252FF673D985D501B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060582, "uuid": "637deaa8-6bbb-4c1c-973d-6288a6b2b979", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060582, "uuid": "70bca436-92ee-4dab-b85b-c73ebe61306e", "value": "24576:oIKjy/SYCpJC7B7j69PCc2jTlqPbea187FSCe4ZEGgGK2KFYU66UnPErK5xM/K:GjAShC5j69/2TlcxyQj4ZEGgGK2KnJgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639060582, "uuid": "f6baa63e-db2b-4619-87fc-794f0facae02", "value": 1238528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639060582, "uuid": "7cc50a74-8af8-4287-b904-96961aad2e8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060582, "uuid": "0a7b084c-07b9-42f6-a25c-fd947d183cd7", "value": "Wire Payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24017d4c-58fd-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639060479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060479, "uuid": "2448d6d9-77dc-46d9-93fa-e1fdb3117e48", "comment": "Malware payload (AgentTesla)", "value": "4863fb6afe36e5a67b41494c7de755f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060479, "uuid": "bd1be30e-c594-4c76-8b8f-bd0c2f02ba86", "comment": "Malware payload (AgentTesla)", "value": "d10aabf37c6a5931d41fdb31151a615811370ae912329e56e453ef1e42b2a70d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060479, "uuid": "643a1119-dd34-49df-9f95-00f0aad9e19d", "comment": "Malware payload (AgentTesla)", "value": "2f9e03995e494272cbf70a11ef31a0ff5dc0b66d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639060479, "uuid": "d10a1f1e-a1de-435b-bf8d-a3f3bebab7ed", "comment": "Malware payload (AgentTesla)", "value": "aaf6af541ec949d7191eaf34b81d9c858b65a800e5a023ee897535a1bb8ccf203271a787a5e53f2bb631725b7722b1b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060479, "uuid": "719da37c-27a6-4485-9cf0-9390d9be0878", "value": "T11174122EBED0CE2FD9A6293153B76974CBF246C2226978470B204FDABFED1835815153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060479, "uuid": "8d710d88-8eb6-4889-bfd7-176e67979349", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060479, "uuid": "673276c6-d7a2-4f44-beb5-3c12f3557fa5", "value": "6144:rGi4/IeitE7fMqXEAm4BZfwNQ6Vk1EVg/3Zh39dw4zWr+s2tUmh/phRvc9p4zIOG:6Tit6/XELIZfwNtVcEVg/ph3dMahy43G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639060479, "uuid": "73648971-7352-4697-b6f3-e23d9a3e29b6", "value": 362799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639060479, "uuid": "87852589-0927-49f6-9fc6-f54794fb345b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639060479, "uuid": "9cf7dd1a-f797-4c07-a5b6-42d59c62dabe", "value": "COPY-F21TRHBTR2AXXX8286060332_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2beed6-58d6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639043955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043955, "uuid": "0ddad2fb-cc8b-4369-98ff-ec5b8a63f331", "comment": "Malware payload (Mirai)", "value": "7f8d5afb55239668ed743155b531890b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043955, "uuid": "dd6227df-b024-4e29-9599-ea42113cc574", "comment": "Malware payload (Mirai)", "value": "d10ac2d168cd678320e5fe1aa009d3b23c6f1e53bd480d693f780c2d9ee46c7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043955, "uuid": "69398031-1ffd-4701-83cb-896e3586b287", "comment": "Malware payload (Mirai)", "value": "9029310c8cd08868477e0c0aa5b67482ccd605de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043955, "uuid": "bc053c21-b9c4-4248-922a-5e6f8488250f", "comment": "Malware payload (Mirai)", "value": "6e2254d6096dc1f37dbe3922658f15fd9c823a098f719eefece07875b0764d7b20505657ac1aa90af887af5f7f152a44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043955, "uuid": "8046db9a-b103-40fe-8195-f91ff558924d", "value": "T1B0A2D01832CDE972D170943BE13DC217AAEB47B652FE323A1E1807D8E44591AD3B9945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043955, "uuid": "7a8c1072-f339-45c0-9c7c-b529af6f1fdb", "value": "384:Yzmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbohymdGUop5hXy:YKoh/DxCvhdR4IjWVFbS8s3UozJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639043955, "uuid": "dfb10d0f-5064-42c5-9d86-7cad6cc0c4db", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639043955, "uuid": "8f21079a-5d7c-4910-8dec-d202e7a55001", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043955, "uuid": "d29c493e-af9f-4959-a904-2f9b212cd1d7", "value": "7f8d5afb55239668ed743155b531890b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4c3554-5912-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639069538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069538, "uuid": "e3058b1f-7dd8-4c96-8073-111c42544717", "comment": "Malware payload", "value": "91a5720a4661f25ac7ed3aa680a51ed7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069538, "uuid": "80ecb813-3986-4c1c-a537-89befc802d1c", "comment": "Malware payload", "value": "d157f21ffa6bfd3ab060cad10d2dd10c49488dbfc07101b55686baa024c84555", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069538, "uuid": "3192be9c-e1c2-4ba5-ae5e-bb59adece137", "comment": "Malware payload", "value": "cc433a61f1df54235483ecbc0e4c65edca2b8a39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639069538, "uuid": "25425080-b116-4ca8-9d6e-101366de7941", "comment": "Malware payload", "value": "981b06722b14d3f1b419af13cfa04fa95b6923f952e4d5df494d996bbe39c89a51027e969606880cbd2e80b56376709f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069538, "uuid": "3701c0bf-8ae2-4183-8c56-032677bda30f", "value": "T1989549276DD2E0021C175CF69EFB56F4760BC84529224CA72B377645E0A6270FA6F38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069538, "uuid": "ccf6272a-da4c-42d7-b3ea-9b8e68e50442", "value": "ada2df5716cdc204b561f1444d64c9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069538, "uuid": "b2ebd798-1da6-4c54-bb4b-8a4c7cc2d2c9", "value": "6144:qpXjcPUqviYVZFiKXJxDPbOoJcfgQwJ2vkeDkCSHVmrOISZKByfjYoxj:qpXjcPl7FzHebpID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639069538, "uuid": "6af3bedd-fb46-49eb-b3be-aad42f230c01", "value": 2057728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639069538, "uuid": "ca05cca7-02f6-43f6-8eb4-e2305544b680", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639069538, "uuid": "a7f8c78c-d188-4923-a3fd-628aaa81fb0f", "value": "91a5720a4661f25ac7ed3aa680a51ed7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7378fc7-5913-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639070282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070282, "uuid": "e31613c3-b0d9-44d4-9e57-d49b90b467b1", "comment": "Malware payload (Heodo)", "value": "9a9fdc9efdd30c9214c0e0f63c8faf47", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070282, "uuid": "db75e000-fb0e-4288-8b4f-8e55ab382a81", "comment": "Malware payload (Heodo)", "value": "d19b92d3bcc66036bc13058f935a9eac08bca63cb059a8a93a21909c5c4e20df", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070282, "uuid": "bfb7fd60-b60c-4b4d-94b3-2396ff72e4ad", "comment": "Malware payload (Heodo)", "value": "66061b0475028b189c13e6e1838e0072ec63a497", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639070282, "uuid": "5a205903-9961-4d38-95aa-2428e6fcb3df", "comment": "Malware payload (Heodo)", "value": "00850f42ff49ab5e0a0819509a892efac2b0822eef94000f361aaa7622678bfbd1abbb4322f39c05f76d181848865b38", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639070282, "uuid": "24794636-9953-424e-8829-81a317543646", "value": "T1449301DBD295DD7EF8E6D438E4B7A0B82772C031C15C1E82628EDA48812D5C757FA2C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639070282, "uuid": "adcf351f-e7c3-4b59-a7fc-420989b687af", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbD:yIBQ3MYeGt9sLBrGrBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639070282, "uuid": "4f7141c0-5adc-480c-bc0d-d6b263dd807e", "value": 90158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639070282, "uuid": "8eb31906-0df1-46b2-9f62-9aa89fb39022", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639070282, "uuid": "670d2531-e470-432a-83ab-a43abb4c9c7e", "value": "emotet_e4_d19b92d3bcc66036bc13058f935a9eac08bca63cb059a8a93a21909c5c4e20df_2021-12-09__171731527152._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcca6fe4-58c7-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639037650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037650, "uuid": "29702f7c-b814-4835-b015-050854384106", "comment": "Malware payload (AgentTesla)", "value": "5546a65ecd28c3c53f9023ad28667f4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037650, "uuid": "b8a6754d-482b-43cb-b2ce-50bb577abdbd", "comment": "Malware payload (AgentTesla)", "value": "d1d83f66509f689e7297056c19ebe237e72d15ad30c02d97d2d257ebb8bd24d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037650, "uuid": "ed846dce-2a9e-4c0c-a3e6-e5594e75df46", "comment": "Malware payload (AgentTesla)", "value": "b2ee853e88c6568de1b3e51ac291ca0f950e3bad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639037650, "uuid": "b0a4f9c6-64ed-45c9-aad6-ff044a8bd2ec", "comment": "Malware payload (AgentTesla)", "value": "3a0dafd2078a85ac4180b92c4c654e4c5ba26078ae6b3c31343d2d14ba7761919c927b2d8a7032236fbd8965e05aed78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037650, "uuid": "1c650b56-3292-427a-96f3-304fd721eaa9", "value": "T1A28423A33A3F2DFD423150DA2E5560F09504960598705533A1BBFFA8FCD1A22B4ADDBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037650, "uuid": "46a97215-e6e2-449e-ae52-59498c06da1a", "value": "12288:k7u2VVNKYmyzkeRowfWiH9kbtJqPS2ZNG:kC2VV41eWidkRJCNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639037650, "uuid": "798f80b2-bb27-4c01-ba14-f6083b6aff11", "value": 400025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639037650, "uuid": "f67d6e89-614c-45e2-b73a-dd3f9a9ea0fe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639037650, "uuid": "b49fe81b-d93b-438b-aeac-dbf58f198f1d", "value": "\u66dc\u8f17-2199DO0253.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94113d94-58f6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639057661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057661, "uuid": "a21b57f2-16fb-46ed-8769-739158df45d2", "comment": "Malware payload (Heodo)", "value": "bc92916dadd74b3fef9c227351e19d35", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057661, "uuid": "4f64806f-0caf-474f-9813-b847a1969437", "comment": "Malware payload (Heodo)", "value": "d1daa0746a72e95372e0a959d4bfb73543e93ca49a38dc05466a53dbc1ff9290", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057661, "uuid": "270c47a7-5a03-4256-9e5b-65a52780c548", "comment": "Malware payload (Heodo)", "value": "233fbd3dc98cae3b391cf6933d0983a7261e2209", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057661, "uuid": "d988970c-18a6-4015-aa5a-ecf6e551f2f7", "comment": "Malware payload (Heodo)", "value": "7ac46a08dbe9b2210eea355c006c8b2a3d6d861ec478f69f5b22fd29047301147ed0b34043c93cf9ca77f5be9324e5f0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057661, "uuid": "4a2ce81a-f030-456f-9744-50fe8dac41a7", "value": "T18744BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057661, "uuid": "732ed744-c93e-4a04-afd5-63bd109b2040", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057661, "uuid": "23a2fee8-7e16-40ca-877e-d5c92e41e523", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBS2ypv:6jIG/pjjuLbJLmGshoCUnWTypv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639057661, "uuid": "88da680b-4b54-4612-8c0d-9e938607e866", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639057661, "uuid": "c1fc46bc-98ad-4ece-8ae6-fb6c56414187", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057661, "uuid": "801bf864-4307-4ac7-a445-0a26cc36f7f9", "value": "eODEBAJuTHzGwtxbQH.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1349cd-58dc-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639046589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046589, "uuid": "6eb0afff-5303-404a-aceb-c896a7d6b279", "comment": "Malware payload (AgentTesla)", "value": "a257fca64db3791ab3cec8b4b8249b10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046589, "uuid": "069112fa-f550-46de-8b65-b68cbd5b95e9", "comment": "Malware payload (AgentTesla)", "value": "d201d8488d316c9ab7d537545efeda284568a652f23db17584f9f26a62ae9d30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046589, "uuid": "6fa15251-9c65-47f8-a8d7-b0daf358433d", "comment": "Malware payload (AgentTesla)", "value": "f21ccb20e1552d2a541893da0dd6d0c811de208c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046589, "uuid": "38df43a6-e6aa-4029-8e50-518756644b4f", "comment": "Malware payload (AgentTesla)", "value": "cf889e0350fa198f13b6171fa7905931b2ec154286ed1fc0acc57fa34e8aba51094f80bfe623ea6725bc26d11dee29ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046589, "uuid": "0c612212-d5c0-4e5f-82b2-f7b05ed20837", "value": "T1C635127E36D363CED44086B53BB9A0B426667D3A9527C28CD58A329F0E377417933722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046589, "uuid": "227303e6-393a-4c9e-b3f1-e17ae3542ad1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046589, "uuid": "023a2cb8-aa10-4271-b7d8-c8c19dbdee9e", "value": "24576:Os6zdsLPgNJQ5h7dkogLfVV1zSHBZCt+8R:OPargIkFlSh488R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639046589, "uuid": "24f3e6dd-b8a5-49cb-b1e6-b4d391c9236f", "value": 1090048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639046589, "uuid": "78f1be08-f5e7-484e-b49f-3a5aec25daa0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046589, "uuid": "f0940e0b-8193-4826-bddb-c315f4e4601f", "value": "DHL AWB - Commercial Invoice And Shipping Documents 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4b0a53-590a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639066315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066315, "uuid": "27b388bb-41a6-4b7c-a143-f17e25dfc708", "comment": "Malware payload", "value": "b46110242203fbae5f78009f1693dc8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066315, "uuid": "6e1c0916-3328-4764-b373-31d14ed5d37d", "comment": "Malware payload", "value": "d423c7f5e8c45d00ee2873eb014d5eb49942c1521afacb4e6ed2b815f310e7ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066315, "uuid": "b1817600-d9a1-4cb2-93be-3895001f09fe", "comment": "Malware payload", "value": "70e7411a2526cf5b54ea234e92e35db6a7b47894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066315, "uuid": "42c3e509-0b2e-4e51-858b-6c15c4b46e88", "comment": "Malware payload", "value": "a734c94a178d8bf1fe5c02bdd83b1425d40edd8d90cafa7777d4650085dfb7f0e5ab0dd3bca653afc845b880e3a4f4b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066315, "uuid": "dd266ca2-d312-4e6e-a927-8cdd3ae7dd44", "value": "T1A5E4B2383AFA5019F273EF758AE874A69A6FF7633703A45E205103864B13A41DED153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066315, "uuid": "044e9f7f-073e-4733-bb9d-525d4bffe02e", "value": "12288:/2T16e859WHPOX8pvCNFYyq1r4a7m45CR7Wsj8/9s/QvQksI+4iFl:/A16e859BYOh38Md/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639066315, "uuid": "90363fba-41e3-46fe-9c7a-35640f16d959", "value": 695719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639066315, "uuid": "f1afd4da-7eb1-4d66-a7c4-45011a60b1d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066315, "uuid": "65ce30f5-4ff2-470a-bea2-70f61dfbd1e7", "value": "b46110242203fbae5f78009f1693dc8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5d18b5-58f7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639058102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058102, "uuid": "9a017fa7-6722-4356-9aed-9e05198612e7", "comment": "Malware payload (Formbook)", "value": "dc9972a50f3ff6b0e1616962a9abc103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058102, "uuid": "5e75beac-e4fe-46ef-b087-8772791cd359", "comment": "Malware payload (Formbook)", "value": "d43d98f0394d01f1f3b1c5ac07a736b6360cb77320862c52c1c70b84cba72967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058102, "uuid": "ecc2d46c-9a6d-4e12-9038-07b8c959f199", "comment": "Malware payload (Formbook)", "value": "54d19a27a612420baf15e5759ec3d7f19db2dc5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058102, "uuid": "cccf19ec-96a2-4ecb-8c06-1a1258287a41", "comment": "Malware payload (Formbook)", "value": "462e13a962f993f6a1bcad7ae68e3e48996973a343885dfd7192ca03af5efee70a94830dbaca5ba03262972238f8e443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058102, "uuid": "70bcf20c-c1ab-46b2-b687-850ba777ee8d", "value": "T1AA45220E29B195BFC27986F5D387D0108EBAF0062D73F6B16DD101FE7B38A899602752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058102, "uuid": "368b8112-b2be-4ed4-8af2-969a5fede492", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058102, "uuid": "ac9c5e3b-70d1-4435-9a92-97e201560353", "value": "24576:KIKjy/SYCppoFlixkcllN5XSVjKYgbZqtfUg4JXEiX3DHXKe:YjASRonds5XSVjyZ0MZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058102, "uuid": "f4feb19c-1403-4c8a-90d7-cdea9de23675", "value": 1202176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058102, "uuid": "f581a5bb-e964-43f4-ab1a-0aeb7d48db3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058102, "uuid": "ff4fe4fb-58f2-42b8-bbcd-076df83ed00c", "value": "ruBu5lBmBkGbD34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228bc2ab-5883-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639008078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008078, "uuid": "53cca29d-ed1b-45e8-8c25-c01625382540", "comment": "Malware payload (Heodo)", "value": "54b42ec57c2099e3e3c27533b0269dd6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008078, "uuid": "35fbda5e-03c2-41bb-908d-584b0daaacd4", "comment": "Malware payload (Heodo)", "value": "d44d1e37a1719b7340f310b04d5d888bd91873e41ecb722a8bbc13bd605b12b0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008078, "uuid": "187c2866-e92c-467c-aa02-236583ae66aa", "comment": "Malware payload (Heodo)", "value": "f69372eb48ec7cc12a4a3da51e619817dd78a52c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008078, "uuid": "6dca887d-740a-4810-a83e-2572a2a6d7f6", "comment": "Malware payload (Heodo)", "value": "3ef71a74b43dbcea3fb530b34d42af1d6b92d572767106b4f81578f3a89d91cbb1164ee9d4756b463329b667758901bd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008078, "uuid": "1b4141d8-0564-4f15-be5b-c3987c5e1186", "value": "T19944BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008078, "uuid": "f92d65cf-037f-4094-be1e-759485d65e05", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008078, "uuid": "d3d6212c-159d-4175-9b89-1419113e2e3e", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTB62ypv:6jIG/pjjuLbJLmGshoCUnWTGpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639008078, "uuid": "edb1bf46-983a-4315-848e-45d0509a0165", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639008078, "uuid": "aa367da6-996b-49ee-801a-858ae3c8429f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008078, "uuid": "f855f76e-513d-4858-bcc0-cbe3dbc7d470", "value": "emotet_exe_e5_d44d1e37a1719b7340f310b04d5d888bd91873e41ecb722a8bbc13bd605b12b0_2021-12-09__000114.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd13387e-58c8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639038026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038026, "uuid": "82eb8d80-ea58-494f-94d0-e23b647dad96", "comment": "Malware payload (Heodo)", "value": "84c27af720ac15374187ae3de54c6260", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038026, "uuid": "6d33d264-348f-43c7-bea9-908b5db54fdc", "comment": "Malware payload (Heodo)", "value": "d4d0c4da446183d347c83da5d6d6b67497a63d40a0ca4a234e4e594e404099ea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038026, "uuid": "6c3c96fc-29b3-4a1f-8013-6b4d8e86e298", "comment": "Malware payload (Heodo)", "value": "015027be9043e7159d3b8e32673151e4c4c4051e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038026, "uuid": "142d148e-33cb-4b8b-b5ff-bafcf0167dd9", "comment": "Malware payload (Heodo)", "value": "2f8e2b6c5c5e53b6f512ead6df0658bb9b091b1f07bf7e186d277cb273106e16c4133a3f798df9b2778d59db92cdd729", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038026, "uuid": "f64892c3-471b-4938-ba91-8a93d60a7274", "value": "T1DF44BF10A181D036E5FF087A89FAD9BE466C76600B80DDDFA398187E4F6B6C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038026, "uuid": "9061cf99-b113-451a-b01b-33882b3e9634", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038026, "uuid": "e0a948f0-b032-49c3-bb8f-648843624b24", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBLmgL/S:Wvef8+h61mRcHL+rF6l5EAQWT7L/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038026, "uuid": "6e4e5a46-dee9-4be6-bf55-e41f104d7ae6", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038026, "uuid": "f510a67a-2341-4b7c-9c47-9f619ee91eb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038026, "uuid": "39a2575c-f58f-486d-a990-27d76012e7de", "value": "9z0UT6Xn6xiBi6p8L.