{ "Event": { "published": true, "date": "2022-05-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-05-18", "timestamp": 1652918582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d4160253-79a5-4fc1-b49c-0c1c4828ab00", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e37a2f-d6a4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652876077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876077, "uuid": "9d84e593-c8d5-4a5e-9a30-be54b251d572", "comment": "Malware payload", "value": "293d03252f1f6bacf46b975573fd51cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876077, "uuid": "d5b3c048-ef8a-4305-a47d-9dd0f726d491", "comment": "Malware payload", "value": "001fcc10ebaa5c8b0aba9ce6f00aea8e5957e3a2d8e91e366c114e4661b1e46b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876077, "uuid": "f50d2fd4-ffd1-46fe-a657-712654bff9ad", "comment": "Malware payload", "value": "a3609a443d88ffa86769d449d1eddd9560004f9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876077, "uuid": "17e88cf4-b4d4-4879-9f3a-f6166fc17bdd", "comment": "Malware payload", "value": "c7f222ad440635f5b30cfcff652331ab5ba6f1f556773d84330849e1f4302d72f5277e530224b0b22f6f14f70b82d4b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876077, "uuid": "40126839-81bf-4fe9-bd8d-9a77b0494a25", "value": "T1DA959EE3C752010BF212607ED01EAEAD7062073167CFB877A7499FE8A75B2D06529B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876077, "uuid": "759d54d7-1672-4e6e-a93f-2a22536f0893", "value": "5a498eee87e4d89512a84502f500181f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876077, "uuid": "a6ea45f8-7638-45f1-86f3-652d6fa73be7", "value": "49152:e06m7NpA0GNJ/lU+zJwZjvjcpT+gDEvTqb8Td/pP6F:eA7UJ/5zGZjvjcQgGqYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652876077, "uuid": "d3356570-97bd-4227-b490-a9efd9342da9", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652876077, "uuid": "76453d97-b641-4679-ad8f-7fb4ae916065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876077, "uuid": "48fcb44e-6298-4131-8007-36a37588a49a", "value": "001fcc10ebaa5c8b0aba9ce6f00aea8e5957e3a2d8e91e366c114e4661b1e46b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db32432-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652908919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908919, "uuid": "a95c960b-fbb6-4bf5-ad93-776df6d6be82", "comment": "Malware payload (Mirai)", "value": "a6df5cc0339dbe6ab06ccd7fc067ffc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908919, "uuid": "744a83d9-50bc-4bed-a02a-e9acc298ca8b", "comment": "Malware payload (Mirai)", "value": "00338c7ea14917bc085ae308d76a947defd1a7e3b3c1207f2cb9001b7f86e94c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908919, "uuid": "c54b454d-375f-42db-ac27-07e3b622d907", "comment": "Malware payload (Mirai)", "value": "2701064e233ab933b2771ad8275c511b761c6d23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908919, "uuid": "52e1ccf7-eb70-45b1-aaaa-fa571372069c", "comment": "Malware payload (Mirai)", "value": "c86b8e646bd0771584efb55528824eecda734d569c3eec926c69e90aee184e5f165cfccb571716c94a6444fe2667cbb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908919, "uuid": "3863d896-dee7-4570-b306-2591eacf6f97", "value": "T165C2E1CC415D9126ECF2837B6FFE1DA67879AE6001D14186BA07E963EF45072571D8E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908919, "uuid": "022bfdee-33d7-4554-b86a-415ff2557db3", "value": "384:MpHJqPS0zMNBLioXT3qasxOpbHQ+3tRS0NlsdSZmEowWFh9rH82KWQj8EI1b+v1C:ogPS0uioOtf+3teSo3Fh9rLKWQj41sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908919, "uuid": "d0d55289-ae78-4750-95ad-2f22653a630e", "value": 25912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908919, "uuid": "52b856e2-cf63-44e4-9bc7-27d14831f4ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908919, "uuid": "774746ea-407a-469a-bce7-14a03547ebca", "value": "00338c7ea14917bc085ae308d76a947defd1a7e3b3c1207f2cb9001b7f86e94c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127d38e4-d66b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652851590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851590, "uuid": "5199085a-3850-4c78-bbe1-81b860a11778", "comment": "Malware payload", "value": "a3210ccbacbc52983f9c366ee76bff7d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851590, "uuid": "6b0a9dfd-5ceb-4e05-ae98-33fde336af67", "comment": "Malware payload", "value": "00c4035e538ec82961651877b8b076f4c2b0b21fb57bf6e2395182a1b5ce6ff4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851590, "uuid": "c0df5c5c-1e3e-4eab-980f-0c6a060a11b5", "comment": "Malware payload", "value": "55d4c33830dbd6f415e1711bf0ba1e106bfa9d03", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851590, "uuid": "488cafe7-8d03-47b7-b282-37b3ccbb9ca6", "comment": "Malware payload", "value": "9e1c8f978f383b3e0401941a2db7ef3b4919781cc0f38bffb8a5b9eea78dfa188ce6221d77b3e3b3f5275fc7c3c38d45", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851590, "uuid": "9d8a7457-adec-442b-b3a8-980ac9d12c14", "value": "T1B794CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851590, "uuid": "ebe0cfca-6646-4ec3-a5e5-27f6bce938db", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851590, "uuid": "e62a61da-8a9b-479d-ad16-a5500d5e0ece", "value": "12288:M3hV6Pw4aT23s2ofd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ai3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652851590, "uuid": "3d8f02e5-dd68-4bd2-bac1-6f7cc000d7ce", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652851590, "uuid": "e1c220a5-3ff6-49af-91d5-19b5faf7dfbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851590, "uuid": "70657c47-0ffb-48b5-a828-763bdd4c4c36", "value": "00C4035E538EC82961651877B8B076F4C2B0B21FB57BF6E2395182A1B5CE6FF4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33809b7d-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652858517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858517, "uuid": "bbdde4b2-6eca-4243-b812-b356ba605df7", "comment": "Malware payload", "value": "c6bbdbdf58aff60b9a3619e57d8bd8c5", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858517, "uuid": "fddb0b76-40bc-4552-a0ae-92d2c181c16e", "comment": "Malware payload", "value": "01b4a9e7c4479cf0e72a55af192c151b08f96b8244805711dc8980d05f850e56", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858517, "uuid": "2b742b45-56ca-4309-a2b8-8bc27ef57acd", "comment": "Malware payload", "value": "918662065b337954cd79097f5137372c80a7e9d8", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858517, "uuid": "017b9d76-9559-4b47-9cea-f6dc1d47a681", "comment": "Malware payload", "value": "f22b874f8c3af48dea587e166f3630fd6ecb00adb8fd9d70a782f5ca2acaaad05e4f56ab39e610114943ac8de1487c18", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858517, "uuid": "877ae14d-b5af-457b-b8b7-f5a287a1b17d", "value": "T13D2412C8B628DECAF6E3F1750659E0694328EC1E5C4B5B85712733C2C8B5C129C963F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858517, "uuid": "9d6217d4-d185-4ef1-8b9e-cb16cc86765b", "value": "3072:6/Sf6wRRYeIGqhTwP7o7e8kBYl7LsQW22QDcuovBAkcbpMSYVgWK++dPzSfY:USMeIGqhwP7R8kG1LbFJyqcBVxPMPzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858517, "uuid": "2d7edc21-685f-4798-b126-e2f49c23b667", "value": 228920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858517, "uuid": "e581f1d7-3139-4682-ba07-8d4f3c225f8c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858517, "uuid": "ae077556-f00a-484b-97aa-c8b15e5299a3", "value": "INV 002-004.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d38f24b-d642-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652834025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652834025, "uuid": "6ba18262-5324-47e1-bc75-f4a833bbdbbc", "comment": "Malware payload (RedLineStealer)", "value": "c0985e8fa2d0a194b764f7641b74a187", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652834025, "uuid": "309cead7-ee78-45c3-8cec-409af7f41f63", "comment": "Malware payload (RedLineStealer)", "value": "02a5a4a60619915dd81f8a178298793689088cbfd0523b6b99ab99c85c51298e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652834025, "uuid": "394715da-110a-4019-9925-165db7e726dd", "comment": "Malware payload (RedLineStealer)", "value": "0050f628b046297a26492f058c198f406be802cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652834025, "uuid": "4e11c84b-e851-4422-9a47-4d5c5152819d", "comment": "Malware payload (RedLineStealer)", "value": "9abb3ccbd8218a8f0d8c961578737eeffd3ff78f2d475cd50ef347767ce42c167d6f5c492ad2df6065244e10cdd1e0b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652834025, "uuid": "2a3b198a-07a3-4e3a-8877-a099ac961ca6", "value": "T1B765294C631A4906EC40DB75DDB32F53BBABE7BA5C424B12A795BB3DC06B3BC1910252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652834025, "uuid": "56cd9bee-7e35-4b24-8203-6c466fcf759f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652834025, "uuid": "ac98ffe5-a96a-4447-9fbf-e3a44089fdf0", "value": "24576:9CEaqLkpjYvxU9W1ri2y9Er7x75F3Cy8BJVUw8:9CEjWjYpxSwF58tXVU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652834025, "uuid": "f991d657-9541-4304-a8d6-fac94084d780", "value": 1480192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652834025, "uuid": "c50770c7-57bc-493d-87a8-ea45a900c07d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652834025, "uuid": "c34a3b87-0e8b-430e-9586-8e47a913227f", "value": "c0985e8fa2d0a194b764f7641b74a187.