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d1bdd2-58ff-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639061428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061428, "uuid": "6416acf3-04e8-4da1-9aa2-569a8ae654a6", "comment": "Malware payload (AveMariaRAT)", "value": "316f9fb56988da7f8e356893f98ac756", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061428, "uuid": "96209513-4b51-44b0-8e18-99feef102f8e", "comment": "Malware payload (AveMariaRAT)", "value": "d4f410bfc8af1bdeae99baae02ea2df264603577df0a36d48701fde4d71fbb77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061428, "uuid": "c87dbb1a-aa66-49cd-b586-1b0a3c3850da", "comment": "Malware payload (AveMariaRAT)", "value": "55b6557476909028ac4354892944931dcde27bc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061428, "uuid": "71789279-faae-473b-8d7f-d7d0f52e985f", "comment": "Malware payload (AveMariaRAT)", "value": "982fba8e50adcb2f9aae2daa58e550cebe59504c38089ba436abb27a353ca7a84ccb6346e5930edde3fc160dc9dd8648", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061428, "uuid": "d99f1ea2-0da6-461f-93e4-f13dfe2e277f", "value": "T1F0439D40FA846A84DA9ECB33E097C38507F06E460825C1CD4F993B6F5DB33E59A9E136", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061428, "uuid": "1402bfcd-484b-4370-96f2-ecaa586a666c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061428, "uuid": "97844b32-6061-4766-a6a4-39b58be36bbe", "value": "1536:RS7JjSblbEd4oPW53wDu3Y6Uk9jg+rr6GbOsKpeQiQKWN:IJjSbFErPWeDud7r6GiX8QiQ/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061428, "uuid": "3dfcfd59-2de4-4b38-9e0a-43c5082c6f0c", "value": 60416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061428, "uuid": "e8066258-5eec-4ef6-8134-b18d3810f858", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061428, "uuid": "4dd04280-2cd5-49b6-9447-1ffd9df7ef7a", "value": "316f9fb56988da7f8e356893f98ac756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c1efcb-58d9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639045263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045263, "uuid": "b7a0899e-79f7-4b89-97b8-d752d2268452", "comment": "Malware payload (AgentTesla)", "value": "4d4a3342d6b34dcd7401d5c218569fcf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045263, "uuid": "8193031c-f55e-4a4e-9665-e108c4728cbe", "comment": "Malware payload (AgentTesla)", "value": "d5184beab29bb778a9d1e1fbf51ae567651269391bb90ef467776db1a208cef4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045263, "uuid": "ad549940-69d6-45e9-9154-dd505b24f1c3", "comment": "Malware payload (AgentTesla)", "value": "e2463158a98e41131dba8fbd690d5c7a9d6c5756", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639045263, "uuid": "18745566-1157-471e-affd-7bbfa3c293b0", "comment": "Malware payload (AgentTesla)", "value": "654f7d0ecd6718dd9856be1e620909ab4d205d534bdbc3d8e048a2c735576c4688a8c0003b68ff9efe14f1cc396f70bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045263, "uuid": "5f26e944-43f3-4c1a-b043-41296852443d", "value": "T1F6D47C691182A7EEF07FD7B9BA203154D3F4ADF6D723E28DFCA630CA4563E446A11121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045263, "uuid": "72debcde-4f6b-4382-86ae-c0c647c1f66f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045263, "uuid": "b61da674-df77-4d2e-b30d-3282264f928d", "value": "12288:P13Su/mwJ9A3f100528hA7FJ3IVCOChz14jgeQXf248HgOASc:PNSzn8PZJ3SCOCj0u2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639045263, "uuid": "7c2f6ac1-e5a0-4ca6-a0e4-13c2c034efcb", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639045263, "uuid": "8216b93e-a95f-4e7f-aa36-9cce26c9f067", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639045263, "uuid": "bf6d716c-6b73-4a0b-8e81-a2575592f7f4", "value": "TT request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54fd0369-591a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639073017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639073017, "uuid": "d213d252-7abd-44ef-8d54-7746f93d4717", "comment": "Malware payload (Heodo)", "value": "37a88965dd52ae3d78d61e9bf6b7dd9c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639073017, "uuid": "9648f864-3c78-444e-a346-37ddfe10937a", "comment": "Malware payload (Heodo)", "value": "d69f3a0ab3de59ef3cd8461d88492993170d51dce254ee1097cb8abf5a0bf018", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639073017, "uuid": "ed83842a-0120-467c-ab67-7ff25f94b706", "comment": "Malware payload (Heodo)", "value": "d18c00d52fc7dcc6684593be1a345f590c2a5f8c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639073017, "uuid": "15912e90-33f4-49f9-a4ae-de4e27c85f6e", "comment": "Malware payload (Heodo)", "value": "ab9bdcaf3e14e0602535c30b3be3b7b6dd624c7ba59efa487608ef6249dd0ccf43ec2511c6c7438dc4142a4705dcdba4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639073017, "uuid": "7eaeca8d-191f-49d0-9117-af3e3363ceff", "value": "T1389301DBD295DD7EF8E6D438E4B7A0B823328071C15C1E82628EDA48812D5C657FA2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639073017, "uuid": "eabc5f7b-ee06-437b-94c1-d3ad1081596c", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbN:yIBQ3MYeGt9sLBrGrBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639073017, "uuid": "a2fc3a26-2c8c-41bc-be56-6f6221c0958d", "value": 90157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639073017, "uuid": "71263134-2e6b-46e6-8afc-9b9bae612826", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639073017, "uuid": "226d770c-fc5e-4c38-96c1-790693510f03", "value": "emotet_e4_d69f3a0ab3de59ef3cd8461d88492993170d51dce254ee1097cb8abf5a0bf018_2021-12-09__180305743155._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94518289-58e1-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639048642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048642, "uuid": "7bdc6e45-a538-4675-a5c3-fcf01bba87ee", "comment": "Malware payload (AgentTesla)", "value": "9b50051aa8a7a1077ad6f8f3c2d5321c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048642, "uuid": "55912082-7136-48ff-8276-7de728c18ce3", "comment": "Malware payload (AgentTesla)", "value": "d811659d6905c2836e86551a25405569c273a84e2caf6825bc431d2054a208b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048642, "uuid": "454c7966-f6be-490d-9f5e-5661be156429", "comment": "Malware payload (AgentTesla)", "value": "587e9bc2bfdacc90510693241e3c9c6f718c1b4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048642, "uuid": "c14a0bc8-6756-47ec-914b-c2292663152b", "comment": "Malware payload (AgentTesla)", "value": "b5bd4b32b097846d1cb0e2ba9580a7b87ce7c3d1140b89440411b26f0360d6a3436b324b741d4600a2eee66fb22ec0cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048642, "uuid": "486d6ea5-9f83-4caa-8e6a-4f8af2cc5a0c", "value": "T14E55231A2EB4D46BD13C6AF5C6ABC0608F79F0072E63F2B60D8511AD7E74AC99543F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048642, "uuid": "affb5948-dea8-4359-95e8-f28ffaa57828", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048642, "uuid": "9a5d611b-a5be-45a2-9245-acbdfbb999ed", "value": "24576:sIKjy/SYCpDbD6UT+xfZ5/SxdJRVwN7kSZFzbJPybZCSvS0fWIWyfL:qjASbLTQB5arvVwNCCSvS0uXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639048642, "uuid": "0e6bd899-fa08-45f3-8907-8150a18069bf", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639048642, "uuid": "11c5c40f-7ada-4dea-b141-6f76e6a97ed7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048642, "uuid": "1f6005e6-9b4b-4d20-9d09-1489b2c6e555", "value": "PO PJM2021PO283.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85d89ea-588d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639012624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012624, "uuid": "9bcfe3a0-a1ca-4a25-841b-7d0a7f011b93", "comment": "Malware payload (Heodo)", "value": "9637ebadf6948d750f703eaa1bafa212", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012624, "uuid": "cc96ab5b-b45e-453a-aa62-4e9c511fc15b", "comment": "Malware payload (Heodo)", "value": "d84fd80831ecbb8b7d3ea1ca94c64cc67978dfb92011df8a4b734f011b0f6a03", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012624, "uuid": "b3de456b-f26a-4561-95c2-6d3436af363e", "comment": "Malware payload (Heodo)", "value": "c623e0f07a9e8c49c3bae9cdc446ac7d32d4d97a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012624, "uuid": "e15f5e99-2ec7-45e4-b10c-5c4b57c9ba45", "comment": "Malware payload (Heodo)", "value": "bc1765c2a121312b710eb2cceb6760dfe06083e4be15e3ff18dd4ae39fa4c10e27381e158dad4bf922629416085c6c1e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012624, "uuid": "2aaffade-c08f-4ccf-baa2-07259739722e", "value": "T18B44BF10B181A031E8FF147A89FAD56A4A7C7A100B80DDDFA3D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012624, "uuid": "f5e3d5ab-a166-47f0-b3ee-1b58367e78eb", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012624, "uuid": "d6eea590-4047-47b1-b514-13b0f2e29c39", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBE2ypv:6jIG/pjjuLbJLmGshoCUnWT0pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639012624, "uuid": "ce5982e5-f629-4600-af21-6c7c6057e9e9", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639012624, "uuid": "b0cc024c-194f-425c-9bca-6bda2d1b5603", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012624, "uuid": "12f60a2d-31c5-46d7-a02d-e09d858baf25", "value": "emotet_exe_e4_d84fd80831ecbb8b7d3ea1ca94c64cc67978dfb92011df8a4b734f011b0f6a03_2021-12-09__011659.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e8f895-5900-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639061747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061747, "uuid": "cc6cae88-0642-43eb-81e6-d03ba4df9ab3", "comment": "Malware payload (Heodo)", "value": "604c0a9f88543404c7612abd1beafdf7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061747, "uuid": "bc793848-4669-442a-bdfe-203cab99631f", "comment": "Malware payload (Heodo)", "value": "d88dd396f704e6960eb6137eb6c8ef401700c2b021f80cdaa0cfa9e34ea0ad88", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061747, "uuid": "1836dfd2-4f7a-47bf-a9a2-076aeb3c9724", "comment": "Malware payload (Heodo)", "value": "e0ec543f80160d9303be9e0030fe135e39a635d0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061747, "uuid": "62d56152-0e84-4947-9d55-2d4912380060", "comment": "Malware payload (Heodo)", "value": "b6ad08f5e5bbad9af98ca9aad23ee2e917deaa2b37f1c4a0b3693988dee6aa4365776deffe5bd8e83abb75b90a5996aa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061747, "uuid": "39ffff7b-bd04-4fd2-9805-a1b528671554", "value": "T13B9301DAD295DD7EF8E6D438E4B7A0B82372C035C15C1E82628EDA48812D6C757FA2D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061747, "uuid": "b8c03a12-73ad-44a3-a1aa-c91535228072", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nba:yIBQ3MYeGt9sLBrGrBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061747, "uuid": "5b6a1154-8abf-44b5-8b4d-4f511469e0f7", "value": 90156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061747, "uuid": "975f0677-4a3c-468e-ba7d-dfbcc26dba08", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061747, "uuid": "c0104d4c-2ffc-4ad3-8272-94039077ef63", "value": "emotet_e4_d88dd396f704e6960eb6137eb6c8ef401700c2b021f80cdaa0cfa9e34ea0ad88_2021-12-09__145518927071._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b02f6d-58d5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639043403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043403, "uuid": "f5e8478d-23cf-46c3-b266-d0c0b82d0d36", "comment": "Malware payload (Mirai)", "value": "e48b301eb012cd8be3a02799adc23d62", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043403, "uuid": "8abbd8d7-0b9e-4efd-a245-99e332227761", "comment": "Malware payload (Mirai)", "value": "d8bef4690eb02103343306c1a66ecd8cdf72f645cfdb492413dead6f1d591c94", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043403, "uuid": "1f2f9f94-9474-470d-b403-dc4fa3583eb2", "comment": "Malware payload (Mirai)", "value": "94dce751b87dafaffe44448f5d53557cc8573d1f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043403, "uuid": "8ef097ce-b084-4d13-a306-0a31bf39c45d", "comment": "Malware payload (Mirai)", "value": "443ed8581c7801d9728aebcdd10732475bad381dbab3e1ea65627529dd35ec9b3ef6651f0182ec4bd7818d5c9d86a297", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043403, "uuid": "d7397be6-43e8-405a-9761-07a0d731357f", "value": "T109B2E1C5D6FB17C3C2529332E0BC8A4CD1721AC1078A440A1109B69EA29770E8BFB3A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043403, "uuid": "a19117b1-4721-4e6a-a789-6da7dc97e254", "value": "384:MVDKKQOcRpmYLdn6RBOFRFt5rUF81uiSSlCo3AnupVFNqnrrd1NEZgO8UXWozPLH:w/QOC0Yhn6ROHWF09cwNPFCnNBxcytcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639043403, "uuid": "bf42ed1b-ac26-4a8c-978a-06366973b844", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639043403, "uuid": "79c59c06-894b-499a-8d66-eb7f09a91e57", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043403, "uuid": "d0031667-5a0d-46ad-bee8-5983ff6f5cce", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f24e614-591a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639072926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072926, "uuid": "8e5e79b7-a57a-44dd-a105-48a9a05a1a3e", "comment": "Malware payload (Mirai)", "value": "18bf70677d68e7503453e6cbc079d404", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072926, "uuid": "af8ffc95-1c1e-46bf-82eb-943c0ceffaff", "comment": "Malware payload (Mirai)", "value": "d8f19d56300803c6a843d17e90578e10cde7fe103628c580581eb48e651e1130", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072926, "uuid": "4a24ec58-e24c-4821-bc18-1922abc86965", "comment": "Malware payload (Mirai)", "value": "8c69102137cecd455123ca861d21224a6e3e0e35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072926, "uuid": "6ab70834-a37c-4fed-bb90-30f99894dd79", "comment": "Malware payload (Mirai)", "value": "4d70068635fe049fb3529284ee8af99d0a62ed53d4b34820836a6ea40388571cc9d77800bac8b47b23d2167aad2f9334", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072926, "uuid": "38989387-01a7-49b8-8655-f7f976bfe9a8", "value": "T1EED2D1756B1000FEC912E4B11E661FA21FE07FB3588BA9049A597756DD8E2E93C83DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072926, "uuid": "2634a545-9643-4ec3-9e84-89e8937a7660", "value": "768:wPdIa/60HaC97oKQkTq6TfSPCdwZiSEY5CK5vakY+3Z2wyTJgGlzDpbuR1Jla:ueo/aC97oRk2sfkCdOvSKpgo8wMVJufa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639072926, "uuid": "4ebf489d-583e-48eb-95d0-63b2b75fa0bc", "value": 31116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639072926, "uuid": "1d99e3ce-5573-41be-9081-48982789654e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072926, "uuid": "c7a56efb-6159-4482-8d56-304caabdcfb5", "value": "18bf70677d68e7503453e6cbc079d404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e687e4f5-58c9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639038472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038472, "uuid": "d55c0d4c-9d5a-43ab-b646-bddc035f71a9", "comment": "Malware payload (Formbook)", "value": "39d42aed02ac7a240d6ca3210da2fd2e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038472, "uuid": "1112fb78-27b3-4452-9885-942784647db2", "comment": "Malware payload (Formbook)", "value": "d91a0e0ec388ca95e6f9084ace490109a28d5469e61e12d680fd96492b81d615", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038472, "uuid": "23549526-8d6b-4b8c-9235-c348aab6cd57", "comment": "Malware payload (Formbook)", "value": "da33cb22a0ed1a953dad4be9a91d5b694aed33e5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038472, "uuid": "40484e54-75e8-48c6-a7fe-dd781e4ddefd", "comment": "Malware payload (Formbook)", "value": "34ffe9f257f03303862cdae8003ad63356771d9b34e06c5e4b9f3d8e13734b489f043a8ec2c445722c9432baa1c6b38c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038472, "uuid": "878c258a-500c-4715-bffc-76de22685b13", "value": "T123253368F1F1B10AFC7C1F942AD348617AB187164ECAADDE1DB71B536F440C8A7162D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038472, "uuid": "ece9c006-9bf8-4163-a110-e6b1dc8fb201", "value": "24576:FUvaFm9V5vicX03NzhXzpHIWd46MJyKVnKZwj98e/CMuRn0UVOmn:FUSFaV5v7X0FhXFHIWd46TKVMwx8e/Cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038472, "uuid": "d5d46de5-246b-41d9-b636-476aac809c26", "value": 993380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038472, "uuid": "073deb37-2529-4d6a-9667-c559a1020695", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038472, "uuid": "648b5b61-15c9-43f6-bb48-e97c0bf0f953", "value": "(RFQ) - ATTIQ 10230-2413.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321aae9f-5900-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639061791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061791, "uuid": "7a34f6e4-b099-44d9-a78a-4a96f188e1e7", "comment": "Malware payload (AgentTesla)", "value": "dd87076299b0ff0945412bff793b7f95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061791, "uuid": "8babe6a5-ae16-4803-91cc-826f6c10b0a1", "comment": "Malware payload (AgentTesla)", "value": "d9e47df5fcc2f52479d4c6ecfa745d0a299c197d5e4f81186bcd67d816db356d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061791, "uuid": "bce22dde-4f05-45d6-a5c5-68a1a0545828", "comment": "Malware payload (AgentTesla)", "value": "7ae483586a1ec5723885eb72315fec0e6a002d9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639061791, "uuid": "56277fa8-d71b-43f0-9d6f-0026b5ced6fd", "comment": "Malware payload (AgentTesla)", "value": "0cd66876d7b930d0188945c22af6b151018d20fceaeb33079d50c83585233d630897c0eff1b5c88de13832dec140c124", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061791, "uuid": "2806baf8-9d00-4e43-a8d0-b4e24991b9ad", "value": "T19DC4123926AC5B1ACBBE177DB06541105B3EA256909BE3CE3A1D14CA1FE3343CE5139B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061791, "uuid": "7ca90f4c-30ae-47ff-8414-b4a6b7c56924", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061791, "uuid": "735220ec-c8b3-4189-b26e-5d9ca48ecdd1", "value": "12288:El1C/LZbHpNTBdOEzcs+MbUlwMtyMAj51ZHNKQE:0yLZbHp1O/s+iiZHAj75NKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639061791, "uuid": "bcaecdba-2b3b-4899-8027-621caecfbe91", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639061791, "uuid": "e23bc62b-0dbb-45f3-9d10-ea5036a34618", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639061791, "uuid": "f4ed2456-0e6c-468c-9ca2-0dee648eba2b", "value": "dd87076299b0ff0945412bff793b7f95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd91d74-58af-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639027263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027263, "uuid": "473d726d-4ddc-429f-ad4f-d4b429b53762", "comment": "Malware payload (AgentTesla)", "value": "e1fe810467915db72eebe78ee3ffa4e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027263, "uuid": "1c787292-5490-4d1c-99be-8fa7c83afec3", "comment": "Malware payload (AgentTesla)", "value": "da233d15345376c2301f1883c96ec8282eca579d4dc8d365c2861efa653bbb12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027263, "uuid": "348e7429-d852-45f7-86d0-06cfeaeb4ff2", "comment": "Malware payload (AgentTesla)", "value": "820729665989842c7b2aeb72aa9e0345a0bd99dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639027263, "uuid": "be3d7b1f-bfa3-4bdd-ad50-367e17a7dbcd", "comment": "Malware payload (AgentTesla)", "value": "5bacbe9948b41938ae620f9a5b1919c30d49bc038270c43702cc59125739ef2c76b7f3704741ba33241b8d60b24379f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027263, "uuid": "f7c7caf5-e56a-4461-b613-7e33578eec15", "value": "T19C35F020996B811CE89335F40F12BD921EAF9EB9C001861A237EF268553E75BCF257DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027263, "uuid": "c4422930-7b02-4540-a52d-47deb35d2e5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027263, "uuid": "b2e08a6d-95a7-4c10-aab2-60b3c3dfed12", "value": "24576:PRLIDGBU0Gk204U+LdICKiD5EyJGthyqC/oli8oHwYOzZw95p:PRLIDoAk2U+LZPtEyEtbnVoXUZY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639027263, "uuid": "b502230c-af05-4728-9383-e7af39e79bed", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639027263, "uuid": "c713270a-9aca-4986-9624-fe9e4b4c2575", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639027263, "uuid": "388b1011-5093-4cbc-ba31-2c6d8da0628e", "value": "REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce1605a-58f1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639055635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055635, "uuid": "b053bdb4-1b87-4491-9dfa-048e65829688", "comment": "Malware payload (Formbook)", "value": "7aaefe517e42446b2f1ca85cea237933", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055635, "uuid": "8a630cdf-f660-4fc6-ab60-44e66f29af77", "comment": "Malware payload (Formbook)", "value": "da4920077303172dccaf8ea8c05798485521adaba58adcc48615dd8142b3ec2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055635, "uuid": "1b6f374b-bb7d-447b-90ab-c4724f4790be", "comment": "Malware payload (Formbook)", "value": "392b8a7a5827cc38c84856fe97aefd43a0a5ddcd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639055635, "uuid": "374f5a59-7ac1-47cc-9f66-ead8931824e4", "comment": "Malware payload (Formbook)", "value": "317d6caa4f2ec5706f9076c8c309ac9b9640224af95b8321752d47e850c178b9290e92a60268db96af34bbae196ee29b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055635, "uuid": "c8b88f47-2c5f-4730-b12b-d85844936258", "value": "T13A64130355E1EF23ECE200783967A75E92BE83B90337A54793541FB6AE375C3854D889", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055635, "uuid": "a8945ff1-3116-4ef8-9152-92d1cd5762cf", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055635, "uuid": "cf667cff-863a-4685-aefb-617382da2dc4", "value": "6144:rGilyaV9VmS06frAVo4L9bnPrkgwZCwectu1alx0zYveTIR7it9GWqWg:hxV9X0kAL9L0ZC+u1cqaGIVitgWvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639055635, "uuid": "de33eb75-2b2f-4a38-af9d-66472e4a7c24", "value": 