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b14ee6-d681-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652861094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861094, "uuid": "c49455e3-bc25-4c63-99bb-e48a4f060299", "comment": "Malware payload (AveMariaRAT)", "value": "23d55ec743bb3c696c73ac8e3c8266f1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861094, "uuid": "257e22ad-e23f-4cd6-b930-83a521b59c4e", "comment": "Malware payload (AveMariaRAT)", "value": "02a8273b894fe6e5bc4c0b906593061c842b9522b7e2dd79a1544278c83f804a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861094, "uuid": "249ed81c-1e99-488b-a0ae-a546e9ab4e74", "comment": "Malware payload (AveMariaRAT)", "value": "b90dcb1202ff526f5c2614b00945e85a81acf81d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861094, "uuid": "4858454c-b5d2-4781-bac1-8ef6aead3560", "comment": "Malware payload (AveMariaRAT)", "value": "8cfe5aad98c67c9cdb8d2a938fb139ab7f22cbfa4f4ed82d8c532a3d3512f04110f7af465df10942749f6bd2a48d89e3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861094, "uuid": "05cd74f7-5977-4295-9cfa-72209527269c", "value": "T1BBD4CD67607CC2E2F96C3EF1520A4B601AB42E925071F21BDA9FBCD4E973713C4859E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861094, "uuid": "0bae047e-c0b2-411d-9bc9-3714493b888f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861094, "uuid": "5616a0f7-73aa-458c-9a80-6464f6b36cab", "value": "12288:XRxyyfH2qQnai7jezvvTuem5XDWg/QPaIvNX:Bx7HynXyhsa7vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652861094, "uuid": "c56b0fa3-12fa-4fda-a018-ccfc5923b4e9", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652861094, "uuid": "4fcb3307-a3a7-46ff-848a-78136512bc7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861094, "uuid": "bb682ca7-064b-42c4-b716-c97c5fcc59ce", "value": ".winlogon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef907a85-d6ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652892763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892763, "uuid": "6d942ae3-d69a-43fa-a34c-7ee5a35225b6", "comment": "Malware payload (Mirai)", "value": "9e4244dcf0943b6776ffa892196f2551", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892763, "uuid": "6f480c85-4fac-4e25-8977-de0fa32a6cdc", "comment": "Malware payload (Mirai)", "value": "031c4de0edff3a14f4a58543c29e29ba7a12d4daa4ad0040943aa39be1f0d051", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892763, "uuid": "809d02f4-88dd-4cf4-b9e4-e213eeb95b26", "comment": "Malware payload (Mirai)", "value": "fd9c7c858776e7aac6dbe077120fd0914e56d545", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892763, "uuid": "086aad06-18a2-4f2b-9559-d4ac49ff9a55", "comment": "Malware payload (Mirai)", "value": "24bac9304744ed4db1e307d76d62b363f29a3a3bee83f3105ed1f5bd84eaf6af3747d7106a38e9b77ab21dd6bf0b1b07", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892763, "uuid": "e6a23a31-1021-4059-9867-7b46297ee3fd", "value": "T1FAA3C60ABF350FF7D86BDD3709A92B06198C550A22E97B367930C858F64B21F19E3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892763, "uuid": "06e96ebf-718a-45c1-a896-0c2da4267605", "value": "1536:5kkhyTy3yryaiNLVeMoWpIRqzSDDmoilIINZTBuBZD2wvxdCnx:5kQ0UMKJCW0oSPIjuBwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652892763, "uuid": "324f26ca-cc05-469e-bb4a-fb0a92257e73", "value": 101680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652892763, "uuid": "94a7c799-41b8-4acf-a43d-990f0fcc3b5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892763, "uuid": "168c8878-1c01-4384-9862-b93050b418e2", "value": "Oblivion121.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e7a970-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908985, "uuid": "036efab3-2d09-4ddf-befb-551d9df76ae1", "comment": "Malware payload", "value": "4b58fe1d39d6a10b2b8d5b015a7d272d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908985, "uuid": "4901e690-6d75-41e5-9782-5118b8e39224", "comment": "Malware payload", "value": "034dad10a8f50833a8713293a83494ee66f9137a8c007da9d4c21d32219938fb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908985, "uuid": "6ff24567-165e-4cfe-905e-177ce31a9599", "comment": "Malware payload", "value": "856155364bd4404e5fc495dbdba8dd4b0d386f88", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908985, "uuid": "5dce4945-b25b-4db0-a749-5418befc8cfb", "comment": "Malware payload", "value": "db012b6366716436f52424e2ff45a672447c8cc0086aa3612510bab5f9582343afcd5d09cc45e486131e180eb9dcff0e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908985, "uuid": "6ec7f05f-cb39-41fe-950b-4a5c87134704", "value": "T1814166C5617130B43CF39D7B6329881433D4B0202DA5BD8664E5F8BA49CEF4D5AD61FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908985, "uuid": "72a6ecc0-31e4-4d1a-b0ed-9e6c06a925cc", "value": "24:IjVOSA1EraIOSA1hCoOSA1qJ6J9OSA1uOSA19OSA1g3OSA1pgOSA1fOSA1KOSAo:Ehhzhyh9J6J9hPhUhhh1hChxhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908985, "uuid": "1e18c534-ae54-4319-8b29-378fc2f343db", "value": 1900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908985, "uuid": "65fd9f76-23cc-4795-bae6-81e74ddc73a5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908985, "uuid": "4e672e67-6763-4d94-86fa-e3778d947927", "value": "034dad10a8f50833a8713293a83494ee66f9137a8c007da9d4c21d32219938fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de3eb1cb-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909055, "uuid": "27e93e06-9745-44f8-8737-1831ac7439f3", "comment": "Malware payload", "value": "3be2c12702961858da0e4bc67851efc6", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909055, "uuid": "f5f3187c-68e4-412b-b9b8-a7a41e94a2a2", "comment": "Malware