310491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639055635, "uuid": "dc8e540b-49ab-4066-a228-20aac519e42e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639055635, "uuid": "cfc8989d-f283-4ab1-8c7a-bb21b3f0b014", "value": "7aaefe517e42446b2f1ca85cea237933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30bda291-58f8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Stop)", "timestamp": 1639058353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058353, "uuid": "128b16a1-eee9-4a9f-a1e4-2dc6f563a02b", "comment": "Malware payload (Stop)", "value": "6a22e6ff14bb12046a9e8a1cf21ebbfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058353, "uuid": "51da13d3-41e0-418b-9e34-bcc2e93b6cce", "comment": "Malware payload (Stop)", "value": "da9a15747d513bc835e35a0b37d1649976c06df46c2185d446fd26db3f4c8416", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058353, "uuid": "1f5e900b-41d1-4809-b02b-7244a7ef28ef", "comment": "Malware payload (Stop)", "value": "aeb7b5a0037a392f90b4649b960e1b7ed91ef467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058353, "uuid": "a4d0af27-5ff5-48ee-9b4f-b4b97f784ab2", "comment": "Malware payload (Stop)", "value": "457f2a2babbd650f96f655f6aee0faebaa9a8b672e9d5ea6ce63caae9cbe2b8bf59548b2393fcc108b840e7426d340eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058353, "uuid": "029a43cc-e8f9-4c98-afba-b255a8aad3e4", "value": "T15EC40239A28285BBD0210A35885BD276B53ABF041F7C15CFB7DD0E5C8D2335A2A753DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058353, "uuid": "249a91ac-a36b-48fc-ac93-58cebb291e6b", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058353, "uuid": "4765b58c-8bdc-4a6e-adaa-10ef7e9da69a", "value": "12288:pANwRo+mv8QD4+0V16Hs1fK3mge1ycrVaGGPkSbsoiVLLGHtY:pAT8QE+kcii3w1ycrVadPkSoXtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058353, "uuid": "0e14771f-cfb7-42da-bc85-3a32c592f378", "value": 568068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058353, "uuid": "62418b74-c7b3-4eaf-a49c-f926da935dee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058353, "uuid": "d25cdce2-1cf2-40c2-a910-592a31c9a76c", "value": "da9a15747d513bc835e35a0b37d1649976c06df46c2185d446fd26db3f4c8416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01984c0-58d7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639044393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044393, "uuid": "def3becb-3e37-4b1d-8f91-de73dd9506a9", "comment": "Malware payload (Heodo)", "value": "2302751fb6d50553d813d79c95228052", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044393, "uuid": "30efc31b-2610-4743-a53a-308e9d2c8801", "comment": "Malware payload (Heodo)", "value": "db1bcc1514cc7c5251784921be912398fe773f48bef8ce90aa1ecfe5381b8f5f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044393, "uuid": "28da7cfe-7731-464b-90ea-3acf2af6cbf7", "comment": "Malware payload (Heodo)", "value": "0a2b6799b440b1fcf0149e4b1ad288983399853d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639044393, "uuid": "6c75db68-95e7-4e55-a408-f4eb9d776994", "comment": "Malware payload (Heodo)", "value": "f7e3b58f3c447d5a6a99645d5864693baf06593a249e48256fa42b4bf02bebfd1b0bd63e1e46ab796a79d13bbec62e33", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639044393, "uuid": "ca800c11-c99e-4478-a45b-616c05622675", "value": "T13C9301CAD6A5DE7EF4E6D478E4BBA1B96333C036C1481E82914DCAC8812C5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639044393, "uuid": "17eb2136-f736-421b-8151-6b36e78fe411", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3B:psXZ3MYeGt9sLBrGrQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639044393, "uuid": "6ae0cd45-bcaf-4bc0-b10c-d8e61087620a", "value": 90151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639044393, "uuid": "f50bd492-fa19-4de6-a78a-322b19e69bea", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639044393, "uuid": "e0b59ff5-5884-43c4-92d0-20c8e51f61f9", "value": "emotet_e4_db1bcc1514cc7c5251784921be912398fe773f48bef8ce90aa1ecfe5381b8f5f_2021-12-09__100611099183._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca24a3b-58bd-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639033194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033194, "uuid": "058cef20-5728-4333-a1f8-21e7c1c1f32d", "comment": "Malware payload (RemcosRAT)", "value": "9db00ab44006ccd6a5c6c09586fd4121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033194, "uuid": "86a9a92a-b6bf-4139-8610-847fd27ae963", "comment": "Malware payload (RemcosRAT)", "value": "db5b52f3949ca7cb29e009535f1d2021b0f24b4e114717a20e86869abae48850", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033194, "uuid": "b26dce8f-4268-469b-a948-58a60397d226", "comment": "Malware payload (RemcosRAT)", "value": "7f906781a3184cd54ab8a0aa89af3d710db5ac00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639033194, "uuid": "7948ecc1-5805-4e30-85f1-273ce908d21c", "comment": "Malware payload (RemcosRAT)", "value": "5995fb2304889dcbcc888138952a8bdd0b86451d2fcd43c65a92eccf29f0f9043bcdcdf83d1c1e490ee791fa1e12df0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639033194, "uuid": "5cdf320f-f361-431d-ab07-74f8aab33bb0", "value": "T1C0358D267190D873C13B06B9CD57E7E42829BF11AB14ED8737E57C8E1EB9680B816387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639033194, "uuid": "8b32f778-6729-4170-886c-0fed6fc262dc", "value": "63129113d28408f1ff3b0b14b238be7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639033194, "uuid": "0905b6f7-4671-4c95-8b71-f4279cc0dc08", "value": "12288:IZLuO0wmv2pdKSKVLmbPy7PXjW1ebIrUxhmKQHwy22NwtIKmmTIy76dFRcqz:4CRv2pvAmbPy7PaYbIryhmNgtIKuB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639033194, "uuid": "b36c843c-13a0-4eff-b1e3-f8e9157a6047", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639033194, "uuid": "fb58dbb4-bedc-4610-8d32-85f5308bbc05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639033194, "uuid": "012af689-360d-4cbc-9bd0-aeeb7a413e92", "value": "DHL_SHIPMENT_ARRIVAL_NOTICE#424253-DEC-06-DOCUMENTS_FILE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066a2718-58ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639052269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052269, "uuid": "f8b11c1d-09c8-46de-9ef8-1bf0c1b76783", "comment": "Malware payload (Quakbot)", "value": "32d515e10d19e25546986e51c567b4fd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SALES e MAINTENANCE LIMITED", "colour": "#5ECE08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052269, "uuid": "8e39b006-38a2-467b-bfc5-0ab243984afc", "comment": "Malware payload (Quakbot)", "value": "dbac4888cb2be8a41986d0992abcb7215556da786e9b12759f6a39eede97b5f5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SALES e MAINTENANCE LIMITED", "colour": "#5ECE08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052269, "uuid": "98991b7a-f93d-4b96-b64d-3510607a618b", "comment": "Malware payload (Quakbot)", "value": "cef7b00e1ffd60de4f78393db7eae14b6bf8c395", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SALES e MAINTENANCE LIMITED", "colour": "#5ECE08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052269, "uuid": "e6801544-5c6f-43f9-805f-c9357cbf94e2", "comment": "Malware payload (Quakbot)", "value": "21cfba06355361403ed5eaf77d3bce688335e67bd8e65f8777afabe3b432a25f0c18791d497fa835d5a33f923d471fda", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SALES e MAINTENANCE LIMITED", "colour": "#5ECE08", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052269, "uuid": "7f418087-4049-4cc7-a823-167eac5e573c", "value": "T1EDC48E76B6C08837D12325389C1B6664AC35BE503D2858856BE46ECC7FB97813F3729B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052269, "uuid": "cad6330e-f855-4452-8f09-3c3624385d46", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052269, "uuid": "7d621a48-2591-457e-b7d7-9cd244817615", "value": "12288:vWXcaMsRJed93y4JPIkFdHl1L8G394a6r6Q8ai4efNQax:vkrMwi37Tp1Im5PQ8aZfax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052269, "uuid": "92e388f4-ef70-441f-9104-efc10edba8d8", "value": 576416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052269, "uuid": "89bad191-817c-40e7-b9c3-63f3722c976a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052269, "uuid": "63cc7564-0be9-4494-9249-e48305dbab5e", "value": "2021-12-07-Matanbuchus-DLL-Volet4.ocx-thru-Volet6.ocx.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b96b80-58d3-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639042524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042524, "uuid": "6a566887-6d41-4539-8799-5fe4ccbd43b1", "comment": "Malware payload (AgentTesla)", "value": "c12c005eb94f8e9a7ecdb3807df6c4d7", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042524, "uuid": "189a14c3-1a33-401d-bd64-07638b1133f8", "comment": "Malware payload (AgentTesla)", "value": "dbd4e2a77e5f576aff441c141fa2b63fc789a04804021af7f05b00bb948c37df", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042524, "uuid": "e7dba71a-b3dd-41fb-a12d-816f5eb42d87", "comment": "Malware payload (AgentTesla)", "value": "15789eef16e68ceca749beca736142d2399f997b", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042524, "uuid": "c3ee1597-46a0-4b5d-9810-40b883e7401e", "comment": "Malware payload (AgentTesla)", "value": "e37f20a958c1e3d9e293d218084ab719181ab5f42526a35a2987dc4132bd6af3a64c28461f93668737e254a63abf7c4f", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042524, "uuid": "1607396c-8c32-4aab-a2af-1b03e4245653", "value": "T16AA2D04D9324680CECFC7BF6C2A2FD4E116E0653D446F2E658FD62D85171BA27B0292D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042524, "uuid": "2739cdbd-ca8d-48bc-9080-24d7b20df73f", "value": "384:18rej+ok8w5tNpBndBnapsP98ADW8GNE8bxI1svgAvkwMqR7CyW3Zt2vK9l1p:Krg+dzNHapsP9lPGNEkxmyW3ZtP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639042524, "uuid": "b0c220d4-7506-46e1-b7e1-b356b21e2afa", "value": 21296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639042524, "uuid": "42fb4c97-c781-4355-8173-91dc4897acb2", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042524, "uuid": "296ad84c-3a65-49ce-ac01-ca8ed2111560", "value": "Payment Slip.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5335a74-58e9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639052133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052133, "uuid": "750b3a1d-554e-4d39-9765-eee71de9e243", "comment": "Malware payload (Heodo)", "value": "f4a660d3ad628616eace21ffd6a30f97", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052133, "uuid": "a15627e1-493e-4a45-8611-00b46ea76131", "comment": "Malware payload (Heodo)", "value": "dcdf1d6c0f3863cb8d96185840e8a08edd2111eabd27720a6fc9019c0f0b7e91", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052133, "uuid": "99cbfb99-30ee-4410-901f-992721541a44", "comment": "Malware payload (Heodo)", "value": "5b3bd847ff10644c14cf95abc1486197a2000995", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052133, "uuid": "0dde2075-33e0-4770-a23d-a813aac5826b", "comment": "Malware payload (Heodo)", "value": "326c98e622c753d5875ba1635be64fb12333d169f3e1f03640d92847b0aaf8083834b8ba97a6d076c73198ac8c2f8c8d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052133, "uuid": "f161a303-08f3-4767-8ed9-17246c9fc8ef", "value": "T17D9301CAD6A5DE7EF4E6D038E4BBA1B97733C036C0481E82914DCAC8812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052133, "uuid": "19fd2ce1-0c7c-48cc-9376-753ab1f34471", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q31:psXZ3MYeGt9sLBrGrQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052133, "uuid": "1fa82959-545d-4d58-82ef-0270118e9955", "value": 90150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052133, "uuid": "25f710ad-1adc-4b00-938e-7aa2e04318ea", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052133, "uuid": "67b39285-056c-4a99-bf52-c230208c86be", "value": "emotet_e4_dcdf1d6c0f3863cb8d96185840e8a08edd2111eabd27720a6fc9019c0f0b7e91_2021-12-09__121506684823._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3099687c-58c6-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639036878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036878, "uuid": "5afd50cd-ceb2-4cbb-a951-afe83866691c", "comment": "Malware payload (AgentTesla)", "value": "1c56efcdeed48a0d8148887f36ca961d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036878, "uuid": "9739e522-41e9-4a75-a2cd-6ec046e60295", "comment": "Malware payload (AgentTesla)", "value": "dce46a0df57e1690383eda1615785d6dc5a13b879c7584b1bc17d42ef2fb61d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036878, "uuid": "ed7c61a3-2262-415d-8b05-09b3bd6843c6", "comment": "Malware payload (AgentTesla)", "value": "c378b93b702bdec89c02ca947f006d92f0e9be51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639036878, "uuid": "8d55f424-6777-4f30-8bcf-b150d4c9c966", "comment": "Malware payload (AgentTesla)", "value": "ded45d94908e30704b365d97d76a6d9a73eb6f4825a07c6e180163e8c28f6f1ecec667d9573332da20491bd9c1bc4999", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639036878, "uuid": "a8b77caf-2eab-462f-b1ab-be44a4108adb", "value": "T1092533CCF25E56A739B101CE680E1C0A42B3BB282757934A37209E55FAC2C9FB714939", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639036878, "uuid": "9917bae0-8df3-484c-8c35-8c3ea287ac96", "value": "24576:jtTqLNSZvW3zCcGWT+T+85FgJUHGg/pMEDTE47:jt+pS1+fGJ+85s5gyHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639036878, "uuid": "0ea679a6-734d-4e95-a27e-2115a344b60d", "value": 1047495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639036878, "uuid": "7159659e-bb18-4ffa-966f-2c50467b13eb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639036878, "uuid": "7aed8c54-cbab-447f-a116-cbe0feff62f4", "value": "ASEAN SHIPPINGS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af57062-5903-11ec-96a4-42010a9c0029", "comment": "Malware payload (Guildma)", "timestamp": 1639063014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063014, "uuid": "b58839fc-063a-4013-8472-4d47ba74407c", "comment": "Malware payload (Guildma)", "value": "13c4b61f395c580bc4f57d890191a34f", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063014, "uuid": "d9c32391-f9d7-402d-8344-d586401cdb59", "comment": "Malware payload (Guildma)", "value": "de236674997a112373395502db73915f63086beb23b3453a32008d53b9117346", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063014, "uuid": "a29c6ad0-26bb-4cfd-8f9d-97835a3d4893", "comment": "Malware payload (Guildma)", "value": "9ffa3e4ef567eb477a7169982df1c197108760f8", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063014, "uuid": "d7458445-11c9-446c-a969-a5d5f9f51dd2", "comment": "Malware payload (Guildma)", "value": "1d7332cc671db0bc447dfaba037e01c9002dc07a47c506e0308510aac4030cbd7f0f0dcec58fdf1355512ced868b8da4", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063014, "uuid": "2fa95689-3b22-4fb6-9521-f6605a50a399", "value": "T10DF05C6917386797C1B51A3DC4310E509934A45AAC40BA3D52E01644A2645C1EF669BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063014, "uuid": "2508b81b-0e53-4c82-aba0-47056fc915fb", "value": "12:8DpOB+PlyWfwEV75FsSISuFxlNz0YgXGrgSUY50GgT:8HPlDoEeIuHl90yD0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639063014, "uuid": "f64582f4-da02-47e2-a05b-7827e3abfdd4", "value": 545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639063014, "uuid": "bac6dad6-82ea-4c31-b42e-c681fe57da60", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063014, "uuid": "3a2cf4ba-8d61-4ad1-8301-52f1764d18c0", "value": "13c4b61f395c580bc4f57d890191a34f.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbcdeeb5-590f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639068572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068572, "uuid": "81b71d35-ef0b-4143-aebf-137eb298d2c4", "comment": "Malware payload (Heodo)", "value": "b95523e0ee23ff8e481718243d5586a1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068572, "uuid": "6e5b2e06-1eb7-4603-9940-de436a2c2811", "comment": "Malware payload (Heodo)", "value": "de4fa3c91d95a065ddf58748fafe421933066ac2e21f21a81290001ed6b53bee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068572, "uuid": "1a1b4dd6-11da-4771-ad5f-10e288033a1d", "comment": "Malware payload (Heodo)", "value": "93a345562851fb57fcf5ccf32e206708d727cf8d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639068572, "uuid": "c0d54cb1-4561-4d09-90c7-65dcae54cc8e", "comment": "Malware payload (Heodo)", "value": "a1428463f1724ac7142f7b939eca17368ff52ebcf3ac5f469e7216971b31097af5fd27b3e224c14e1c2ce225f1ddf698", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068572, "uuid": "f3a9f923-6dec-4454-8f6c-dfb4ffcf4262", "value": "T12444BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068572, "uuid": "f78185a5-b92c-4eeb-a7c9-d4c5a2a41ed0", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068572, "uuid": "ea731789-e9e3-4c45-81d1-5188c7172577", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBN2ypv:6jIG/pjjuLbJLmGshoCUnWTjpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639068572, "uuid": "8433d28b-057c-4012-a8b5-dcdf751bbbef", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639068572, "uuid": "34c8a19d-5b85-4fd8-986d-d4a24569fff4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639068572, "uuid": "0dc2ef45-b80c-4bd2-a379-bd2a8716b228", "value": "XXDBYdhrv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5aaa6a1-58f3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639056482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056482, "uuid": "33cd5d0e-fd95-483f-a9fd-02ae456dfff7", "comment": "Malware payload", "value": "fc6821c39f14aee7af937616f86abdb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056482, "uuid": "ddcabde6-01bc-4ea9-bda6-16ede1a7f118", "comment": "Malware payload", "value": "de591f53cb4931dad120161165494e6991010c8c8df37b2780042c200fd29cb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056482, "uuid": "b11d1bdb-6cbc-4741-987d-306585244c89", "comment": "Malware payload", "value": "747ec8f710a4c475ca173b1237eb5328558ef4ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056482, "uuid": "fcce72ea-de02-4afa-b686-bb07cbe92d7f", "comment": "Malware payload", "value": "30266ba90db7f0fcfcf28d34bbb6845ea97be850ec527438a0b2af82d7b4408ec953443c92642d74f1a22dbd98534c4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056482, "uuid": "ea837120-15c0-4fb1-96ab-aa0f96213aff", "value": "T1C353EA602BC8DA09C2FD0DB4B8A1112D53F4D0576646F78F6EC6A4F53E667C23A538D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056482, "uuid": "947eec51-4138-4b43-976c-bd89482dcebb", "value": "1536:jWZ7nChhCm+HmfHZgjRf4emO0cdXclKg/w0JHEz:jWZLC7CVHmRgjJRSlZ/bGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639056482, "uuid": "0bc20767-2df9-4d9c-8210-b7f22438c69c", "value": 61497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639056482, "uuid": "7de6f625-ae1a-40b2-a349-00c4dd428b21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056482, "uuid": "c1c4d42c-fff9-4b40-83d9-61e9dafc6e27", "value": "fc6821c39f14aee7af937616f86abdb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89ab347-590a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639066312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066312, "uuid": "ef6caf93-e6ee-4269-9b1b-7cf6d88b3cdc", "comment": "Malware payload", "value": "c459dd450088856608328426cfa7dcca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066312, "uuid": "cc584902-b50b-4dc9-8df4-16ad693631d6", "comment": "Malware payload", "value": "de925c90cdae562790ecc835a8c9ca9ae905f95b753bd251fe6fcebc82db71fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066312, "uuid": "22851729-28e6-4f21-9e08-a934114185c2", "comment": "Malware payload", "value": "c84a1f49eea75cf2c8890336e7647671a1d7b098", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066312, "uuid": "91f39710-b470-45ce-9995-27e22a1cfa00", "comment": "Malware payload", "value": "f4cf7edb36940cf4817099f1905fcca184cde17cc15050be6912ec9c1d23dd5ac5ebdd7a2fb8a3ffd0e50ef7cd6ab2b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066312, "uuid": "1580a75a-99de-4e4d-97d1-86be0877e050", "value": "T1FC43E8A2F3968CFAF46590BAE86A96042391948FC6E54F2F115FB51258F334320F7D4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066312, "uuid": "9de6b587-c0ea-4116-8303-5c5fde138bc5", "value": "cccd4bf4fb76b9c23b74fa654df5e80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066312, "uuid": "808b07c5-1f10-4fda-9370-e37e0401b599", "value": "768:rsqV9K7cIonbbAx073xzWurhb6OMn1kXJFBE5efxvIZnXAyc8Y98:dV9K7cIEbk673xzWQhb6+PZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639066312, "uuid": "8eb5b8b7-0019-466c-aa41-6f74e583600c", "value": 58599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639066312, "uuid": "286878ff-e3ac-453e-8245-ecb1e37d4217", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066312, "uuid": "1bd5f9c4-cebb-42ef-b9d0-ffb5d2981fa3", "value": "c459dd450088856608328426cfa7dcca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359bbc2d-588b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639011546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011546, "uuid": "dedd2169-6a1a-43ed-b85f-d2cb3d6657a3", "comment": "Malware payload (Heodo)", "value": "2af3fb33e654da6ac4e0c9b48be6f762", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011546, "uuid": "7e9de302-c9c5-4941-b82d-7a1f416af5f0", "comment": "Malware payload (Heodo)", "value": "df56d036eb173a9063af1ed6303a843cf763f55591276868cf559446f63bf871", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011546, "uuid": "66223784-9168-47ea-8d55-56a9ba742424", "comment": "Malware payload (Heodo)", "value": "6d45364a1a7eab808c8e8c0c29db21562cf67547", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639011546, "uuid": "1f86b28f-5002-453c-be63-eac447b33653", "comment": "Malware payload (Heodo)", "value": "336592e412acbee2ded039e11e9d072128bc490d68ad57cec1619aba6e1d71f808fa664fc8764693bf7073b392aba0d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011546, "uuid": "be79f5b0-19b9-47b0-a9a4-b6ecb8dd4ffd", "value": "T12A44BF10A181D036E5FF087A89FAD9BE466C76600B80DDDFA398187E4F6B6C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011546, "uuid": "98188539-f398-4d62-a3ea-39b952655ca0", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011546, "uuid": "2e10560f-220a-484c-b31c-f7528b6f572c", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBamgL/S:Wvef8+h61mRcHL+rF6l5EAQWTyL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639011546, "uuid": "526e923d-d4a5-4290-9916-d543478150ef", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639011546, "uuid": "0a1fa272-dd80-4a09-bf08-bc7c98d5db40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639011546, "uuid": "8b69b0aa-5193-4a03-add7-f1ea4ebe02f2", "value": "emotet_exe_e4_df56d036eb173a9063af1ed6303a843cf763f55591276868cf559446f63bf871_2021-12-09__005902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a745852-58cd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639040008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040008, "uuid": "6a881a93-b9bc-498f-8712-7b308d39fb5d", "comment": "Malware payload (Heodo)", "value": "3892231cd794e6aee32545608798644d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040008, "uuid": "aedafff7-7cdf-42ce-946e-ab6661e89e6c", "comment": "Malware payload (Heodo)", "value": "e08a2020669acf7d12a0624d407de5267e6a1e62beb56f11c830948df229d25a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040008, "uuid": "b0562a65-4677-49b7-ab48-1bbb40f53979", "comment": "Malware payload (Heodo)", "value": "64f12f95f7718a65909008c01c706d98160eb0d1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639040008, "uuid": "625452cc-91a2-4c0d-92de-245c4d81ab06", "comment": "Malware payload (Heodo)", "value": "ce7458a88a8b49bd559e319781b74613d2acac5e0c9f842d230e062ef027b587aea64a67863e5ed5eb6ed7e0b6f863d6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040008, "uuid": "56dc24c8-3e68-4e7b-a330-5c39cc0d17d0", "value": "T1239301DAD2A5DE7EF4E6D038E4BBA1B97723C036C05C1D82918DCAC8802D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040008, "uuid": "8d8202e9-5bc0-4ff0-abcd-8b300e4fbc86", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3f:psXZ3MYeGt9sLBrGrQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639040008, "uuid": "8aafc69c-8d83-46a3-bd19-8539ce430e8e", "value": 90153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639040008, "uuid": "65a70a94-5d98-490f-8210-d8a015d611e7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639040008, "uuid": "5842935e-ce12-44d4-ba5a-7f40a56fa9fe", "value": "emotet_e4_e08a2020669acf7d12a0624d407de5267e6a1e62beb56f11c830948df229d25a_2021-12-09__085315776087._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed701d94-58fb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639059958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059958, "uuid": "00734543-ef46-4c0f-8021-f1fe1bddfb7a", "comment": "Malware payload (Heodo)", "value": "1003971a7face3380f054c71074d021b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059958, "uuid": "5e3b1d3f-0d8f-4599-914b-95bd4c795bad", "comment": "Malware payload (Heodo)", "value": "e13304b7d50c1b51e7fb8d0853f3ad9db6039bfb3395b86bfce02d491cb91591", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059958, "uuid": "1a21cbf9-b794-46ea-ab6f-dbe6329c77f2", "comment": "Malware payload (Heodo)", "value": "a70bb0f7d44ec095a15d78984ff00af8fd6bc437", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059958, "uuid": "1996d438-4e80-4092-8323-509444636a97", "comment": "Malware payload (Heodo)", "value": "e2411def81d8b4d4fe3619d707832c7720448abcdd8b8d45e43456516be67cbcd942cc4107ffe6c38fd44dd5be871fde", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059958, "uuid": "e7cc346e-1415-4311-86b6-f75bfec3a3e8", "value": "T154E46C00E701E036EAE710F786BB89BD9979AB20139559CF56C82DF5DB290D03D32A5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059958, "uuid": "5fcddd59-3b2f-4c1a-920e-0f3464770f54", "value": "12288:me+n9DJGtOal5V8yMcztuEpzZ4GbOX8+DbiuD+jv6DEiih24b6WTw:m5MtOK5VXNzZ4GbOX8/BthxTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639059958, "uuid": "975824e2-597c-4723-9f10-e309371975d3", "value": 720575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639059958, "uuid": "504b9332-784a-44c4-bb0d-398498b6f011", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059958, "uuid": "3ace0994-7519-47f4-b0b2-c999ada3d18f", "value": "emotet_exe_e5_e13304b7d50c1b51e7fb8d0853f3ad9db6039bfb3395b86bfce02d491cb91591_2021-12-09__142553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc19592-58c2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639035100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035100, "uuid": "79107616-7e6c-4b2d-917e-31c251018794", "comment": "Malware payload (Formbook)", "value": "eaece4dd66437dcd4b849522e4ca4be3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035100, "uuid": "ccda0b14-7517-42bd-83d5-e53c9a987cb8", "comment": "Malware payload (Formbook)", "value": "e159309035035691a0390f1c30b4147d4755a5fb4c5a18fbee7d221ce040819d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035100, "uuid": "ca956eba-bc90-4baf-9b7c-f8360f2a28b6", "comment": "Malware payload (Formbook)", "value": "48017dfc1b6f0188c8801936122afb96b6e04beb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639035100, "uuid": "8c63fcc8-32db-4815-b229-136fc3e4dc0e", "comment": "Malware payload (Formbook)", "value": "7fe9f5ac01aac619804b94648e5a30e392cfa4cf46bf1f5e9253c15b6c58c76dee28ac15eb922a15b693a97dfa138c61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035100, "uuid": "7eb94c26-8934-449e-8d48-7a09c9124ebe", "value": "T1D264231BBA614DBBFA9252368071E3A997F6D33401560C03D79D0E7F6FA6107897A2C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035100, "uuid": "88945c78-156f-4a99-84d6-a6e5511bc410", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035100, "uuid": "f606a008-632d-402d-af12-697cd118b6af", "value": "6144:rGiwn6256ThZrh0/kR1yQoreBq17/rRngSxYHNE/U1VIFl9Xf7:ybc96MRICO/FxYtEc1V27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639035100, "uuid": "e1520f19-6f30-46e0-92bd-ecfb2a8c4bcb", "value": 310290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639035100, "uuid": "9d406d6e-8225-4117-8b6f-11719601653f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639035100, "uuid": "ccbbee7d-a45b-4380-bc82-a3009ed642d7", "value": "eaece4dd66437dcd4b849522e4ca4be3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2107b725-591c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639073788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639073788, "uuid": "ec505556-4cf5-4601-838e-690d0060f151", "comment": "Malware payload (Heodo)", "value": "b76a92c83b990bd63b89c06b0a75ff08", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639073788, "uuid": "9ca5aba9-5fd9-433a-aea5-631ec348ee91", "comment": "Malware payload (Heodo)", "value": "e167804a6f36dc99e96909bcededa8a733dd8633037b8b52e8d7881d20446c16", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639073788, "uuid": "637edc9f-7587-47b4-9506-6e81d54d8701", "comment": "Malware payload (Heodo)", "value": "6913a08688a3091b00666fb2e5f5e5a2a2066e76", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639073788, "uuid": "91b10fef-b1a8-4d97-9749-7ca02f393da1", "comment": "Malware payload (Heodo)", "value": "7712ba19f644e9d7dffbbcea8fb4b5229c94915e7397e9791cff424fd1a37a4de9e2439e210fa2ebe8b531244a5805c9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639073788, "uuid": "2c6c8a2c-85fb-4ce4-9ad6-d94d456f051e", "value": "T1E09301DBD295DD7FF8E6D438E4B7A0B82372C071C1581E82628EDA48412D6C657FA2D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639073788, "uuid": "49729d68-bcac-4333-b0f9-14a305b4130f", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbd:yIBQ3MYeGt9sLBrGrBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639073788, "uuid": "70634cea-447d-4ef8-a085-8cd2e480b1a4", "value": 90155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639073788, "uuid": "43e6d2df-5971-465c-9635-cbe044efeee7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639073788, "uuid": "0b4eb39f-a8eb-497e-9958-2520109a2086", "value": "emotet_e4_e167804a6f36dc99e96909bcededa8a733dd8633037b8b52e8d7881d20446c16_2021-12-09__181556776302._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e347b10c-58c9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639038466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038466, "uuid": "a6d103da-5eb2-471c-a8f9-e356dcd7cdca", "comment": "Malware payload (AgentTesla)", "value": "9ac1f6615a23eb604eb7a2abadae5ab4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038466, "uuid": "23177455-4826-46de-af67-08d4d5a4d954", "comment": "Malware payload (AgentTesla)", "value": "e182bf63b22c32c51930b1f3bc18fc6892d0ac4bdc38a7fd34a9b6859491dee3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038466, "uuid": "41c2b863-778a-4cd5-850d-57f33aea9535", "comment": "Malware payload (AgentTesla)", "value": "80372368424e8bf0797b6cd7473e08e9d3ac54ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038466, "uuid": "224fe102-e7fc-4947-9e27-626d97c958ab", "comment": "Malware payload (AgentTesla)", "value": "f7e2d51d5dd0da21ad2f65390e643367c076cff428af3ca7ea0a98991ed371271e971f140a6d6c3950922a4fc865d6a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038466, "uuid": "11f3f538-2783-4d3d-9a8d-1412cfb15bb2", "value": "T18E9423D2CEE1990E6E91B227A20F08165DED0C5C38C177F6B91AF4DC3E77497246E622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038466, "uuid": "d5253eaa-7f3b-46a6-9069-382a397f1550", "value": "12288:0L975wm2iIcEkK8RDfBtkh1OoO0vJ9gTtM9QJ:cEJZcEkK6yhwz0vJ9ytcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038466, "uuid": "52aa9f50-cbed-42da-9421-84f8b7887168", "value": 448148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038466, "uuid": "86b20e2b-516a-45cd-b497-9105d2026a2a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038466, "uuid": "d102d6df-9353-4f32-a14c-cb1f05b6e570", "value": "Purchase order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e006f535-58f3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639056500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056500, "uuid": "0161d016-a0bf-4719-9ccb-9a8145bc6dfb", "comment": "Malware payload", "value": "978e9c14c141f983f2d24bb4d4d83950", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056500, "uuid": "fbe6ca02-6ca7-448a-9af7-3cc736aefa51", "comment": "Malware payload", "value": "e277dd22c27af85bf2368f2f3bacf7b43abbead5aa58f698d499846404b0d93a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056500, "uuid": "7f96b811-ad1a-4238-b0fd-e57bdbe62c8e", "comment": "Malware payload", "value": "dc4f4bc3773d7569adc9d179406635184c7d383c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056500, "uuid": "7d8a0e9f-26c7-48e5-81cc-b0f84ded9f58", "comment": "Malware payload", "value": "28548276491d90b3528f5aa882a330240e68fe827bc29c296a076c6f7c76bd1d39e5af5a94428d55cd56748f4a309d33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056500, "uuid": "b29bd7d5-7acd-4f12-b876-0563f83aacf0", "value": "T14F64DF11B7F91228F3B3AF70AAB195991D37BAD1BD35C96D0109108F0A36EA8DE35713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056500, "uuid": "33abb553-8ef5-4678-877a-a88fbe3c05d5", "value": "6144:25/1D3NBELnJAPc2x3fOilTizbzssOd7zyc8TYL+Im4KwRrPqh:25dDOQhOilTYzssOBNLmGxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639056500, "uuid": "00f6ab04-bfe5-4e5d-8e06-eae3d3ef1e42", "value": 309105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639056500, "uuid": "75195619-3d7f-47d1-bc2d-3947ba5ee037", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056500, "uuid": "6b0fc9e6-4792-42b6-839d-13730568d96e", "value": "978e9c14c141f983f2d24bb4d4d83950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b809b49f-5904-11ec-96a4-42010a9c0029", "comment": "Malware payload (Stop)", "timestamp": 1639063734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063734, "uuid": "4a5686a7-d51a-45ed-b90a-65019e3bc0a2", "comment": "Malware payload (Stop)", "value": "915d210a27fb06e0c1ce21ee18fcf4ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063734, "uuid": "634dd8ac-8dee-4808-83c0-f9ce21eac663", "comment": "Malware payload (Stop)", "value": "e28fad4106120da332e8bbcd7288373ae7035654f54faf52abbfa51b6fdbd996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063734, "uuid": "b93773cc-ad24-49b9-867f-491a4a1e285f", "comment": "Malware payload (Stop)", "value": "d155efffd1df9c35bc9338697ec1872cdd4dba84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639063734, "uuid": "e63210bd-da11-4960-9838-0fc4792baed4", "comment": "Malware payload (Stop)", "value": "76d4e42e84ac21f4bc5962b55430f5342da1bded92fec067c5d7af5173457273211d658931ddcc0ae4ae7cb3895335bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "STOPRansomware", "colour": "#FDE707", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063734, "uuid": "2e4de387-22a4-4c19-bcde-a8f68a60640c", "value": "T18215F02235D0C032D9E214F64624D7B89E7AB4325B25698F7BC81E799F373D1B63078A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063734, "uuid": "bec30951-dda3-4a80-9328-9c5d89c36454", "value": "be125991602a4dd07b72ad3b5c37a3e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063734, "uuid": "475d11bd-49a4-4979-8a93-4d9eb40c1bec", "value": "24576:Hd0UuVDZWSRjKX8FF7jyaEjuOs59xBupurq8Xi:90UuVMShKX8XG1KOkHDXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639063734, "uuid": "0f5f5237-2f1d-4685-ac43-8041424cec29", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639063734, "uuid": "8ab60afd-824f-44e6-923a-7673bb32fa21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639063734, "uuid": "680ed749-c57d-4514-8e51-fd2e46ba1007", "value": "stop_packed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f5232e-58fb-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639059937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059937, "uuid": "9c703f0c-2f5e-40c8-8c2b-7956b52d07da", "comment": "Malware payload (AgentTesla)", "value": "2ccfb0fd985cd47dabe483005bdb047a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059937, "uuid": "132a769b-0951-45ef-9ae9-ad967cce3d42", "comment": "Malware payload (AgentTesla)", "value": "e2d897a0a1e63b6323ff9b95bd878d55b26710f75124c227cdb18f17b4124243", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059937, "uuid": "f6e11d7d-e405-4dee-9299-1cfaa57bc24a", "comment": "Malware payload (AgentTesla)", "value": "0e05acf1c7b1b8eea90f254310502ba701bdfbbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059937, "uuid": "54ac1e22-e2b9-4289-89d2-10ec3532f697", "comment": "Malware payload (AgentTesla)", "value": "c49de2ebb3288a8be7126aa232c5eb5f82fed4a75abd33a176602859aa36b69b7d4d75937ff55a0d9f512804bdb82b6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059937, "uuid": "29ec97c2-9976-4221-aab2-4897942cd589", "value": "T1A2350124A6AB441DE84B35F45F0A7C421E6BEEB8C1128A16237EF514693E313CF267DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059937, "uuid": "c7b35dd1-6e6d-4812-88ec-2b154e004b6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059937, "uuid": "295baccf-4235-44f5-b0c7-cd7be2a9e070", "value": "24576:YzxGajPXH7baQKaCp2Ppv6sCqatFnGtMsDltiANBAX9jNaI1Q:wEyP37+FtjxdFshtiDNL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639059937, "uuid": "9693936c-7628-4ac1-8e61-010c1465a92a", "value": 1114624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639059937, "uuid": "86b631e5-b4ae-447a-b59a-980f3f2db387", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059937, "uuid": "3b72cd8d-4ffe-4697-896a-0f4ac02a5852", "value": "Booking NO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcfd3f8-58f3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639056550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056550, "uuid": "fd82ba7d-b566-4797-876e-e61df7b55132", "comment": "Malware payload", "value": "c969913ef786154f3e72df42c12cc370", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056550, "uuid": "309c9b85-6a5d-4d57-b4a9-906b7ee95e2b", "comment": "Malware payload", "value": "e3c18906900e3fbacf918185dbb4cf8122e175bc5c1e2318ed62cdc149b0edb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056550, "uuid": "5771f551-5912-4cec-8864-f18413462b2d", "comment": "Malware payload", "value": "2ec7eeac92aae3848e897bf4e31a982a8b1a516a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056550, "uuid": "64902868-8000-4991-8471-c36739a906d4", "comment": "Malware payload", "value": "8773b07f54a61558589295a006930334662d254257f3e15bcb9af0db356caf35bf7c791417f875c4f5948e53db3affac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056550, "uuid": "c2fa4e2b-fbcf-4102-8c20-7c88518d0bef", "value": "T18774011073F9126AF7FB9FB0A9B414855A33BED27C39C51C0508465E4972E68CD3A3AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056550, "uuid": "fcb5a0d9-a484-4986-9aad-c3de967b723f", "value": "6144:oseANmfHeqPkp7Mq/0htCQtOTAcx5jkjoGCXZY1w+5VJfoj7lrw1Oy6PvM7igXve:H6ehN+7ATAguCJ7ESjhrw1Oy6PqigXIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639056550, "uuid": "a3168861-7947-45be-8768-8670a17e253b", "value": 352545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639056550, "uuid": "ebc5d271-0d7b-4766-9243-28a87476f289", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056550, "uuid": "f1ea0a5e-c57d-4a71-b4e5-43160bf94d4c", "value": "c969913ef786154f3e72df42c12cc370.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f0fbff-5928-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639079140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079140, "uuid": "04194ea7-6289-426e-bfd4-48fbe286bc96", "comment": "Malware payload", "value": "6c897e453e65a30e3d4fe687d08a1309", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079140, "uuid": "a642ac81-479e-4d2e-8808-a68420d53508", "comment": "Malware payload", "value": "e476fe636cf81b030e16bab4b460ab97e447977d4f491fab6372b539e5792aef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079140, "uuid": "f1758fd0-2fbe-4a14-b0c6-e2abf74cb173", "comment": "Malware payload", "value": "f09611e973fcf4e087cafeed884ee6ef721f2e73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639079140, "uuid": "eb8bab1c-c69d-42d4-a322-d609e9ba43f1", "comment": "Malware payload", "value": "6558aeb7ca5569845b2e6b4fe2b8eb383e61ab0ccc6f1689e92903b95d96fdbaf53e16f65008fc2a4e574e22b5ebd7c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079140, "uuid": "21aecd96-788b-4665-bbc7-4b1257b8e5de", "value": "T12B44BF10A181D036E5FF087A85FAD9BE466C76600B80DDDFA398187E4F6B6C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079140, "uuid": "fb9620b4-d5ed-4077-9297-624fdfe7ea20", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079140, "uuid": "560892be-f219-4161-8660-05857f25ea20", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBymgL/S:Wvef8+h61mRcHL+rF6l5EAQWTmL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639079140, "uuid": "771dd592-3df6-4715-b806-2edd180b2c46", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639079140, "uuid": "9f176301-1817-49f4-ae4d-38a434e1f461", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639079140, "uuid": "10924b1b-03d7-4c1b-91b1-21e922b28dd1", "value": "6c897e453e65a30e3d4fe687d08a1309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14698b67-58d5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639043273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043273, "uuid": "2e01fb2d-2c3f-477b-a65b-2c3371315201", "comment": "Malware payload (Heodo)", "value": "af84a348f614b0da8bb7e79d1d054008", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043273, "uuid": "49211a37-2afd-456e-86e9-b71983c55534", "comment": "Malware payload (Heodo)", "value": "e4b74b7a1143cf9a19b71f201e7a6390aceada8b97a41ac9b5b8f7280f95161d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043273, "uuid": "5b1e3113-9d2b-440f-a4dd-c9d2bc83a826", "comment": "Malware payload (Heodo)", "value": "43c36a0c87b1d7b1e12087787c5ca30e40b5eead", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639043273, "uuid": "9b6a3e4d-b6c9-4501-888a-318d8b7234cb", "comment": "Malware payload (Heodo)", "value": "90f0d3d7b810bd6355cf67eac8adf2938870add688f11a1740f527f21b695a19c99623fca12535ed8e988f60995e7342", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043273, "uuid": "38f41ffd-6a04-4253-bcc7-31b42ae7e770", "value": "T1A49301CAD6A5DE7EE4E69438E4BBA1B97723C036C04C1E82918DCAC8811D5C757FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043273, "uuid": "a608f66f-daab-4091-8bad-e2bf2f070e99", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3L:psXZ3MYeGt9sLBrGrQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639043273, "uuid": "00419306-f89f-44d1-9e60-1c96c19fac2b", "value": 