payload", "value": "0389cc5946ac9195400ecdce3550dd181da0308456a15c6489e2d63cc2b279b7", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909055, "uuid": "d4cbf31c-f6b8-409f-b05c-973fd8accbc3", "comment": "Malware payload", "value": "e572a4f0252a3732d41d1d46fc15b58e1f1a2621", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909055, "uuid": "5e37a4f7-e6c1-416e-8c03-1e9165a01006", "comment": "Malware payload", "value": "fef256ac19d7b9cfcbdadc2dcc143632c2d3b6d393d83501d4e918051146b0ffe871e9fbccc92d13f3e455b0b54ac55a", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909055, "uuid": "039f4bf8-29f2-4139-9830-e5f2dabc22ab", "value": "T1BED5330C13ABBCFDF99D052827638DA5C1BD51F0B98260A2D76819985C3F5BE13CF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909055, "uuid": "04bf6da7-ef08-4d0b-bfd4-ae39e0641915", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4T:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909055, "uuid": "92d9198b-3742-43b7-8187-32fde22b8787", "value": 2752512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909055, "uuid": "b7773c8a-3af1-4a2e-9e4d-bf7623438db3", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909055, "uuid": "fbb6484d-ca18-4d09-bcb6-b04da1bc4891", "value": "0389cc5946ac9195400ecdce3550dd181da0308456a15c6489e2d63cc2b279b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39755e76-d65e-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1652846072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652846072, "uuid": "01b458d2-39bd-4b4e-9b81-8940d293ddec", "comment": "Malware payload (BumbleBee)", "value": "d159380bef01bb3bdabafbf202ef843d", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652846072, "uuid": "8a7d9696-e684-4244-8335-c07b0b6fec00", "comment": "Malware payload (BumbleBee)", "value": "03bdbec423dd2c79255eb8379ee50f94b49895cea2a5419b4a3fbd0db8c25d1e", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652846072, "uuid": "c8535fc7-9adc-438d-bebd-8ef35127125c", "comment": "Malware payload (BumbleBee)", "value": "d17f9544e99bba05f9c702102e0832dbbb372887", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652846072, "uuid": "396c23b0-8627-4002-92ef-cd4ab89394e9", "comment": "Malware payload (BumbleBee)", "value": "166ba651ef9d6e98809593f000defa6ab5e02c719e565cb44166e5be63f05db4875afdaa48b77e35940a3a6d9cd3decc", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652846072, "uuid": "78970841-1bae-4b4f-8d4b-1235147cafaf", "value": "T119557E35155A1033E3EF8335CF214A6AEA98710CD2D5AE7D0703C9F678816D9C8DAAF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652846072, "uuid": "d4be6e3e-beec-44b7-bfb1-fc21f07b2c28", "value": "45e5a86be3127bf8f78f9e42574800c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652846072, "uuid": "5e010951-c2ae-414b-bf0f-f11ba8351564", "value": "24576:9BRUr20joxnh+Ia6aBiQEFLplYEEIZY7NKTaadVCvnW4nOqHfqKtTqGcGHJb+zpF:jieYAhg4TaadVCvnW4nOqHfqKtTqGcGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652846072, "uuid": "500f25ba-0d12-41d4-a57c-30798a98f465", "value": 1376768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652846072, "uuid": "81a31a62-4343-48c6-8a45-9df5f358eb21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652846072, "uuid": "05d4b8ad-80e2-4484-9102-69f687cbc8f5", "value": "texte.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2ba8ec-d703-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652916861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916861, "uuid": "f4323043-982e-447c-9418-360a3d219a69", "comment": "Malware payload (Mirai)", "value": "90d0e28e7859c751a5be511ffe491917", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916861, "uuid": "a9a38dc1-2202-4a0c-af5b-6c53f327495f", "comment": "Malware payload (Mirai)", "value": "045a3cce0955ce4c1432226b241cb4d7cdb4b5ef3b566fefd072d1ff0074df8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916861, "uuid": "0475b54a-6979-452f-b5c1-8a0fc6effb57", "comment": "Malware payload (Mirai)", "value": "6240257ec6db99162bc75e3b2e653916a1ac1c63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916861, "uuid": "3dace690-8bfc-449a-acb1-f0d947450fda", "comment": "Malware payload (Mirai)", "value": "e88c0b67c97108d1fb0ba1d6d927bcfca126cc10c4c71aa56f317f9374f76c0fe467f995866928281cff0afb58e46535", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916861, "uuid": "c7c5e61b-a684-43f9-bd80-5674d453fe9a", "value": "T19A336B65E8294D64C14E01B4B82C8D3E1FE3E4C5A6823DB26ADEC671144FADCB904FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916861, "uuid": "f2c49ddb-ba92-4998-a035-26990c07e4a3", "value": "1536:3a+BiFCYXjD2/FuhFmKbwBx/AURAYEYCF:3pioYXOt4oQyAYEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652916861, "uuid": "a30a6388-d8da-4421-9a66-3a99d4f3c1dd", "value": 54668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652916861, "uuid": "92423387-390a-42a8-b267-787522d266d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916861, "uuid": "466a3f7e-cb2a-4406-b9a0-fc789cc5acce", "value": "90d0e28e7859c751a5be511ffe491917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b289b8-d6d4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652896662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896662, "uuid": "94e4e2e5-1910-4445-99d5-566c029c018f", "comment": "Malware payload", "value": "4715686c16924f33e361b802da26f3fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896662, "uuid": "88261005-8312-4517-b221-55ec9d305c39", "comment": "Malware payload", "value": "0579e205b0279b28ed83a2a717dc4cf6b5a39d2e92541f1e60603671cd31f48a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896662, "uuid": "7b4b59e5-c8bc-462b-b057-fe9e215994df", "comment": "Malware payload", "value": "7f2575befbae164daf6ba242b868c59915904af6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896662, "uuid": "5a52e143-fce4-44a4-8701-71b1f5b701f2", "comment": "Malware payload", "value": "8a2319ba04482e7e6c391f0747790890dc843dc400b1d889b7a8bfed58507e0d50dd4331382ececcc740f60819f0ea8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896662, "uuid": "fa41754a-8f3f-4905-b3d3-e6d110e1a78b", "value": "T1CA05273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896662, "uuid": "5fda4e50-dc65-498d-8158-83dc1e001706", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896662, "uuid": "16a2d88f-eea2-45e3-abc7-309e6b6677dd", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oyaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7wUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896662, "uuid": "c3542093-800b-431e-a9d7-87422e4edc80", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896662, "uuid": "a667d21d-93af-47e3-a473-6248c478a3a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896662, "uuid": "bcf98127-c8fd-4dd6-8787-ad285923100a", "value": "4715686c16924f33e361b802da26f3fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f35d058-d681-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652861194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861194, "uuid": "d24e49fe-c60c-46f0-a987-b5c07245295e", "comment": "Malware payload", "value": "c3304436b340a7d7261aa6b779fdba59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861194, "uuid": "f2cc59b2-c335-4088-94ef-32483f7c49ef", "comment": "Malware payload", "value": "059e6dd59c834dce6b1cc0ca756170387caf573e8bd3098675188189a8ccce0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861194, "uuid": "f7e569f1-07d8-4068-bb50-4c5d6ca4af0d", "comment": "Malware payload", "value": "0d366090d58d51d36c92dc61681de0fb7cd1b236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861194, "uuid": "6877d242-2eb7-474e-bfdb-f1d8aa2d4468", "comment": "Malware payload", "value": "0505058fe9a088518734ea27195b7631fb660340e19bd0f77d9019888ed220b1b2ac1d10f9b42859153c3e0f21d90f3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861194, "uuid": "b764c8f9-1a09-4817-9d17-a09474a00543", "value": "T1D954E1F3BDD91B81E1653DB732874E29F94FCCA1B42A58A1D36DF650D8B6BA0052027C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861194, "uuid": "1cab531a-6003-4075-9f40-89b9f0ba3c6d", "value": "cba1459e69695a90bc8db290bb5b18b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861194, "uuid": "c525211a-2f8a-4d77-b99f-5666b54f8b01", "value": "6144:ztvBPnU1b7e9SQii1EkoNlhlrQ2ZrM2xLobh6yoMq:Zv1nWdQP1EDhZPxLE6yoMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652861194, "uuid": "d613ff25-1609-44d7-99ce-e43cee3e80da", "value": 280996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652861194, "uuid": "d1021bea-3b18-4af4-9cba-423177fbb5ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861194, "uuid": "53d81b1b-c512-4eec-9b91-3d134ad6f6f7", "value": "05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9908bba5-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908938, "uuid": "f3b03dd0-d606-4f4c-870c-33ad914c86c0", "comment": "Malware payload", "value": "4075626a3636efa7fa5a184191b87f04", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908938, "uuid": "08995a2c-8584-4d74-844c-957690ba6c9c", "comment": "Malware payload", "value": "05c05239c23158756cf91182632635a659866770eb94b97f835fd9d94f11e161", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908938, "uuid": "602addbd-6be3-4703-b135-85cca49156c4", "comment": "Malware payload", "value": "2b2b0985c721b9b2c44e5651f7017583649284a9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908938, "uuid": "643aaea0-639a-41a0-a7ce-d030aa533c30", "comment": "Malware payload", "value": "009018b473ae83c100be1064a89094e76de946abfa3b723379e105a065b46957af3909b781d1d960cd6c98423412afe2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908938, "uuid": "9acbe6da-e602-4362-b193-14cdd3842808", "value": "T177A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908938, "uuid": "49065ec4-7bc9-40cc-89e6-7658062c5414", "value": "96:FRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:FRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908938, "uuid": "d70d70b0-4f62-4aea-9be0-c8ca4584b473", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908938, "uuid": "bf7d7b60-741f-47a4-a303-182f4c25beb7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908938, "uuid": "138417fd-2298-423d-b795-e500b008a455", "value": "05c05239c23158756cf91182632635a659866770eb94b97f835fd9d94f11e161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c27105-d6b0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652881438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881438, "uuid": "e96f383f-b7c3-4321-9cde-92414cf39257", "comment": "Malware