90149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639043273, "uuid": "0cc44f56-7f52-4792-9ff6-300fe888b0a7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639043273, "uuid": "1400fcc2-d480-443a-b5f3-8686a6a909c1", "value": "emotet_e4_e4b74b7a1143cf9a19b71f201e7a6390aceada8b97a41ac9b5b8f7280f95161d_2021-12-09__094729554957._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131ec8ac-58f3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639056156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056156, "uuid": "3da0c009-2028-469b-8615-cfd1b3618d81", "comment": "Malware payload (Heodo)", "value": "fd8e9b7678a918abbc2f0d2ea4ebafb4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056156, "uuid": "7ed2691b-62c3-4c0b-aba3-0e55eac362d5", "comment": "Malware payload (Heodo)", "value": "e4d9933d7b2e608df21ced9634f2b9d7ca5e9e693356f395bf18c2d0838b09c5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056156, "uuid": "bf90f8e8-2be7-428c-ad2c-c168e2d7a4d1", "comment": "Malware payload (Heodo)", "value": "29aac296ac0acbbacaf5caa31d8cbc86c1f04e76", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056156, "uuid": "68dc9819-13ad-44a5-9afb-36f2e13154c1", "comment": "Malware payload (Heodo)", "value": "f75807c81613fef4b7ed918ab23f2abe058ca98da2e4631fed48e7762b815414f89a4752d156acab8497c538e7bdc67b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056156, "uuid": "95efa523-9c31-4215-beb7-902a44acff49", "value": "T1C644BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056156, "uuid": "793c05ea-63d5-4844-aeb5-f73b7906292e", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056156, "uuid": "32dad7b9-fb3d-49fb-8ddb-4310b33b8b00", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBK2ypv:6jIG/pjjuLbJLmGshoCUnWTupv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639056156, "uuid": "8e46aaa2-937c-44db-ae9b-f05811f3cae9", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639056156, "uuid": "406a020c-448b-4e9c-bcc7-39d55116be3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056156, "uuid": "506f528a-ef78-4d09-97ed-a5a48b9a4546", "value": "qfxdkydx12xp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6840ab5e-58f6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639057587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057587, "uuid": "5bb3a579-196e-4dd0-8c85-b9664fb8544f", "comment": "Malware payload (Heodo)", "value": "cf8ba1e535e4598c5445744038aac3ef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057587, "uuid": "2e19930e-af26-475a-bd50-4c86fb0c2a13", "comment": "Malware payload (Heodo)", "value": "e4dc01ab8951e1985c4bba52f41273778021090f02511a50c72143a3befcad22", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057587, "uuid": "da98269f-62df-4972-a8a0-a6b947b064e2", "comment": "Malware payload (Heodo)", "value": "11fee5fd97de822c826a2af01ffba3ebf4a87353", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639057587, "uuid": "f4db5180-e67e-4d46-a75d-e7fd31849192", "comment": "Malware payload (Heodo)", "value": "dc0d1ac74c00885c04b2d9a115f7bcd1d7b33859c2ac42fe5477fdbecc0af7b36abe4eb3cee134d37808a91e42c4e61d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057587, "uuid": "684cb1d1-c438-4f7d-9ab3-bf2f0eaefc86", "value": "T1E044BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057587, "uuid": "78263f8f-0f36-4a31-a183-e881501e3230", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057587, "uuid": "e2233eab-b964-42ca-8b68-556431ab4679", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBf2ypv:6jIG/pjjuLbJLmGshoCUnWTdpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639057587, "uuid": "70df5fbb-b5dc-425d-b722-f781fe357adf", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639057587, "uuid": "f931d003-9f73-4d7f-88ae-3fee6306b3d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639057587, "uuid": "343dca8d-2db0-450e-b282-e5cd6d6d1f7c", "value": "LiL9Dw7k7UcCkZAAHlEU8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325343ee-591a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639072958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072958, "uuid": "1fc41604-fb84-4d20-8cf5-d744bf1899f8", "comment": "Malware payload (Mirai)", "value": "9a97e097f9a2deee50b409b697b1fe6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072958, "uuid": "bd379d3f-38f3-415a-a14b-7a9bffd3e8cb", "comment": "Malware payload (Mirai)", "value": "e5435e1f206742154c50b4cb0e5262a6acf8807a5a73489746faa2bacacefb15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072958, "uuid": "ab4d53a1-8c65-4293-b492-21bc9e10f5af", "comment": "Malware payload (Mirai)", "value": "756d4dac3a53166ad360576345ff4ee2fcfd1073", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639072958, "uuid": "d76ddc63-6596-4c77-9207-34783a47fc1f", "comment": "Malware payload (Mirai)", "value": "56a8918f5d2756997bcd28ba68b7bf42add72ed9b904b150524601a18613950693deb7e9a0671351072657f31a63212c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072958, "uuid": "92485c27-30a9-49d2-8866-288d79572ae1", "value": "T1BBC2D05D130514F1C1B05A30EEBE89427FAB6BECD1FC65066E6A47106301E827BED1BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072958, "uuid": "f4f84670-fe2d-4a2f-a2f8-61860829e95d", "value": "768:lL8dknN4aeP2XLsZqJW4fu4uT1A/8cL1fGs3Uoza4:lQC4aq2bGqJluzo8q1DzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639072958, "uuid": "293ab6ce-fc49-49a1-b2b2-0fd7b2b20bd1", "value": 26116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639072958, "uuid": "069e71cd-0e9d-42ea-bd01-0320ad533dad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639072958, "uuid": "a8b17068-36b6-4733-baf7-125f34e4176a", "value": "9a97e097f9a2deee50b409b697b1fe6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83864106-58e6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639050761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050761, "uuid": "8fe28b27-a600-4ef2-ac4f-9d040c943571", "comment": "Malware payload (Heodo)", "value": "56f69a30d4488378e1732d86601e6550", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050761, "uuid": "fea30618-b623-476a-99f9-6f5e8f016f93", "comment": "Malware payload (Heodo)", "value": "e55e6581431ec2142044daebf50dea7692b76e101875a9935fe1273c849f99c4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050761, "uuid": "793cf01b-bacb-4a74-8408-ecd5e22b7a77", "comment": "Malware payload (Heodo)", "value": "6b9b619bf58a399853d2caa772560b04f4c80f4f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639050761, "uuid": "adec9100-0dd2-4c10-9cd0-1a9201eb9aa7", "comment": "Malware payload (Heodo)", "value": "882aa85d75d82704207b068cf674ac8daaaf2877b046adb03622866901de64f8790059d3e1d8e45c15ee971690244b4c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639050761, "uuid": "afce2b8e-1f7b-4c93-bd40-e2d5efa76583", "value": "T13093F1CAD2A5DE7EF4E69038E4BBA1B97723C037C0581E82914DCEC8812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639050761, "uuid": "9820c722-cbc5-48af-86de-ee5972fef74a", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3H:psXZ3MYeGt9sLBrGrQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639050761, "uuid": "98a5dedb-a728-48f5-a4a1-f70e74d27db0", "value": 90151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639050761, "uuid": "1658ae5c-1b3f-4d60-bba3-5d025ccbd8b5", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639050761, "uuid": "b1dbbddc-ec9c-4d40-bfbd-714498f85ba9", "value": "emotet_e4_e55e6581431ec2142044daebf50dea7692b76e101875a9935fe1273c849f99c4_2021-12-09__115214766346._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff23dc5b-5922-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639076738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639076738, "uuid": "106480ec-b295-4f7a-94d0-fd8574dd3912", "comment": "Malware payload", "value": "282be04156ffb1fdf572c9301969a19b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639076738, "uuid": "695272d2-5a5c-4c96-a463-96cc66897044", "comment": "Malware payload", "value": "e5cb08f2148067c9d3cd26c1b2ac251ebfa859ca47646f9ae3b0be39f8d6e558", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639076738, "uuid": "30bbad9f-4154-4c26-93da-016bd5c9bf91", "comment": "Malware payload", "value": "7cacb84a7eebf6adf88eefe568bdd318bcb9a1f1", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639076738, "uuid": "e35ffcb3-ac68-40da-afc6-a1fa274889e9", "comment": "Malware payload", "value": "0d6e0368a45d512a79c7a0db857b5362a3c4bb578a845c5d2f392a9040226bb84c6fa8d326ea0a3c90a3fc101d6c8089", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639076738, "uuid": "0788aec7-39a1-4f72-beaf-b065379d2034", "value": "T1E9240249683CE8CECB1B1432C708BFEB860B506199C27C2EA5C9794D5955EFB7B8C14D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639076738, "uuid": "98590437-1b7d-4d2a-b95e-10e88f7286ea", "value": "3072:ocfEIz6t8weEGc33rk590Du99wpFlUz7o8NXKRlzpG7/UQXIqdtKcmIDYPIZE8D4:ocfEw6R9537k5WSOeME6rGj/m/58DD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639076738, "uuid": "a3f501f3-4488-4247-8a1f-aca35e1f4df1", "value": 211228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639076738, "uuid": "cbfd61d2-8c0e-4307-924c-51fdecbefef5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639076738, "uuid": "c94a59e8-c086-49e1-8d3f-4db1bbb7ca02", "value": "sw-1164123628.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc9170d-58f2-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1639056011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056011, "uuid": "f93f394b-ee5a-44b2-9ec6-42031c48d93b", "comment": "Malware payload (GuLoader)", "value": "a07a4734570157db89d1f18f7987ce20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056011, "uuid": "6a4d497a-c5ce-437e-9d23-995df83a0998", "comment": "Malware payload (GuLoader)", "value": "e67c75c305f8343cf6a1530ee228831248d4b164533fe76740389fa108dfc0dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056011, "uuid": "cf3963d6-4ac5-4c97-8ce1-17ad2d1adc7e", "comment": "Malware payload (GuLoader)", "value": "775f2b5ec15497fe8f7a598f26da2ca227a19674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056011, "uuid": "ba0f49c7-9b77-4ab3-821b-eba21c8f990e", "comment": "Malware payload (GuLoader)", "value": "bc4858607f723df5460851076c76b213045196f792f6c59a08c5129f44aa66accf11a54e03606aa2ff5153c04a5d7f9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056011, "uuid": "c9a2bcdd-c81e-44de-820f-6717ca9f877c", "value": "T1EDE37CA23290F5D1E591F7B2EE25F55D80076C33309248C78ECA3B1A2A71B9784E375B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056011, "uuid": "15aa3ad0-1aaa-496c-9fdd-c79575d4dda9", "value": "98b6dd560a57b8960045d82e7d77c431", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056011, "uuid": "0ac48975-d051-490a-80ee-2a21508bd31b", "value": "1536:+MO2j0VFVvuee3ngmPOLYPEvHlZKyiQmgSeSMzTF:O2AJue9bLYsvH7KyidgSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639056011, "uuid": "edadcc3e-567d-4cd2-b2dd-6011d3c43e00", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639056011, "uuid": "848401a1-105c-45aa-a6de-f238178e23e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056011, "uuid": "815a1c64-cc8d-4158-b2df-b45e2b395227", "value": "liqefe_03817_001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "357bd60d-58d4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639042899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042899, "uuid": "31c6c2ed-1c4a-49c6-8008-9360b3491928", "comment": "Malware payload (AsyncRAT)", "value": "ae292bb6bbf3dcbac34c6ab080175559", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042899, "uuid": "9afe3f14-4773-4e46-9d02-05d112e99ce6", "comment": "Malware payload (AsyncRAT)", "value": "e6b50ad6eb540cf0489dde45e03a9fbbb1e07cb5a79a66b71b25db76fcb713a1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042899, "uuid": "36097853-7e2b-4d66-b087-c2aae8b448ef", "comment": "Malware payload (AsyncRAT)", "value": "209cf116033ef010f2343acb778e8cd1a1fc5f86", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639042899, "uuid": "0ec1d7ae-63c4-4b6f-a1bb-0525353ad160", "comment": "Malware payload (AsyncRAT)", "value": "c68048463c0612d549f47d803ba39d0b27335e213b8d68ad6060c1529f244b106c86ec65a0598e120482e715a35de3fe", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042899, "uuid": "716e9b68-6b84-49d5-b4c9-bd324a7be6d0", "value": "T1AAB3720526A48116E1A9CE7F78A3F1508679FDEF650EC57E2880337E863DF84C90E6B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042899, "uuid": "99896fc5-68a2-44bf-bb2e-69b0e0e9e0b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042899, "uuid": "ad8a3212-b5b4-49bd-b2e6-bc1de114f11f", "value": "1536:0/rUCAljJsicFv8gygFtHTbjxQRUp48R7I7f4vIIJ+:ErAljJsicFv8ITbjx5W2Mb+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639042899, "uuid": "29c75c8c-9631-448e-a326-c603ff09d533", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639042899, "uuid": "8a30cfb2-e87a-4827-afa3-b45d4f586873", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639042899, "uuid": "1cf8c913-3771-4fc6-a595-f1cbf1b6d6bd", "value": "ae292bb6bbf3dcbac34c6ab080175559.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce9ff94-590d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639067715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067715, "uuid": "e767ab62-3356-4c9d-96a4-eaebcf71c0c1", "comment": "Malware payload (Heodo)", "value": "e0104cee9f0594b73f6bdfdc26533613", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067715, "uuid": "0089d2f0-bcff-43ef-b33b-2747c0708754", "comment": "Malware payload (Heodo)", "value": "e7b9c7ae85b65f18519cf9daed5b665424eb5e90d9ea917793d93a57f0a8860a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067715, "uuid": "fdf78ee3-f631-4377-b1b4-c804a2dcaa82", "comment": "Malware payload (Heodo)", "value": "6dd23b1933a3da9ea040ae251f8c42b8545975fe", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067715, "uuid": "ebfb9747-946b-4bad-9e06-b16730ab4dec", "comment": "Malware payload (Heodo)", "value": "c3c1b2fd371096c1500a92b172743eb130df0a7aa657350d42fc64e9df0239a79e0ca51ef1fa16216dcbdbc7ded49a5e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067715, "uuid": "4bfdbb67-b578-4fd2-b19b-c9b912c28130", "value": "T1019301DBD295DD7FF8E6D438E4B7A0B823728031C1581E82628DDA48812D5C797FA2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067715, "uuid": "1c15b64a-05bf-4f6c-a1a9-7fe993cc9d2b", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbN:yIBQ3MYeGt9sLBrGrBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639067715, "uuid": "94780a83-f395-43f8-be10-83bc9339965c", "value": 90157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639067715, "uuid": "516696c5-abfb-474e-9f17-0e56648ebe71", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067715, "uuid": "06fed51b-7a58-4388-9d4d-f3ed3f1cd4b9", "value": "emotet_e4_e7b9c7ae85b65f18519cf9daed5b665424eb5e90d9ea917793d93a57f0a8860a_2021-12-09__163414846102._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4bfe74-5894-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639015663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015663, "uuid": "1ccaf9ed-1056-48d4-a526-d615fb275845", "comment": "Malware payload (Heodo)", "value": "87f3e48a50811fa79105f24a7d058647", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015663, "uuid": "c279525e-a4ee-402a-9ef7-94d21e6d7609", "comment": "Malware payload (Heodo)", "value": "e81bd1835e0def5be5c97a03de9e48b06cf8d6a93ae4fe144c8284df4a7f1d99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015663, "uuid": "b6227573-4b94-4a6e-9740-94ea306fc901", "comment": "Malware payload (Heodo)", "value": "b9eed45b6c15ab4c999e6306308d19f5c8137e67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015663, "uuid": "15cff4f9-8800-4443-9038-e8166ba88da5", "comment": "Malware payload (Heodo)", "value": "b292167cac6f1003a17d83722783586d40893954931d433d8dab43dfcc640431f4213c44bb533de6e91313b2a0442e2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015663, "uuid": "4ab200c5-896d-4ada-ad1b-83520edc05aa", "value": "T19544BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015663, "uuid": "a6195b91-c7ae-46f1-a5ad-3cbd51e3a73d", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015663, "uuid": "be253020-8fce-41cb-8636-e7991bd6cf5d", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTB52ypv:6jIG/pjjuLbJLmGshoCUnWTPpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639015663, "uuid": "697480fe-1b69-4df6-8f27-7d442904fa38", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639015663, "uuid": "ed802a2b-bbe0-4cfe-9a18-21ecbfa5f92f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015663, "uuid": "9fa76f2a-2e0e-4eb9-abc7-c854c075f8c2", "value": "87f3e48a50811fa79105f24a7d058647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8518ac5-588d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639012624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012624, "uuid": "3bd97f33-bab4-499a-9ff9-161438dbadee", "comment": "Malware payload (Heodo)", "value": "d574e8dfcb34731a09ca02bdaec35e78", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012624, "uuid": "20a5dc64-dc6b-425d-9e7f-451a847db96a", "comment": "Malware payload (Heodo)", "value": "e83a83cbbb92b8b2d1158d03ce1c4fa5489c29da3349db1a33325d1adcef501b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012624, "uuid": "ba10a9ce-02b3-4043-8071-485f547eb297", "comment": "Malware payload (Heodo)", "value": "a1511f4fad6c92689a8bb42de37c168fcfee3a74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639012624, "uuid": "53190007-93dd-449e-82ce-0723e2f27e17", "comment": "Malware payload (Heodo)", "value": "39d62797cd04171db0a811ebdb6903db45a045551f7dbe00fdaf21762027d522f5e7a164f990b52115054cf852882890", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012624, "uuid": "3adc91a5-dc11-4e97-8a88-4f03339be7e0", "value": "T14444BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012624, "uuid": "a8f9dbd8-2604-42a5-b87b-b385af09a147", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012624, "uuid": "3fa1b61c-edaf-43d9-aef1-5b6a0d17fd54", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBQ2ypv:6jIG/pjjuLbJLmGshoCUnWT4pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639012624, "uuid": "75a76fcc-e7b2-4b5e-9c65-08bbc470d55e", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639012624, "uuid": "89428485-09e0-42a8-839a-e8900c6068ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639012624, "uuid": "ac65c75e-6953-495d-86ee-0308cfc7ff91", "value": "emotet_exe_e4_e83a83cbbb92b8b2d1158d03ce1c4fa5489c29da3349db1a33325d1adcef501b_2021-12-09__011659.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3aaa77-58ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639052418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052418, "uuid": "49759a60-ec5b-4708-9fe1-6a99ac4215e2", "comment": "Malware payload (Heodo)", "value": "1f5bdca06f2444488e8899bdbc159831", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052418, "uuid": "f35ba1a8-061a-481f-bb80-51a7b324a6af", "comment": "Malware payload (Heodo)", "value": "e8519e1548fee8c35bac50eb473ce75738bbe6273baa63ed60c17602fb23873d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052418, "uuid": "61af368f-61dc-4c83-bd84-9dc10aa29f14", "comment": "Malware payload (Heodo)", "value": "1217ddec0886fb76bd0ab35c67ae8da217896144", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639052418, "uuid": "ecf2de2a-ce68-4e0e-ad04-deae2c008d25", "comment": "Malware payload (Heodo)", "value": "89ba4a7d01d1ae2303a1560e4459cde35476fd2345d7278e9fb0e7a22f1bf026ce69d89285a1dbee07b20894d6db26c6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052418, "uuid": "3248212d-d305-455a-93a7-b920942c57b5", "value": "T14393F1CAD6A5DE7EF4E6D038E4BBA1B97333C036C0581E82914DDA88812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052418, "uuid": "36edd523-f882-42d9-ae24-09b087794722", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q30:psXZ3MYeGt9sLBrGrQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639052418, "uuid": "196ddb96-3acb-4f6b-b500-98e573a4f1e6", "value": 90152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639052418, "uuid": "0a9a4123-0417-42f0-958d-d116932e817f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639052418, "uuid": "b6f8ff2a-3ca6-417b-92f3-a2cf12ff43dc", "value": "emotet_e4_e8519e1548fee8c35bac50eb473ce75738bbe6273baa63ed60c17602fb23873d_2021-12-09__121950398575._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523b7dad-589e-11ec-96a4-42010a9c0029", "comment": "Malware payload (1ms0rryMiner)", "timestamp": 1639019754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639019754, "uuid": "49f2a671-f025-4604-a200-7e0338e6cca2", "comment": "Malware payload (1ms0rryMiner)", "value": "a173721aa16d4d28f473cd022ab286b1", "object_relation": "md5", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639019754, "uuid": "78ca2113-db98-4aba-ab9f-4408c51c406d", "comment": "Malware payload (1ms0rryMiner)", "value": "e88ecbbe677d8cfb97ba9a42db6f8b038aa96526b283b9de8635a80dd25790dd", "object_relation": "sha256", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639019754, "uuid": "14360ba5-d06f-4784-a0d2-a6fedc54ea66", "comment": "Malware payload (1ms0rryMiner)", "value": "51ebb5bc0562f1bc698fac3e7f4b92e4db76d3ed", "object_relation": "sha1", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639019754, "uuid": "66b7c00a-ef21-4ea3-ab49-4d6a3368c5b6", "comment": "Malware payload (1ms0rryMiner)", "value": "ef41a41f819b85ff3b85ff29fc93158ccb167a2f60bed87e8214a01bda33557aa692ee4032440cd17712cee8b6d7d8a5", "object_relation": "sha3-384", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639019754, "uuid": "c940ce64-05a0-4bf1-a659-19ebd69bd7be", "value": "T1D50733F2BA7AC0D7D3D36AB3B4730F23E6D46A21499A04283710775EF8B452D9E79502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639019754, "uuid": "842684c0-31cd-4b84-b2b5-d51b0dd9d76a", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639019754, "uuid": "36ac2572-db70-44a7-9cee-5533bb029668", "value": "393216:JFyuViM/+fuVUo8QaV0PtW3zOpICAkb/qFOzqmffW04X1oxvdYXw0:J84bhURCmOlAkjaEfffW5CxvdOw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639019754, "uuid": "e5531ca6-cbd5-42ac-8abc-a31409c3de32", "value": 17365332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639019754, "uuid": "e5be4d21-7655-420f-9a25-27b72758791d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639019754, "uuid": "8d738cff-de92-4cf2-a2dd-03ee4d60be90", "value": "a173721aa16d4d28f473cd022ab286b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e328cd12-588e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639013126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013126, "uuid": "2bd103cc-0645-493e-a855-5709b705274a", "comment": "Malware payload (Heodo)", "value": "dc582bbee493408345e62b0a7c4c74a3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013126, "uuid": "48f98720-8124-49c7-9017-da1c6d241fd8", "comment": "Malware payload (Heodo)", "value": "e968b2af583804d642b7374c45753629d3a6ac63dab8a73293f7d805d0e84747", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013126, "uuid": "16cad0c5-7bcc-4cc8-8267-7340ec471ac8", "comment": "Malware payload (Heodo)", "value": "0dbba06404713f8bfb73e9bc3db7e4677eb6a25b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639013126, "uuid": "67274c60-d370-41e4-b565-1c8c9c3b2f7b", "comment": "Malware payload (Heodo)", "value": "47d043c2f03a825efe87ddf14141dd9bb4b6052f6b2e937e46c2a7eafb8554902ffd0c95fc8a6d16e9b20bf4460debec", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639013126, "uuid": "ce1503d9-0e21-4ea5-8d31-281f6627a6b2", "value": "T18E93F1DBD398EE6EE5E7D438D5BBA1E927628027C1685EC181CDCE8C812C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639013126, "uuid": "7273c428-1592-4634-9c56-8fc362fd8d30", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySP:Gp4Z3MYeGt9sLBrGrSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639013126, "uuid": "9fd42b7e-7adf-4966-b3c7-0101e509ba3f", "value": 90143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639013126, "uuid": "683459e1-45cd-459e-a9dc-c7f0f87d1889", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639013126, "uuid": "90859aca-ff68-4583-9b2c-1e5bea05c154", "value": "emotet_e4_e968b2af583804d642b7374c45753629d3a6ac63dab8a73293f7d805d0e84747_2021-12-09__012512958124._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ee7b69-5900-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639062033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062033, "uuid": "e26b6516-c0ad-4237-93a6-0ce102a4ce69", "comment": "Malware payload (Heodo)", "value": "8d72c04f2c246acea8e53cc05998f8af", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062033, "uuid": "a7f87f9d-6333-43bd-be61-2a326874d72d", "comment": "Malware payload (Heodo)", "value": "e9e88b7232ae3639e10a4b099da5c0a7e8feb75810afdc3f11bf726b2b9b3fbb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062033, "uuid": "d42657cb-2687-4871-a0c1-d698049f304e", "comment": "Malware payload (Heodo)", "value": "117ec2225aede3d12d05ab643480113d0d2e4602", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639062033, "uuid": "595e39df-ecb8-4b75-9310-0e7a486afa3d", "comment": "Malware payload (Heodo)", "value": "c3fb16587ffb49d0da264b987ed6ca6fe9a5c8da7a01a9fd3328b2005aa1ca4f034c41a35ed31712ea2ed53ea32ff756", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062033, "uuid": "df208ff0-3d14-4ee5-88e3-3a77d1ec1466", "value": "T1139301DBD295DD7EF8E6D438E4BBA1B923328031C15C1E82628EDA48812D5C757F92C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062033, "uuid": "4425f14b-58f4-4040-b139-07781e8b5871", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbl:yIBQ3MYeGt9sLBrGrBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639062033, "uuid": "2eb80e1c-18cc-4178-80e0-80f3cfd411dc", "value": 90159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639062033, "uuid": "b6d54d0d-8b51-4abd-b34e-a475b73623cc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639062033, "uuid": "fcdaf764-2d48-4dae-a6ae-fb1202ffaee7", "value": "emotet_e4_e9e88b7232ae3639e10a4b099da5c0a7e8feb75810afdc3f11bf726b2b9b3fbb_2021-12-09__150000477051._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd4f42d-58f9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639059100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059100, "uuid": "0bed50d6-16ad-4365-9ba0-216a319dcb1c", "comment": "Malware payload (AgentTesla)", "value": "4c0869fba5da8bc32186fe0442e3448e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059100, "uuid": "b2758253-6ef8-4bb6-9702-d1f09cdcb946", "comment": "Malware payload (AgentTesla)", "value": "eb496a85e94a406b12177111cf9d0ff7be9714fc7109503237df6dfb12a970a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059100, "uuid": "e73628cf-57c6-4cd9-921a-a105e8877a79", "comment": "Malware payload (AgentTesla)", "value": "79954e5c61c775c37d8be9d55d4f14acd21351a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639059100, "uuid": "ef234dbb-c369-428f-95e1-1cf1befcc7bd", "comment": "Malware payload (AgentTesla)", "value": "1303a06937d26258d344bbefe2ae2ec89dcb518c96ec2ae9e457b84afef1ce714e559d878c073ddc27c0d43f3cf51dc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059100, "uuid": "4e1c9cd1-fbf7-41d3-98ce-2d08e7357633", "value": "T12555231639A0A69BD2BC57F1C65380918FB9F0172DB2F2FA5CC141BF97346899E12B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059100, "uuid": "5f20c3e8-596e-41c8-8f5f-17a0522ea45a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059100, "uuid": "41afade7-51ed-4563-a080-e4af6cfbf261", "value": "24576:8IKjy/SYCpH4mV1vP0W25T1toiKFlvH/SfduzagP9ZHvxaVw:6jASfnfioNvHyH+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639059100, "uuid": "dd0580a5-866c-4951-9e47-8da0c0db8a9e", "value": 1305600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639059100, "uuid": "7f51ce3d-a79d-4d48-8064-5da9bf1b45f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639059100, "uuid": "ade95b39-1296-49ff-8a8e-a02503247393", "value": "4c0869fba5da8bc32186fe0442e3448e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea57d83c-58c8-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639038048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038048, "uuid": "2debaff8-62ca-4c31-84d4-480338fd6199", "comment": "Malware payload (RaccoonStealer)", "value": "660e98f9db4b7907212adb0b5fef70d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038048, "uuid": "08f11db9-f7fc-410b-823a-23079a8b3103", "comment": "Malware payload (RaccoonStealer)", "value": "ec01600e6344a310982ddae1f8af1a618ee02984bbe60e82190d4793bb079fa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038048, "uuid": "94201c0b-f4e9-4db2-832a-21034e7d6613", "comment": "Malware payload (RaccoonStealer)", "value": "b7191dfed86f666e054ec9dbb715a236a9d73479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639038048, "uuid": "0e6acc30-5dd0-473a-888f-b7267b524c79", "comment": "Malware payload (RaccoonStealer)", "value": "3ee79022c9bd8f692d9f81e43f55b6e36b2198914ae7c910a6f82e4479810c95ba31a59d17262b58bb8182d0322291d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038048, "uuid": "946ff122-3098-43c3-aaae-ba9ed7f061ce", "value": "T14C649D00BBE0D435F5B712F459B993BDA93FBAB15B29A5CB62C116EA06346E0DC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038048, "uuid": "015c044a-a43f-4e94-be43-11bf4449a96d", "value": "971a9f981d9286b99905cee799d3e7b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038048, "uuid": "29e44aa6-cef3-43c9-b48a-6938eda6943b", "value": "3072:8vB0ByUsIBgrc7fdU+iV5vV+h+NmfwcBIpbOtJdNaIxtWEEUtWDmLox1Dejwu79:NBgudeVxEh+gYcWpbiJNxtHET6KJeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639038048, "uuid": "f8999583-bac9-4c20-abd7-3e53eb822f1b", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639038048, "uuid": "7156b30e-3a9a-4534-9f23-ec85a7a3d27e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639038048, "uuid": "68e9b3c1-9255-4c07-ab64-8173647faf9e", "value": "660e98f9db4b7907212adb0b5fef70d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d29672e-5936-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639084922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084922, "uuid": "d1b05a2f-4239-4146-8adc-9ebcd8b15510", "comment": "Malware payload", "value": "12793192a5eddb51c6ac313a0f10ceb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084922, "uuid": "5e1abd9d-7a29-451e-9574-6ec0f62e9853", "comment": "Malware payload", "value": "ec104e3c83fb076eee3078ab084abe0c3d6a419d06ae6aef2934120a86dad1f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084922, "uuid": "0478682e-85f0-4cf2-a92e-7a334fa2e4f1", "comment": "Malware payload", "value": "6dc3c493d66b8567072c2fa10cf01b66c0f8f8f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084922, "uuid": "21d8fd1e-f80f-4ce0-a699-488887357a01", "comment": "Malware payload", "value": "5cfa79d9fad1a69566a576c53e21322ffaaa2452a66dd6184041512bc762007be3bb5e651a8e98c5b0dcbe450f1a3a26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084922, "uuid": "e6978455-5ca5-485d-8bfe-1066866a779d", "value": "T16655231E19F4946FE0AD96B18397C060CEBDF0032DA6F6B65DC105FE6A78AC5D502B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084922, "uuid": "709aec79-c531-4e56-844f-7a770a3495a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084922, "uuid": "e1feba32-de3d-4d40-b6d2-bc35e4956b66", "value": "24576:5IKjy/SYCpitcl/C5bc4OVF5NlSwy/tb369yEH79SUXTNDI6:xjAS6Wq5dOVF5NBytb369VQaZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639084922, "uuid": "0eb3fba2-ec0a-4f67-b399-57726fab9551", "value": 1297408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639084922, "uuid": "9d8cdd90-5c3f-482d-ae48-e7650daa6071", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084922, "uuid": "3001a297-457e-44d7-baae-d6015148bb88", "value": "Fac0912.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe788d12-5906-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639064711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064711, "uuid": "374a4fea-6595-4187-b41e-b81c732c0c2d", "comment": "Malware payload (Smoke Loader)", "value": "65fd5caa0beaf2c6915e5b05004e5ba8", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064711, "uuid": "bf5cf439-f75d-4b69-b02d-d11a25d04f85", "comment": "Malware payload (Smoke Loader)", "value": "ef0d3b336aeef7f0a0aeb78ec08f1f20592d8006bcbe3fbb559e18aebcf060a3", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064711, "uuid": "eaf5729a-a964-44fd-a873-8017f0576dd0", "comment": "Malware payload (Smoke Loader)", "value": "4a1e5e5c188ef1e8a3e5bf7fa7db17f0307c6912", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064711, "uuid": "55ec379a-1c94-4785-b71b-d03cabcd5c74", "comment": "Malware payload (Smoke Loader)", "value": "fb49e2ff7a290263235c343163e08e8fe16da4c83ae1216194d1bb4538845811a9e5bfd6343c395f3d5f7a0da8eadf78", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064711, "uuid": "7d167f60-552e-47f9-802a-a327c6a0b77f", "value": "T17864AD00BBA0D435F5B712F84979A3ADA93E79B2AB2490CB62D116EE17346D0DD7031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064711, "uuid": "a0a7d689-f735-42f9-9de7-9e4660a93a7e", "value": "1e7f53cbc09c74d2d76a753a16b82f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064711, "uuid": "a43f2d15-70c2-4445-8a3b-da8d1ebd9c8e", "value": "6144:hLkR/cdt1kquusp4uIPGjzO5qnfhtc52IQ8:hwRcOqubp4uI+jzOw5tcRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639064711, "uuid": "6e577b19-e856-473b-9543-647dd6c5712c", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639064711, "uuid": "69b5d0b8-36e6-451c-9610-63322cce30fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064711, "uuid": "940b4178-4bdc-4265-9018-a2176e515c85", "value": "65fd5caa0beaf2c6915e5b05004e5ba8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f80838-58bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639032169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032169, "uuid": "6fefb31b-0ab0-4ece-9cbc-4891f4688925", "comment": "Malware payload (Formbook)", "value": "b4daa86e8ccce47aa17112044524b739", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032169, "uuid": "7b1e7210-06f8-4d47-889c-08e54ddaa4dc", "comment": "Malware payload (Formbook)", "value": "ef1ce544a008966a834d36b9f01cb2a7989c7cf522a4a58c349e2300e1ba028d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032169, "uuid": "ae66f9f2-b78e-454d-955f-cc0b3ddc1663", "comment": "Malware payload (Formbook)", "value": "51a43c905928f2fcbb77c1acbb840d97b2805853", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032169, "uuid": "1bd28e9e-ca06-4dec-af51-756895c3896c", "comment": "Malware payload (Formbook)", "value": "a7b7934add86420b811ea8ed64c5963dde5267b79a27d8e6abc8854ad29badb8741c6a7c819f22f377d145f3a9b001d7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032169, "uuid": "a2b9d679-c4da-454c-b3b7-bbc4214e2f42", "value": "T1E77271ACC44751988F8AABB4AB1F6F58015DBA6DFB419532327C673127E2C3B442287D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032169, "uuid": "a7e5ec11-b201-440a-b9d2-d48e74511203", "value": "384:L+IkmjVRtzJbuJfOzZJqL7n6PzuAaa3tDQNqXeRE:SIvflbugGLL+tN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032169, "uuid": "5fdc5a4a-a35e-4bf2-a91b-6f272961cdd6", "value": 16036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032169, "uuid": "89b158e9-f819-4054-86a8-060aa62497c5", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032169, "uuid": "c7cfac7d-0cf6-4559-aeab-f07e9c6372e7", "value": "swift copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7630249b-58bc-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639032700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032700, "uuid": "b05a7ec6-bbe1-450a-be6b-3300e1d5eefd", "comment": "Malware payload (RedLineStealer)", "value": "5eb34b974f20e03a514dd4ce99d37e79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032700, "uuid": "cfddbbb4-154e-4ee8-ac5c-08007871f6c4", "comment": "Malware payload (RedLineStealer)", "value": "ef81cf82d1c69f209395d913e2ba23f49423057e0b109cb8c6066b22d743154f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032700, "uuid": "f2190dbd-5965-42c0-bada-172cd72cb86d", "comment": "Malware payload (RedLineStealer)", "value": "eb5660690bec6e308aff580d66e71ad274dff585", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639032700, "uuid": "36cd9a7f-4546-48a4-a09c-433bc085a689", "comment": "Malware payload (RedLineStealer)", "value": "7530c5dd1a94f43ae99ebef110ab13ed62ef7c02393082581509dcb60b7c8ca03d4a9be7764bdde151981255f53c637e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032700, "uuid": "a4019c05-8051-45a2-9afb-25369c7ccb57", "value": "T123159E12A7F84119F2F73F767EB462A54A7B7CA2BD38D28D026104AD0876B54D9B0733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032700, "uuid": "62c9d717-9e91-4a8b-a885-ae24f7308630", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032700, "uuid": "6ce3ea83-d4a3-4a23-aeeb-92e952e77669", "value": "12288:tUXDORLSsEFV86uc9szUwlfSYABjFZq0IoK6hNEYgJb3snUYm7wE7i3vXSfH3ZU9:tCVsEkdpSYArZBbxhNEqUzwSi8U9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639032700, "uuid": "35d8d012-f73f-4c1f-8d48-6da75a0d367a", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639032700, "uuid": "613fb301-cb02-44ad-bd60-00fa3c5fff75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639032700, "uuid": "fb28ddfc-9158-4f83-86b1-31c435f46745", "value": "ef81cf82d1c69f209395d913e2ba23f49423057e0b109.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed969110-5892-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639014861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014861, "uuid": "f9e96b9b-530a-4e97-a7a3-89a80d36653f", "comment": "Malware payload (Heodo)", "value": "117633aed41417faa6c21df15f0b05a6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014861, "uuid": "49f0c606-7c28-4931-a06c-7f67a5bdac5c", "comment": "Malware payload (Heodo)", "value": "f05e9847d3d9861f367d11e08ef16aecc53db2e91d45d11250d7642940e48216", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014861, "uuid": "7dfc6712-625d-43d2-8c7c-3226e62c7b21", "comment": "Malware payload (Heodo)", "value": "6f4738a97ef84a331d6f2db3a13156dfb3e589cf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639014861, "uuid": "5de35023-34e7-42a5-b72b-f4d2d965f416", "comment": "Malware payload (Heodo)", "value": "f24ec38e19b9389c2450150bbec98735812a5dce0efbc2a6b1347c9e4a4eea0bfbe7c64d6b2c5cc3fe3ec30d390b14d0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014861, "uuid": "abf01ff6-01d0-4e1e-9279-6e68bb8036dc", "value": "T12D93F1DBD399EE6EE4E7D038D5BBA1E927628026C1685EC181CDCE8C812C5C653F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014861, "uuid": "a6419907-425a-4c4e-a057-e4f76c16346e", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySl:Gp4Z3MYeGt9sLBrGrSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639014861, "uuid": "14b6a8c8-8c6d-45a3-91c7-62d9f481adb6", "value": 90143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639014861, "uuid": "97db3837-4556-4bf2-840f-c4a1e448fec9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639014861, "uuid": "bd36ec13-060d-4bf5-874a-e3d242a062a3", "value": "emotet_e4_f05e9847d3d9861f367d11e08ef16aecc53db2e91d45d11250d7642940e48216_2021-12-09__015408182387._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a738c8f2-58d0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639041372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041372, "uuid": "601af422-abcd-4d9b-91f4-6da87d7d9048", "comment": "Malware payload (Heodo)", "value": "5230a23e990bc64dca0f9df4c3532eb2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041372, "uuid": "0c95d39c-1be9-4d26-a43a-7a7e8375b5e8", "comment": "Malware payload (Heodo)", "value": "f0b7231879367172ffc03d67819ed0582b25245f0dde0e927ab218ca909ed7e2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041372, "uuid": "07022959-3600-410e-a73b-7a5eb0ef94a6", "comment": "Malware payload (Heodo)", "value": "2b41db257d2b94d4a31b74ece2cef3f92c0bd551", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639041372, "uuid": "48fb593d-5037-41ce-82d0-8b011b485126", "comment": "Malware payload (Heodo)", "value": "d92b9cecc4acd08f6419a70cbe883b023e2afda9741e7feff4e59adf55eab36d488a67b9f8d39d08e02d68f340054c11", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041372, "uuid": "4f426c36-b1d9-4d71-8c16-1ed4527f1ad3", "value": "T13F9301CAD6A5DE7EF4E6D438E4BBA1B97323C037C0481E92914DCAC8812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041372, "uuid": "f7d1d75f-0a60-4e4b-bc73-19f91468477e", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q36:psXZ3MYeGt9sLBrGrQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639041372, "uuid": "e84ee38f-e861-4a52-9fb5-fe05a465cfeb", "value": 90150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639041372, "uuid": "15ba8751-5b95-4534-930b-b6143a56a919", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639041372, "uuid": "9c6a9178-7d91-46e0-93ad-73329c102ed4", "value": "emotet_e4_f0b7231879367172ffc03d67819ed0582b25245f0dde0e927ab218ca909ed7e2_2021-12-09__091559017834._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b5e1dd-58ed-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639053741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053741, "uuid": "b5be0258-03e5-4b42-bba9-f573ebd558ef", "comment": "Malware payload", "value": "49e4e68fa4002a4f6635e318ad85b460", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053741, "uuid": "8e5dcd47-50d8-464a-afe3-dd4df71a75cd", "comment": "Malware payload", "value": "f1161c82900c81f11b781e04f95d88110a2a570681b5602c05268a34cdd8f73c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053741, "uuid": "c4bd7116-b1c3-445a-af1e-7f243f9c3159", "comment": "Malware payload", "value": "c4bb2c2c60ae181eeb8105f95c1532f7a7c86b0a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053741, "uuid": "e2b94b75-080d-4fb2-8045-f35e70a2ba3e", "comment": "Malware payload", "value": "fc28ddd70f5d2b6efc1d3152e0393335728a65b1beed95f59d7c5a21de0be1dde1d46c11ea09356a830049732ae40522", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053741, "uuid": "68ba898d-453c-4a3f-b1b6-ec5164f8fbdd", "value": "T156B56C22B1D1C577D0776A7CDD5BA3999825BD201E28880F7BD43E4C9F39B803A292D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053741, "uuid": "c603fe78-9158-4582-aef0-961725c96396", "value": "24576:wtFe5GYZAROp4F7PxW5Adm3o285/ykWlooVAy1Q4DZ+coqssPpgB39kUhFfD0/ky:wtYGYZLwaY2EyjONsR6iTPyFYjZEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053741, "uuid": "2ac49fd3-c912-4af5-884d-e9f0534d5f3d", "value": 2462208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053741, "uuid": "cb9eac87-0e18-41b7-beb1-b5e31814afa4", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053741, "uuid": "6ff5d912-6500-4289-8aa5-59306e9add02", "value": "Factura_08122021_(977KB).PDF_office.