payload", "value": "35382e6d7d1c3dc1f79464ebffca6393", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881438, "uuid": "2f5d0952-769a-4058-94ee-58558dc550d9", "comment": "Malware payload", "value": "05d74ee9a3d39dbd9e45bd8c265a7fdecaf9e1f8fe9f322127d4fe3b73cf04b8", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881438, "uuid": "759309ef-92ec-4f21-b4f9-6f34e31c3270", "comment": "Malware payload", "value": "b3ab4f8e5d238ea6a79f2dbeb64787fa298bf7aa", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881438, "uuid": "13c4043a-88be-495a-b663-e34f66584c24", "comment": "Malware payload", "value": "090db9d4be913aa4fcac8a9287e2c33ce4b06616242c876eebb3968293cd8a305b5681cf3dd913b4eeafaee68eb81bb4", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881438, "uuid": "69a999e0-8807-4c2c-be20-cc4c09672057", "value": "T176D42392B26FB5E6CB78A1C003D7E00E070D9E0B511F12D923D2C77D345B6A67E1E66A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881438, "uuid": "2e128d47-f095-49f8-8af5-f35785e3db00", "value": "12288:8/K4+5psu7lzr82T5nakCCZG0hm8u3Lwj9d+61N6d5g46Bn0G4e5HJltu4AP816H:/X59fnGCZG0k3MZtO6h0M7AP+XA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652881438, "uuid": "6965d655-22cd-4ef3-b693-7284877f8a7f", "value": 647404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652881438, "uuid": "e8dee137-1120-4f7c-96ed-fd6c5397f9eb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881438, "uuid": "c8d89874-9f55-4209-9fdc-05d6e82a4d70", "value": "AWB & Invoice.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22621f71-d653-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841308, "uuid": "c6ba613c-cac3-4d8b-b1de-f125ae36897b", "comment": "Malware payload (Heodo)", "value": "d79c4b29dc4d86a8b456e2c43f22435d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841308, "uuid": "5d172e86-e6b4-4350-91f4-ed4b7a6b615b", "comment": "Malware payload (Heodo)", "value": "0609d35534b648772f78e281690928c54b36c3169565b45a2e52bf5d40564eea", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841308, "uuid": "ab626fb0-f16f-42f0-8420-fabac91a2237", "comment": "Malware payload (Heodo)", "value": "58dadf973d62b67ccd21859a40f9cd58c6360820", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841308, "uuid": "f1e80e37-76bb-4da9-b800-a4480065f983", "comment": "Malware payload (Heodo)", "value": "4d94c79c7a1067d5996627d97a905114c62259a4cb3979411bdeb5b045f75e74bc5973416936104217645ce75b421231", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841308, "uuid": "520a4c5f-f2c1-43f8-b797-f64794afdcfc", "value": "T14C94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841308, "uuid": "0233b238-8f28-4119-a6e3-5a44c274e1bf", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841308, "uuid": "479ab87d-6755-4182-91fc-d71ee7a06874", "value": "12288:M3hV6Pw4aT23s2opd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Qi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841308, "uuid": "1cb1b2b1-069f-4a15-bc48-bd104b3d901c", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841308, "uuid": "5bb00343-1770-4b1d-a383-e21644b7b53a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841308, "uuid": "3f8601a4-574b-4d9c-8b97-20ce3c032e1b", "value": "d79c4b29dc4d86a8b456e2c43f22435d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b023a919-d68d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652866457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866457, "uuid": "9401f5fd-ca47-4d34-b095-d4595678a50a", "comment": "Malware payload (Formbook)", "value": "751b6fd81898d660445aa73dbd12878c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866457, "uuid": "b1d3d60e-0224-4dca-973d-1099e46637a0", "comment": "Malware payload (Formbook)", "value": "065447963af3f19bf39599204f7617764ebc6703b795cb5948d7660e01c955ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866457, "uuid": "3eff0388-34b7-444d-a167-5607fc6a7e07", "comment": "Malware payload (Formbook)", "value": "b4de3f4e4a14fd1bd4097adc0a8c93b54c18d091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866457, "uuid": "f89de839-9e4b-4005-a590-0e175a5265a1", "comment": "Malware payload (Formbook)", "value": "3d2bbc634fa217c8f63e8bdef4be6ce1ccb0e85334ea65bf78af147fbbcfc725e4c5a50e16f5f3e4278d762a42825eb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866457, "uuid": "28602097-d1e5-4fd5-a6eb-6e071b16c930", "value": "T139359E44B244BCDFD4074D72CCB99C206124BE5A822AC60F35537A7D98BF3936926E9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866457, "uuid": "73cfcc0f-c1c6-46bf-ba7a-7a26c918ab12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866457, "uuid": "5eb5d16a-2c60-405e-a836-fcbc9b532f63", "value": "12288:mTqpRuphCnHSDWjJRGqcULk2ZW6zIpQbHL91pxxvIbBonl2zjABQflJrF9tkgGZM:BweC0kcW6MOtDQ1olOjAgSGpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652866457, "uuid": "4c6eb772-aaf6-4b99-83c5-675b3e3615f3", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652866457, "uuid": "1e23fbfb-93ad-4874-8f60-482395ead103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866457, "uuid": "ec5d4d1d-1b5b-4928-ab1f-251e18bf1baf", "value": "SecuriteInfo.com.W32.AIDetectNet.01.25914.17421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675389f2-d647-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836270, "uuid": "92751e9a-0e4e-497c-a4db-4e7dea6b1250", "comment": "Malware payload (Heodo)", "value": "7151369b81e1a37ec63fa43078bd1f3b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836270, "uuid": "59880947-a81b-4844-94a7-4fadb10c7ec9", "comment": "Malware payload (Heodo)", "value": "06f7bef5ab3a0df3a72e0a40ac43c9964a185511c3b8256589bc06d3b83ebf0a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836270, "uuid": "99a2c1ca-a675-43f9-8c30-48b5b76fcf33", "comment": "Malware payload (Heodo)", "value": "0d1c517b5e7605ddf122bf11f03e0c61bfafbe70", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836270, "uuid": "29908350-647f-4f3b-909e-f640deef2962", "comment": "Malware payload (Heodo)", "value": "9b3037d60694d23a10defb0ea72fda6660471166f1373fac7177f4f245e524b50f43830c4eec80e13a313accddc11d4d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836270, "uuid": "e593199c-8481-4339-9c95-45c0744b23f7", "value": "T1E094CF1572A50CBAEC779239C9434A06E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836270, "uuid": "ae4a9584-c36f-40d0-8f1a-951cb5bcbbb7", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836270, "uuid": "b5b719d5-bdfe-48c0-a15a-9522d3454558", "value": "12288:M3hV6Pw4aT23s2oZd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ai3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836270, "uuid": "0674c8a4-67cf-4a2a-a326-64c1e43cdd0e", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836270, "uuid": "a06c64ba-39e2-4ee4-bf38-47ebd5b3083f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836270, "uuid": "91c1b56f-bb80-418e-86ca-06238073f456", "value": "7151369b81e1a37ec63fa43078bd1f3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973260bf-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908935, "uuid": "62be8cbf-57ad-405e-9e6c-f30cad024572", "comment": "Malware payload", "value": "520b96f496f2598c2452b17e42faff16", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908935, "uuid": "92dd1047-64a0-4a2b-b7b3-8c21a43a9c87", "comment": "Malware payload", "value": "073c5ab0383bee6abbae4fa12c67d7097717be34f552213ce4190c28230c83d9", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908935, "uuid": "ebc3150f-09bf-4552-a06e-0e3d40c2c51d", "comment": "Malware payload", "value": "cecebb602a0ab1867418ed077bd9a0bfdab84a08", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908935, "uuid": "a705a9a6-a4d9-4dcc-8486-786aecb2d6ca", "comment": "Malware payload", "value": "406ac7b5f836ba96eecd927f9f6b632c8305d9f29ce95f8ac2ddc3c42c7875992353372f0336963ed8e60f02aaae1226", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908935, "uuid": "90437925-ad95-4148-b226-0274763c1711", "value": "T12CC5330C037ABCFDFD8D452927638EE4C1F9A1E0F592A092D66419A85C3F57D039FA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908935, "uuid": "79db1c74-62c7-4b03-9cff-8b2bdb4d9496", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4y:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908935, "uuid": "56ad08ea-e1b9-4950-8be6-58b44c913d69", "value": 2560000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908935, "uuid": "e2bfc094-30a3-4c05-8f1f-06aa2542b83b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908935, "uuid": "bef57aad-781d-4432-b341-b58f67406dd6", "value": "073c5ab0383bee6abbae4fa12c67d7097717be34f552213ce4190c28230c83d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988ea971-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908938, "uuid": "40c26681-8e46-413b-9861-430061f520ba", "comment": "Malware payload", "value": "11f7a98a87b94c7441b07a3f6ba7036e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908938, "uuid": "b6f89e03-c25b-4b78-8b92-d59225c74f1f", "comment": "Malware payload", "value": "0763baed136ee64be96c9fd4301d273c06c5ea2d680bdde05f616385beec5fd8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908938, "uuid": "b1850668-4673-44ea-97eb-5e70755bbe0a", "comment": "Malware payload", "value": "4fd3327c4e3abfec662e5063e59f5c3b9e24695f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908938, "uuid": "51c99d73-7ce4-4cf4-9582-74d75d846206", "comment": "Malware payload", "value": "53127a1ed165077bf8eb924b0463f5384970bcfedb06c3f9513f3198d66b1fb058163dfb7d7c8e6f316b0b25dca1f802", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908938, "uuid": "558c677e-38f6-46b1-98d2-acb9a11689b1", "value": "T1B9A1F750112C1AB07246697AD26FFA52B90ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908938, "uuid": "412fdaa2-f4e7-4268-b8cd-834682486021", "value": "96:kcRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:9RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908938, "uuid": "57dbcfbd-087d-461a-8929-c7c1551698cc", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908938, "uuid": "23557f77-8c2e-425e-b80d-cfb2d51292f2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908938, "uuid": "1f8c2a28-279a-403f-ab53-3779500b82a7", "value": "0763baed136ee64be96c9fd4301d273c06c5ea2d680bdde05f616385beec5fd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4cc020-d6e1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652902369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902369, "uuid": "bedcdf73-4159-4925-806d-2c2ef5ac5985", "comment": "Malware payload", "value": "fd72c4280312debf70b845157c2f6006", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902369, "uuid": "87babdda-6d14-4908-b4d2-3bd85d09912c", "comment": "Malware payload", "value": "077704d00dbedb31dfd62c060e8fb5cb0d0ef5ff0784feaffbbbe0949b12649d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902369, "uuid": "fb08d845-dc98-4797-bd96-c6b52d280104", "comment": "Malware payload", "value": "974496f394062d622881b6e33eacc61ad7e853a3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902369, "uuid": "017c6e0a-1c3d-4c0e-b5f5-803f2f5395a8", "comment": "Malware payload", "value": "d7c6b7c03eaed12084e91766bc79474c8f8b01fbdd9b78c10cc82c6405fd7c7803fc6d3aa7091808ce7104e36e1af98a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902369, "uuid": "3e77a5a9-4a99-48ff-a96c-8c6feff0280e", "value": "T18BA51253FA67E91AC9F2C33361741632507B4D18CB43A74A394977FA38B79E84B42AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902369, "uuid": "8c7ed460-438d-4e8a-8dc6-40dd127ac67e", "value": "49152:EJDaIswJ6cDgC1scfLL4kh5uN/V+fGVolcK6pFVdYMJ/SCzj:B4JPDgTeLLz89+fwo56bYA5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652902369, "uuid": "443279c5-0945-40d8-8341-c5c0634d6fe6", "value": 2084773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652902369, "uuid": "ec598a13-4167-43a9-8e62-60fa2120d41a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902369, "uuid": "72bd42cc-bfcd-42ee-9756-73cc98eb7884", "value": "eblagh.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fecb3572-d66a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652851557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851557, "uuid": "2d9d078f-bc5a-4179-a4cc-410cd4fd845c", "comment": "Malware payload", "value": "5c22b983c46a5715ecc262064c53f3d1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851557, "uuid": "66b38dce-b9ae-4eeb-acc5-0fafce3d71f7", "comment": "Malware payload", "value": "083002555488508d85d13bb85b9a4333180d1efcac8fdf4f40f84e03115ccfab", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851557, "uuid": "14a2ac34-a90f-4302-9bf6-f6cfb2a543ae", "comment": "Malware payload", "value": "6e5e814206e68b8a34eaa4427777deb5519324f5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851557, "uuid": "b616fa04-e02b-4c6e-8915-8ffc722a87b0", "comment": "Malware payload", "value": "d3c884ac26caae5db4f5e40da30f840130374ae957810a7c3de05c6bbae3de1d8e13b8690d6c71d6dac79836f61cc60c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851557, "uuid": "d8d04740-6cbf-4cbe-9c28-e06b3607a50c", "value": "T15594CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851557, "uuid": "d17227d8-3bec-4db4-9f9e-b0d773625820", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851557, "uuid": "8bc99677-946f-4e10-8fb0-78a48fac6fd6", "value": "12288:M3hV6Pw4aT23s2oed9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ni3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652851557, "uuid": "bbd25e00-a50c-4064-8aa5-9531e23ef874", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652851557, "uuid": "c088d38f-3949-4554-923d-8e970e95bafe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851557, "uuid": "8586e6f1-d0b5-4f0d-a703-8539b0ecdcf1", "value": "083002555488508D85D13BB85B9A4333180D1EFCAC8FDF4F40F84E03115CCFAB.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c371871-d677-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652856975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652856975, "uuid": "2eb474f3-7ef5-4336-a5a8-8e5c9f7df4d9", "comment": "Malware payload (RedLineStealer)", "value": "b7c61366d5396aea88f7466e6075312c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652856975, "uuid": "6e053f78-fbef-4242-a6a8-953ab94cf875", "comment": "Malware payload (RedLineStealer)", "value": "0894c766c72290465fa4d099ac313bb02848562095725af85dcd1b852e5ddd74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652856975, "uuid": "ba0b4271-6cd8-4df7-8d6d-c9ed5bef8698", "comment": "Malware payload (RedLineStealer)", "value": "cca304653a0c24b31cced1dbfaa1b8793dafeb24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652856975, "uuid": "a51c38fc-63d1-42b2-bfa9-c2d3