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9e02cd-58ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639054187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054187, "uuid": "a415b0a1-7bf2-45fc-b2e2-ad4fe9e44c75", "comment": "Malware payload (Formbook)", "value": "d01e4a83d76ee9c91d1a4d578084ea66", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054187, "uuid": "2a1b7101-8307-47b5-8a1e-34215014e8f0", "comment": "Malware payload (Formbook)", "value": "f126c941dccc8dc3166a5ab575d25e9dd0629ce64a853176a250ab8acc521a51", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054187, "uuid": "76228c81-302a-4110-a101-0c996857041b", "comment": "Malware payload (Formbook)", "value": "67df73f11378f532086ff221e51b64010146b82e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639054187, "uuid": "4767a666-f669-410c-bbe5-f0ea02a2f01d", "comment": "Malware payload (Formbook)", "value": "1bf98debc215434652f6b1b3d93735ee1b87d165b388488243452728627e78fb26afd95755bf66653d8157101fc59ba1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054187, "uuid": "8bc5aeac-e938-4f09-91a9-5a7e31045b65", "value": "T1813412C17ED9D40AD156B7F62844EAA2C919EFE80E9E79E075EE354D21709DB2300F70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054187, "uuid": "421fc869-fe3f-40e4-b8b4-31935eeef1ce", "value": "6144:4QvhKF1ZrdTYnhjFDsiNUjRf/lxBFqV2bYtsCom6K+wMBO:46hKRr8jFAiN41rqPtl5IA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639054187, "uuid": "ada0db4b-c080-4681-9ffd-d79848b4eab8", "value": 234328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639054187, "uuid": "bd5aad73-5406-476c-9a92-2d491f9d96a8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639054187, "uuid": "1433cb2c-9277-47c6-85e2-ba049b949c6a", "value": "Maxifruits Order_367464.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc729bf-5893-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639015291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015291, "uuid": "d0cba58a-2f40-47e5-92c1-72d48cee613d", "comment": "Malware payload (Heodo)", "value": "c53f107e32e923bae19131a5622a96df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015291, "uuid": "a84ac328-8db5-4f0d-9e4b-6877af4dba8f", "comment": "Malware payload (Heodo)", "value": "f1e34014f42b3e55035e60d9ca98a62da034f71ee491a5f6af92c7c33065550b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015291, "uuid": "7ebbe160-6184-47c4-9618-a82f7944e9e4", "comment": "Malware payload (Heodo)", "value": "a380551069df81a7c5ca96668f8e7bca19d94cf4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639015291, "uuid": "b743eacf-db33-4eaf-855f-b11a2d99fc8d", "comment": "Malware payload (Heodo)", "value": "901eef390ae9a38c88ee491cea48dfe0890bb497bca96dca6632c8cc5a3709def6f020970d7879b64e0af8bde220bba0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015291, "uuid": "6185f0e5-5e07-492e-9eb2-dc4753dbd9c6", "value": "T1F744BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015291, "uuid": "1a80448a-d30d-4069-af51-2375b1a7e5a6", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015291, "uuid": "0b6afb7d-17da-40c2-95ed-4cd3103e03ca", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBy2ypv:6jIG/pjjuLbJLmGshoCUnWTWpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639015291, "uuid": "e80160a2-b555-415b-ae41-d3b7e2f74d37", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639015291, "uuid": "82d3da01-1ebb-4663-b837-8f6df56b5d7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639015291, "uuid": "9035d6b4-5d2c-4e38-8015-7da02440aca3", "value": "c53f107e32e923bae19131a5622a96df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce505177-5908-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639065489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065489, "uuid": "f5f3b178-4c2e-4fc1-bb07-dda013323f39", "comment": "Malware payload (SnakeKeylogger)", "value": "8e2842851a83b15b75c7647d10081a68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065489, "uuid": "c1cf31ee-a93d-4b83-93a6-0af67aff96df", "comment": "Malware payload (SnakeKeylogger)", "value": "f2cb48b9e10b252066d9162e6366ae9955a46bed5cd25c6e7c0ccc9b6f04b42d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065489, "uuid": "702aa61e-85b1-42ad-b677-8b27f7012c4b", "comment": "Malware payload (SnakeKeylogger)", "value": "04b3bd9a663d357a180bfca218bb4ae4e8b4f79c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639065489, "uuid": "b7e6e254-866b-4e13-b6bb-5ff4e1f6aef7", "comment": "Malware payload (SnakeKeylogger)", "value": "2be1b13550caf45acba36834b020944cd8a513900633397fa3f3e65e4e8c2657b245894ce48a68fc948b7b7b05c84cbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065489, "uuid": "aa65e180-2abf-4a9e-988f-fd52feef88a8", "value": "T1F135120A1AB5F46BD1554AF5C257C051CEF9F04A1DA3F6B2AC9110FE6B78AC8C943B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065489, "uuid": "ca71c24d-71ad-496c-a39f-4c78d4c17b06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065489, "uuid": "4eeda28b-68ef-443c-939e-0b7ba17501ee", "value": "24576:pIKjy/SYCp787THwNpUYEggmy7nTSNIxDd5qyLPxfCvkO+xPkjS:hjASz83eiYEMy7TSNIxd5B0tZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639065489, "uuid": "c9962bf1-54db-47eb-85b7-9e11df8941e2", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639065489, "uuid": "4c8fe81e-fb3e-4dfc-b69d-454be0a1e7d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639065489, "uuid": "6e0cde2a-2f52-48b7-9f34-1f0640e2318f", "value": "payment transfer swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cae9f5a-5907-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639064896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064896, "uuid": "56ad6ec8-9db8-4ecf-be3a-518e9d683439", "comment": "Malware payload (Heodo)", "value": "ff1606efae628a1663c90d356761b26c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064896, "uuid": "4009e3c9-ebef-4afc-9605-426afbf403d9", "comment": "Malware payload (Heodo)", "value": "f37b6e26f4d57136470d7f92f9b5dceab3c31038cabb1db75f72155760bbc58f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064896, "uuid": "d10d2a75-21ae-4f88-8912-7c178ce505c1", "comment": "Malware payload (Heodo)", "value": "d53be3f458ebbd2fab9835b782a2293b526fa00c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639064896, "uuid": "8c003736-6daa-4703-a486-888f2df08b28", "comment": "Malware payload (Heodo)", "value": "288dbf0e22d09a6325799ab0695ec6c14893d6cffd4ff25b74f7a19e4ae9c7173cba6ab1206a740336fbbd4f5cce8cc4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064896, "uuid": "0405b67f-46c8-4a29-a05f-d700ad719aad", "value": "T1349301EAD295DD7FF8E6D438E4B7A0B823728031C1581E82628DDA4C812D5C757FA2D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064896, "uuid": "83b54892-d5cf-472d-a4dd-f68b48b793d7", "value": "1536:KbIBUPvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+nbe:yIBQ3MYeGt9sLBrGrBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639064896, "uuid": "1a3e6ead-8f74-4a5d-8dc9-0a5fe489bacb", "value": 90158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639064896, "uuid": "018981b8-95b2-4b94-875a-daa3ebd2b129", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639064896, "uuid": "76a4a4e9-550f-44e0-b68d-9b25c7ca0e3a", "value": "emotet_e4_f37b6e26f4d57136470d7f92f9b5dceab3c31038cabb1db75f72155760bbc58f_2021-12-09__154746475324._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3b9de8-5898-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639017406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017406, "uuid": "1df3310b-9ceb-413d-b6ad-f3cf152a435e", "comment": "Malware payload (Heodo)", "value": "d93c6e8b51236c679aa0c8e85cb29e51", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017406, "uuid": "9b0001c7-70e9-4892-af2f-05c1f691cc95", "comment": "Malware payload (Heodo)", "value": "f385d5c463923592652fa7395420d5113175f823a448140670dad62f04603f6f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017406, "uuid": "1f19dc06-0359-41cf-9643-fa9abe2f6192", "comment": "Malware payload (Heodo)", "value": "7eb6754f5c9becd72a5de23d78bdb204723c881c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639017406, "uuid": "335ee808-2b00-4602-ac02-3860acfda839", "comment": "Malware payload (Heodo)", "value": "11d304d2924454ba29ff7082a2f4d3eeaa585222dc18a19b03acbcccf93fda4cf8d8f490d25582bd0874fc88a701ebcd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017406, "uuid": "3ccdeab7-8403-4161-a710-fbc696024336", "value": "T17993F1CBD394EE6EE5E7D438D5BBA0EA27728027C1685EC181C9CE8C852C5C657F81C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017406, "uuid": "534a333d-793e-40e2-b48f-0ed988c40c96", "value": "1536:cvIIiT11PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+iySo:Gp4Z3MYeGt9sLBrGrSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639017406, "uuid": "5ed8fabe-d22c-4b4d-a8ef-6edce821dd93", "value": 90142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639017406, "uuid": "5e632f6b-6751-405b-a96f-6106a6283a2f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639017406, "uuid": "701df6e7-4673-4a80-83de-b552d8b86d65", "value": "emotet_e4_f385d5c463923592652fa7395420d5113175f823a448140670dad62f04603f6f_2021-12-09__023629425035._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08376ee-58f7-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639058165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058165, "uuid": "fd391433-91fd-4ff5-b7a3-1cb5c29ca34a", "comment": "Malware payload", "value": "d34dce5a7f54244e147ec145995b413d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058165, "uuid": "9632db3a-c82a-4188-bcc5-7358d032d6fd", "comment": "Malware payload", "value": "f398a72426e71c42b7241102937a488604979f471ab60ca144f8ebaeb3f3134c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058165, "uuid": "fada59d3-b9a8-4979-9ea2-ddbe96ee7076", "comment": "Malware payload", "value": "eadd50e842b3ca51dddf65cb2ac222ce379fed69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058165, "uuid": "99abedb8-7713-481c-899f-93709d386c8d", "comment": "Malware payload", "value": "d609d628dd44c50cdafd69c9bf77348e75577dca86698cb0040fbee7ea571a7d7586c494ddfee3d8514eded844693b02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058165, "uuid": "c5d2b2f9-6cd0-4b1b-95c2-c594ea895a6c", "value": "T18A05121D29F0946FD17957F5C263C0608FBDF0072EB2F6766CC112BE7638A859A82B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058165, "uuid": "90c71803-eac8-484e-a1c0-7e46b289ecb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058165, "uuid": "1f6388d7-6aae-4c52-8e93-3191b5468aea", "value": "24576:pIKjy/SYCp2L9ex8Cd5r2RYJ8zuAfJ33j+8e46r:hjASepex8U5rTqzuAFT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058165, "uuid": "40444932-f404-47cc-8dc1-7c17cc6b999f", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058165, "uuid": "23a0075a-9797-47ea-b70a-4463580a49c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058165, "uuid": "60c0943e-e436-4e6b-a1fd-5bc8fccb52e4", "value": "LIST0012-Dec-09737437822000440262110363_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d265e00d-58f7-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639058195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058195, "uuid": "cc7a6992-171c-419f-a04e-08ddcd919bb3", "comment": "Malware payload", "value": "017e57f02b6a6a7734d810c47d6b3cce", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058195, "uuid": "ef66ba6d-8257-4693-be8e-170c6db7554f", "comment": "Malware payload", "value": "f3f6de15f7491d404bfe71e9831749fd25e33828a4f150ed97610105b44dd8d6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058195, "uuid": "37281271-78b9-454d-b6b5-c1ca2960e20e", "comment": "Malware payload", "value": "9758bbe1e16f07b7e1eab137f802645325c05ee7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639058195, "uuid": "d4e519d1-5cc0-4f77-9e1c-1a45fc0cf3ac", "comment": "Malware payload", "value": "f986efa106b7ac07943b7bbe741a063fbf433264f42fb0f705c91f72822628332671eb63452121a6d1e5b19618c4dd80", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058195, "uuid": "1be268d3-a52c-45a9-a741-dd1b8999b75e", "value": "T13953C029E1DA6D8BCE274775158F92E5E3837325502D4BD43D6130EBCCE2C9970787A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058195, "uuid": "ea1da772-3b20-4d9d-bd1f-2faee01db3bc", "value": "1536:hbDQddfUed5L4fwIsxJOudbxqC/kHpl9uKY:hbcffUXwhJd0+y7uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639058195, "uuid": "3bab03a5-d1ff-44d1-98eb-82c1c8bc5034", "value": 60738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639058195, "uuid": "ccf7e669-ba6b-49ca-846e-d69791c59729", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639058195, "uuid": "423a03fe-26e7-41d0-b6ec-a7cb092d612b", "value": "emotet_e4_f3f6de15f7491d404bfe71e9831749fd25e33828a4f150ed97610105b44dd8d6.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e2155b-58e8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639051412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639051412, "uuid": "e7ee1110-c89a-426f-804f-4521daa297be", "comment": "Malware payload (Heodo)", "value": "4cc15541646b5b6d70ee3745d7e8b617", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639051412, "uuid": "204c7762-f9a4-4d5f-9fad-607d0224c517", "comment": "Malware payload (Heodo)", "value": "f40d26895ae37340ccc04c2ce8514c7e921ec9047100bbfd7c89a7b0bba61dd1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639051412, "uuid": "02c63e98-0a67-4c00-8611-77d8ec776ba1", "comment": "Malware payload (Heodo)", "value": "c30437a2fbe22d7c1bb0bdfdd8baa3df562df07b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639051412, "uuid": "8234d0cd-1f2f-4757-88e1-2fe86fb4d780", "comment": "Malware payload (Heodo)", "value": "81069b9784f7b896a7bd37303dd5ae0ebb8a2b47048a9ff77ab4903be22bb647bc98d2bae4cf0274003007ba665c4432", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639051412, "uuid": "756b675c-58b7-4ccf-bc29-1381154c3fcf", "value": "T1CC9301CAD6A5DE7EF4E6D038E4BBA1B97323C036C0581E42918DCACC812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639051412, "uuid": "3e83a61d-3a53-4030-b295-2ec17deea08d", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3D:psXZ3MYeGt9sLBrGrQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639051412, "uuid": "38ca26f9-43c3-46df-9f34-923bf13907d9", "value": 90148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639051412, "uuid": "0063ec6a-1ff7-40bd-890a-a7e3536e2106", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639051412, "uuid": "3ac44508-2abe-4b8f-880d-1e450cb767dd", "value": "emotet_e4_f40d26895ae37340ccc04c2ce8514c7e921ec9047100bbfd7c89a7b0bba61dd1_2021-12-09__120306880856._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd3eb40-58e1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639048443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048443, "uuid": "6efca2aa-3473-4e77-9003-b26572b976ad", "comment": "Malware payload (Heodo)", "value": "582f76a1213cc421b9e10c0675999742", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048443, "uuid": "9b7ddc3c-3bf8-4e1f-a35a-07697b35a67e", "comment": "Malware payload (Heodo)", "value": "f469688bceb339010e200f2aa7f2ca3417a9eaa5b326a281d26458287acec4e7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048443, "uuid": "6d611862-e4d2-4467-a2be-070bfd700838", "comment": "Malware payload (Heodo)", "value": "d5501b964a4b7da392328c5d86cf13a348ce821a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639048443, "uuid": "42f2d8bf-6f69-4caf-884c-d0fe490cc115", "comment": "Malware payload (Heodo)", "value": "98e693e601136a9d2aa33f08a71aca6062c6c4fbf43b895eb58204c79ea1c27a2ecd1bda5b98f909083bdbf3b46aff28", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048443, "uuid": "7c62b9aa-9160-47ef-b5d4-5653704a9409", "value": "T1979301CAD2A5DE7EF4E69038E4BBA1B97323C036C0581E92918DCEC8812D5C657FA1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048443, "uuid": "ed5872cf-0323-410c-91b6-9b278bea7c5a", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q30:psXZ3MYeGt9sLBrGrQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639048443, "uuid": "c9942dda-1ac3-4803-aa6c-ba0e88d2a19e", "value": 90151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639048443, "uuid": "ebba0e62-49d4-47c9-83be-38fefba31cce", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639048443, "uuid": "54a8d609-5d46-41c4-8f63-9be67dea9d8d", "value": "emotet_e4_f469688bceb339010e200f2aa7f2ca3417a9eaa5b326a281d26458287acec4e7_2021-12-09__111338095638._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968a9144-58dc-11ec-96a4-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1639046498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046498, "uuid": "89f8e2a8-0900-4f01-a022-1df46e6864b4", "comment": "Malware payload (AZORult)", "value": "822ba9b3cb71807e33170424907db927", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046498, "uuid": "25b23078-3a85-4cd5-9bfd-07d363c7275a", "comment": "Malware payload (AZORult)", "value": "f4e530cef710d98aa5ca1a24d0c8ee1ce83b534afa2dbe27b58ac857729a662e", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046498, "uuid": "707d3298-7183-421c-93ba-557eefc3d3e1", "comment": "Malware payload (AZORult)", "value": "55e6e7f0796a002658ecb2bda433a862dfb23df1", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046498, "uuid": "169412c7-34df-4843-9010-a55117cdabf9", "comment": "Malware payload (AZORult)", "value": "2d9aef9e57210d2584b6e796e76f6284ec2883afc32b3b94ec14c6d60bc244209c7f9ea23928a045f8980205b6b5e25a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046498, "uuid": "526dc273-248a-4b2f-815d-c10670932ceb", "value": "T1E735121926E0A457D07967B18367D0A1CFB9E05B2D63F27958D242FEB638BC9CA03743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046498, "uuid": "a345688a-d9ca-4431-b12d-88a9730cb56f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046498, "uuid": "2ba01a1e-28eb-4e7c-ab00-6e1843ca85e6", "value": "24576:lIKjy/SYCpTSvNLO+tHcQbjFR8v/kbGpGpYBbQkhJoy1FQePLSHB:djASrSHtHvjFR8v/Ryeb5hVX9SH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639046498, "uuid": "f8bee299-ce68-44a5-8442-aafef88d1db7", "value": 1141760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639046498, "uuid": "7f85f53d-56e1-4853-ae4d-bb9c147be26d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046498, "uuid": "d7d1a4dc-e3c3-401c-ac24-b4529036e9f0", "value": "822ba9b3cb71807e33170424907db927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f3bb9f-590c-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639067059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067059, "uuid": "b860ba4a-80fd-4893-bc71-a9cf83eca910", "comment": "Malware payload", "value": "aa57fcde9c6aaf91270aefaafc3b4510", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067059, "uuid": "a0484288-46ce-4820-a202-b9fab4b547ac", "comment": "Malware payload", "value": "f4e7dadf3fc4520b7b99d41f7bbf7f3bc5ce1fc0c1730a726992537c603c980e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067059, "uuid": "c880903f-a895-4f0a-a5fb-3003a0337997", "comment": "Malware payload", "value": "5c849ce251739735c30d522676db1cf9352fa8c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639067059, "uuid": "eab4df08-d6b1-4208-9cd9-b3457c76f90c", "comment": "Malware payload", "value": "ce4e5b768bbbe09462abe9ece3b4b90d29e363e809cf019bc78fd1ea4a95f6bca9735f551e8923b13771ef2b503814ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067059, "uuid": "78d2a900-be48-4f1b-9557-e76fb5d28da4", "value": "T1C08535F1DBDA8B5FACCC986163020A7A51CA07678D45879AD0BC53FC787D982CC6BC52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067059, "uuid": "a99e25bb-84e2-4450-a191-bdce56973848", "value": "c131e7ab95b6cc6ff4c2379d5b0fc4ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067059, "uuid": "27f7a706-5888-4a64-ade7-5c35480ea07d", "value": "1536:sjkUHInOKVU9vFhgD6wK1LhsfAWs/g9UhwtV/IeQ/HQljEqt:sjFiDgL+C/3hwXfuwJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639067059, "uuid": "e16223dd-bcf4-4928-91b0-900489385dd1", "value": 1821184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639067059, "uuid": "605ecf1d-1337-4e97-9d43-71aa3b40dc28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639067059, "uuid": "e2ac3f94-ccf4-401e-8437-83f944685d49", "value": "aa57fcde9c6aaf91270aefaafc3b4510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ac28e3-591e-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639074917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074917, "uuid": "20e54a7c-6698-4572-900f-edb8f3c08527", "comment": "Malware payload (RedLineStealer)", "value": "24e239cd3d4a6b308436b4a41a59d3a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074917, "uuid": "6676e2cb-ac8a-4526-84fe-11ea40625f97", "comment": "Malware payload (RedLineStealer)", "value": "f4f588e0b75e4caa0fca73dd981c859eb3437384d52370c5d6726d58d93e9c1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074917, "uuid": "437bc242-252e-49b3-a0b4-ca67bce150b3", "comment": "Malware payload (RedLineStealer)", "value": "c7a5b4d2126861cab3e4a3d28d5726ebd839a441", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639074917, "uuid": "13fb8d6e-21e3-4109-b6ad-95e91c63c2ea", "comment": "Malware payload (RedLineStealer)", "value": "106b13ed5c212fc4042cea015b6ca08fedd4b286e18579e09ec9b1c5bb05d08613cae2abbb21ad598ef954080028df37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074917, "uuid": "028500e7-86a3-4673-9066-719ae98aa9f5", "value": "T1E87533075424A598C74723FDF612B2BE7A5F1CDEB0A0257653394B3ABA86278C7190FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074917, "uuid": "12d3a535-d483-451b-bfca-9ea789019ecb", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074917, "uuid": "9119c85f-d745-47dc-bf60-55731bae9eab", "value": "49152:qyaYF5MNgSgQEcHirE7PFd1xtD0dNaWS9N:innLCr6PFd1javSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639074917, "uuid": "fbbbfb6a-f2d2-4e34-b235-ee13833fc0fb", "value": 1636864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639074917, "uuid": "5455e8dd-07b6-4161-a3a2-c015cef86ee0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639074917, "uuid": "40051ea8-1598-42ae-86bf-42308dacd01a", "value": "VAPE V4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c40b1eb-5936-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639084974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084974, "uuid": "74a1c8cb-7fe5-45d9-ba78-7f790711b0ac", "comment": "Malware payload", "value": "db8dd4b8f4134c5d7645abce953acacf", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084974, "uuid": "50341305-afec-4a6c-b3ea-a5c8eb8a1604", "comment": "Malware payload", "value": "f6c06615e35798274dfa9c4b28aaa6d94220804e766e9a70c4f0dab4779ee1db", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084974, "uuid": "b2852b54-d2ff-41c5-bdba-90217254d4e8", "comment": "Malware payload", "value": "9cfa578b42cb0a585ca6a0cbab362667d88250a3", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639084974, "uuid": "95e7d097-5c1c-424d-955d-23c65ca497f2", "comment": "Malware payload", "value": "7eaa6286ed9da05b9112896c30751c4e11eb44fc12bb7755f41d3625fa855cffd938f04e2f597f19665ad075ed0f1af8", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084974, "uuid": "e0486037-032e-42ef-8bf1-5fa8a4a09d6e", "value": "T1E1974965EA8C486CBB24B531BB9FA40BA3F2BF4C6178DEC639D15DB3755F100B621A04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084974, "uuid": "3ead6f41-949e-43c9-962a-5972f8d5432c", "value": "f66aebe787110e03686c13d46a416836", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084974, "uuid": "68ebe822-795f-4e61-93cf-72db425193bb", "value": "196608:QtkZbOHESTj6lN8BIKHbXFcvqIb1oW42rY/QVHodr1yTTzfWRVIklHbEq9wp6P8Y:QsbY9ylN8SKrFcvHRMQYYy9MmTHFCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639084974, "uuid": "f589249b-9e8b-4231-9d9a-9b5e637df7bb", "value": 40442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639084974, "uuid": "bcd6aa36-c43a-4228-b1d7-c344ed71240c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639084974, "uuid": "b4f632f1-14a8-4495-8670-ce57fc862db9", "value": "terms.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfd75fe-58cc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639039690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039690, "uuid": "4915e556-4413-4633-8981-36af7cc5c766", "comment": "Malware payload (Heodo)", "value": "053fa09cbd5d588afaab6dc12c60c6ab", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039690, "uuid": "63aa154e-77ea-4f1c-bd4b-0d6e6e67a9ff", "comment": "Malware payload (Heodo)", "value": "f837a14e07a4863a4e9ad20c7cbe3c779dfa6d32ac4556961879ce6928867bf7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039690, "uuid": "47560e03-cfb2-4bfe-9a37-b13bb3795495", "comment": "Malware payload (Heodo)", "value": "7fd8fcdacf3e9713533af5feaaf4f209e2ce20d7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639039690, "uuid": "b2b98d28-1e4d-471d-b272-2a9ba77ad3e8", "comment": "Malware payload (Heodo)", "value": "4a3c87450e264721622cc3b08f50a70e7428fbf48676100fbc1f4ab5467e9693d129ebf2fac0a52d399ae8fb642ce29f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039690, "uuid": "ed98dcd5-042a-4208-922d-eb6e81c478ed", "value": "T1A69302CAD6A5DE7EF4E6D438E4BBA1B97323C037C0581E82914DCAC8812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039690, "uuid": "fba567bf-70a6-460c-973c-3af8961f6478", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3iP:psXZ3MYeGt9sLBrGrQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639039690, "uuid": "fc400af1-b0e2-489b-85ff-f06a192aa501", "value": 90150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639039690, "uuid": "a44a21f5-801d-4088-b676-7a633f4352b0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639039690, "uuid": "03e84248-17b7-47c3-88cd-66f9b523aaa1", "value": "emotet_e4_f837a14e07a4863a4e9ad20c7cbe3c779dfa6d32ac4556961879ce6928867bf7_2021-12-09__084757199720._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78211896-58ec-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639053319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053319, "uuid": "23e6e94f-ef3c-42d3-a84e-521116e4788a", "comment": "Malware payload (Formbook)", "value": "2bf7ec30a7bf521e51ccdcdb6de8122d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053319, "uuid": "b6ad7b1d-7dcf-4133-99e5-9a6cd1a97308", "comment": "Malware payload (Formbook)", "value": "f870cda016332c396d6be3822bd6367e6e788b6e3b34aee7ed8bc873fb81c16f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053319, "uuid": "c6a3c236-2723-4c61-9c60-e9ef9f2590f0", "comment": "Malware payload (Formbook)", "value": "c8411197d8974e88c1d1743478b770fd8bee7757", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639053319, "uuid": "8d209ef7-f144-4526-884e-199f65d316b1", "comment": "Malware payload (Formbook)", "value": "c248b8a8edd40aec6150279bb341215029fd90b38fc6b347d183a7afccbea40bb2851c7dfe9e02aab97ba2179ab53d55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053319, "uuid": "7ca455cd-c239-4316-b161-cf176d9300bd", "value": "T13445BE4D3201E08FD556B870C8692FF45600AE7DE207D767A8173A2BFAB8F998D124F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053319, "uuid": "70c6811f-4a65-4d81-8d74-9e6098dfa457", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053319, "uuid": "ddbd75aa-beae-486b-88a6-b2ab8d95201b", "value": "24576:hlaP3G2c6rSSQgYtI7n+cy7w62Eb+DsRW+K75sQ2U+W04xCotunY:hS366r0gYtI7+cycHaWp75sB4M4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639053319, "uuid": "adac08ea-bead-45b3-9b67-cec2867457d5", "value": 1259520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639053319, "uuid": "c4f00f50-7f06-4b56-b65e-aad09f34e12c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639053319, "uuid": "9bbf6f3d-3494-4ff7-bc76-84a3f29e4601", "value": "ORDER INQUIRY-PVP-SP-2021-60 F.W.G-Symbiosis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d5597e-590b-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1639066656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066656, "uuid": "d92e2cde-fd3e-4188-a9fd-9eb0b0365bc4", "comment": "Malware payload (TrickBot)", "value": "2e92d20d2ad68d9bd5841910c488af6e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066656, "uuid": "2e923dfd-46c6-44fe-a3ac-04b1d87067dc", "comment": "Malware payload (TrickBot)", "value": "f894a027474fa36723db3644d7dc1715dbfd6db1dd18b1f124cf8abb8709e1f8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066656, "uuid": "8d2c7a1d-b3c7-4500-9b13-37388be7c01d", "comment": "Malware payload (TrickBot)", "value": "2daff152cecad77f3a1e5e1d43ee07376fccdabe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639066656, "uuid": "8d9eeee3-e04b-49f1-9dae-5fbe0de9537c", "comment": "Malware payload (TrickBot)", "value": "dec7e84886052d5b01499b1657ee4f0d131d765ed6935453ce623f405a5f4b4d7d7379b90dcaa0c1f5d24c2cd889f5f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066656, "uuid": "ad815000-37a2-4688-a9b0-c34324a2a8e2", "value": "T1C38535F1DBDA8B5FACCC986163020A7A51CA07678D45879AD0BC53FC787D982CC6BC52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066656, "uuid": "aa787ee3-3980-4d82-9f74-559315ee1765", "value": "c131e7ab95b6cc6ff4c2379d5b0fc4ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066656, "uuid": "6ec7af03-81b6-4291-beb0-65273c67304d", "value": "1536:sjkUHInOKVU9vFhgD6wK1LhsfAWs/g9UhwtV/IeQ/HQljEqt:sjFiDgL+C/3hwXfuwJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639066656, "uuid": "20c03cdf-9dd1-49b4-9f09-6253938ff6ca", "value": 1821184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639066656, "uuid": "237e7603-778e-49b0-a2e0-948f7128e75b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639066656, "uuid": "20d66c62-7c1d-4fb2-912a-7ce749d50c25", "value": "2e92d20d2ad68d9bd5841910c488af6e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4646281-592f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639082277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639082277, "uuid": "1420f8d1-625c-4d22-86f1-501285d24dab", "comment": "Malware payload", "value": "8beb65d69ac7fde1ac47347cb728435a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639082277, "uuid": "3a22b40f-f8d2-4b48-96a4-dab8d2c80c25", "comment": "Malware payload", "value": "f8f97ce86ff8d8910c5d5329c009e3fae7635f01bf21000a7929ff2183e55993", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639082277, "uuid": "9df2aa07-5d79-4bfc-ba53-364059337207", "comment": "Malware payload", "value": "088b9b3d2aa948d9db330519614061370c8dd2d6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639082277, "uuid": "1fff49db-6914-492f-ba79-a0e131c52178", "comment": "Malware payload", "value": "1dcdf18eed5d6654b99ea8f2b3299f1af894bf41cdf1cc19d69cf3072a05f738f731c40a26ef1ad37f36ab6f40f9cd1c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639082277, "uuid": "493e82c9-6286-48d7-a776-ecedf9d45495", "value": "T10F357C00E740E027F9EB00F685FB96B9997C6730136149CF52C86BE9AB256D4BD31B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639082277, "uuid": "523acc15-a50d-4b01-9564-f60fae5c0052", "value": "5607b60d2043ceb44befd6bbf5fa6d91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639082277, "uuid": "6e0d13ce-8ede-4a61-9f44-d7734fad8e80", "value": "24576:ygM4d4mrYD7THpWf+4RY4GbOXwRDh/+cNeTpO:yZ5THpP4CvmcNeTpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639082277, "uuid": "30bba854-dabd-4504-b964-993c17218e4c", "value": 1135104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639082277, "uuid": "77ccec08-8e76-4acf-8424-d15c9bd2f645", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639082277, "uuid": "a27c2818-58da-4462-8e9a-03a2068b2c01", "value": "emotet_exe_e4_2280d38bfc421d5882bd9158d7060c44a59129cf59713670303e5f2370b21392_2021-12-09__203751.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f067edc1-58f3-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639056527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056527, "uuid": "0f90a91b-977b-4ecd-b130-3097fca08982", "comment": "Malware payload (AgentTesla)", "value": "d84f36ca8edb73bfe0fc09b2ec4ff775", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056527, "uuid": "ba16c43f-01d2-48c2-9483-c243ec05cc59", "comment": "Malware payload (AgentTesla)", "value": "fb2b8095fb4e4eef76362e8691f03c906ceeac94660c96f141b5c7adfb071e7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056527, "uuid": "76641c50-2b99-45f9-83de-78de880b12d9", "comment": "Malware payload (AgentTesla)", "value": "4a2ee7cdbc25ca82bbd4e20471184113eff539d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639056527, "uuid": "05f1de8c-c17f-4735-af7f-4050d185bed9", "comment": "Malware payload (AgentTesla)", "value": "b4552fb854577e2be2c0b164b8274dda8e1fb6da1e966c75b063e5680adf194e1632c027787b711adcba565fa1be494b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056527, "uuid": "331ba4dd-5fa0-45a5-9ad6-06eb5e21c1f9", "value": "T197350134E86B801CE85735F40F157D960E2BDEB9C412961A277EB228683E603CF657DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056527, "uuid": "642242f6-0c5c-402c-ab39-8f024fab5e0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056527, "uuid": "88c3424a-fbd1-4cf8-a06d-9cb4465a53c1", "value": "12288:2mVTvxvY/D0/Z4Y9mhZBkmTKKhxUdXWe0zjJOQLzPRdEiS538f6kR/mh1Nx1eEEb:22vw0/TuYSDhfJOQLzJdjStPkRO/gU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639056527, "uuid": "2ace4b87-675e-4940-9a5d-299b55886da0", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639056527, "uuid": "909e8d19-a656-49e5-be0c-e0a1a967da3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639056527, "uuid": "de79b8df-1b5c-427a-93df-83fb8cc04cb8", "value": "kutipan_langsung.09.12.2021.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2218beeb-5883-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639008077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "db8a2d63-99f1-4e70-b24e-ea54328d92a8", "comment": "Malware payload (Heodo)", "value": "7e1577f85764953e7b43d771bedd1bf5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "9a90c8dc-2d5e-439f-9eac-f7de31402296", "comment": "Malware payload (Heodo)", "value": "fc95f5bcca06f9733781c56a74de06c72ac22d92b1a1e2493cf734bf2acd0212", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "700fbddb-c1a1-4f1e-a1b2-c4e31fddc53f", "comment": "Malware payload (Heodo)", "value": "5d11a3754ecb13eee369f2df0f323297434e14c0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639008077, "uuid": "8c081e06-cfb3-4fd5-95e1-cbfb390d19ff", "comment": "Malware payload (Heodo)", "value": "f01ca48ec31e7682e379de7f352d53d76bccca5571b9c7565840806089d0d856ea8519ea84981dd730b2075dd50bed4d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "c1bacc80-33ff-48f3-832b-44bcdbf08d8d", "value": "T1B244BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "38d3545d-5959-48b7-b2f8-5c5e78ce4272", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "56568a68-6205-4320-933e-ac72c8f75838", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBC2ypv:6jIG/pjjuLbJLmGshoCUnWT+pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639008077, "uuid": "bfbeb248-3e8e-4c1f-b8af-0d7e5cf3f6cc", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639008077, "uuid": "9b2b5bb5-3d36-48d8-a92d-ec9352f00f12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639008077, "uuid": "b5f815c0-f657-45ae-8bcf-34f6cf0746b6", "value": "emotet_exe_e5_fc95f5bcca06f9733781c56a74de06c72ac22d92b1a1e2493cf734bf2acd0212_2021-12-09__000111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24555b6b-58b6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639029985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029985, "uuid": "d26fdbf0-3133-49d0-8052-99cbf4a08595", "comment": "Malware payload (Heodo)", "value": "3911d141b14dc47aa63e44094c58fe46", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029985, "uuid": "faf45c20-77d0-4cfc-abdc-c6889349f31b", "comment": "Malware payload (Heodo)", "value": "fd146389172e5af321ab7f36561e6f9be1d2a96def655c87813d24bc86ae81ff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029985, "uuid": "af0d5d4b-5204-439e-ad46-bd1e347eaecb", "comment": "Malware payload (Heodo)", "value": "77cdac125a88322fcc08f65b418d0b11b760e067", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639029985, "uuid": "97ac90a3-7d79-4797-b089-6e77aedaf281", "comment": "Malware payload (Heodo)", "value": "753c74d789a7db1462ce449c9dfea2c5d28e68e18eff2cc626d1018c8c4fd4818f1d650118470caeda9461714a22cf9b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639029985, "uuid": "c91ae290-9350-4138-ad72-072ff9ba9996", "value": "T123F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639029985, "uuid": "e1bdd68e-6854-4fd3-9b57-00b942357c68", "value": "12288:gKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/y:gapiKiBEmj4GbOX399Md9J/0Tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639029985, "uuid": "b8568b11-3846-4e38-9929-8935ca93aa26", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639029985, "uuid": "f08974ee-017c-4626-b805-26c5f275d3f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639029985, "uuid": "f5f5596e-333b-4026-bc1f-63672f687be9", "value": "emotet_exe_e5_d4af0c570e0fc4b8cc239296395416d6d33b9778cce0ea355f555e58d84ef035_2021-12-09__060620.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1c8572-5931-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639083100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639083100, "uuid": "511812f8-2a75-48b8-a262-5e700818e586", "comment": "Malware payload (RedLineStealer)", "value": "0536674f9cfd8d69e044c17c83620f26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639083100, "uuid": "90f5ce6b-7dab-478f-b3c9-1fb06d97053a", "comment": "Malware payload (RedLineStealer)", "value": "fd21e7dddc8ed426971983f819be29e6fa123dcdfb19d87fbbbffa12c147188e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639083100, "uuid": "8239c2d9-e2fa-48b9-9854-1ce5bfe181c6", "comment": "Malware payload (RedLineStealer)", "value": "3ff75312b9eaebbcdd948ae248684ba30acce89f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639083100, "uuid": "9bffcc48-4bba-4e41-b303-e90275e5e3db", "comment": "Malware payload (RedLineStealer)", "value": "ab79ed83733f65c88980fca72023975664b0a80ea5c3366ecae6566ff7df28b90195ca461d5bf6c530cba8b4b63caf9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639083100, "uuid": "add9ca80-2983-4c92-9752-547284bfd320", "value": "T1EA17336CFDF2511AEA9416FA3675ADD560A3E70137390B0DD108D634A26EE0C23F399B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639083100, "uuid": "fe4c627d-c99a-47f9-8ef1-84742daf8b47", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639083100, "uuid": "1a9ec72f-9f63-430f-b237-6bdb1ba613d9", "value": "393216:JDTM99S8xpL8R8PKAcYkrapORbLD0dHTNJZA2QZguN:JDMgwpL8RVdYkWpOJOLw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639083100, "uuid": "30b5e370-0135-436b-8f13-e511d26c5f86", "value": 18781591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639083100, "uuid": "5f639f06-d7fe-405d-9e94-eb344338a42a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639083100, "uuid": "31778a6a-295b-4f6a-9759-fc00e527eb4e", "value": "0536674f9cfd8d69e044c17c83620f26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae75491-58df-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639047579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047579, "uuid": "47d83575-1e44-4775-938d-94e20c55ae18", "comment": "Malware payload (Heodo)", "value": "7836f09dcf15d068febae207e4fc78c0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047579, "uuid": "ed4a4d68-35c2-4acd-8ef4-b6a4f8e0461a", "comment": "Malware payload (Heodo)", "value": "fe396373a53e8edbcf5424a2448fda5d86110293ec8efd19bd4b3d025ccc969b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047579, "uuid": "d32fe5f0-f8d6-4c4e-b57a-a0e8274a09d3", "comment": "Malware payload (Heodo)", "value": "b144afc3e7029d86a56cd5bac10767aa905efa84", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639047579, "uuid": "f29ec805-47a6-4cd2-a599-a60cda01704f", "comment": "Malware payload (Heodo)", "value": "a4e21b7219a76c761003182b46f3c6cec5bc24d2297a62d5d62ded32a176654be07bb3d4f361ceb5e9827e72053a0fc6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047579, "uuid": "953de87e-be05-4a0f-99c6-7d99795c8534", "value": "T1BF9302CAD6A5DE7EF4E69438E4BBA1B97323C036C0581E82914DCECC812D5C657FA1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047579, "uuid": "0dc49853-ff8a-4c9f-8012-2763b6712d3c", "value": "1536:+MayC7X1PvODDPDGhTYXY7AjVj4bBXm+pXgXLB38GY50lY3JxK+Q3l:psXZ3MYeGt9sLBrGrQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639047579, "uuid": "ef309a82-efc5-462d-91ac-416c897f535c", "value": 90150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639047579, "uuid": "d2b73696-7f96-48c5-9d45-e39f9e7b20ee", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639047579, "uuid": "62eba3df-a6b5-4069-886c-b839d87d8b46", "value": "emotet_e4_fe396373a53e8edbcf5424a2448fda5d86110293ec8efd19bd4b3d025ccc969b_2021-12-09__105914236557._docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fed5345-58dd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639046809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046809, "uuid": "e460fc9d-e21a-4ac5-bcf3-755dec709609", "comment": "Malware payload (Heodo)", "value": "9599223817f7b0acd3c525d0fe3984ae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046809, "uuid": "00bac5a5-0989-4cac-8e00-9b8dfc521369", "comment": "Malware payload (Heodo)", "value": "ff5318a0b2d5fb8be4411ee8e187fd3dff3df0ed22fe512d327d011ea6a26ad2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046809, "uuid": "03c0f116-7dab-4b4b-9f4d-c3e0271809bc", "comment": "Malware payload (Heodo)", "value": "e6cc76fed8da56867de16c47f4a9f691aba02475", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639046809, "uuid": "892a2e70-490c-4666-b0c6-f44564d69ec6", "comment": "Malware payload (Heodo)", "value": "fed98416075667d0d79e738492a91558e0c9728bd1a0cfebea0f9829ed674f58d5451e3313acade7870bce378b64e026", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046809, "uuid": "2b8bdc58-198e-41a0-a002-fb89136e2922", "value": "T1AF44BF10A181D036E5FF087A8AFAD9BE466C76600B80DDDFA398187E4F6B5C1763059B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046809, "uuid": "19eca78f-5878-45f4-a7d0-63e7073ba795", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046809, "uuid": "502f05ee-ac6b-435c-b382-1ab9d23c8a4d", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBlmgL/S:Wvef8+h61mRcHL+rF6l5EAQWTlL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639046809, "uuid": "02af64c4-f2a2-4450-bc1b-d1da2ee1d9fa", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639046809, "uuid": "36d13be1-2679-4d9c-9aed-f7b19c3d25b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639046809, "uuid": "be15f51a-011d-46da-a1b2-09b62cc12917", "value": "2HK.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }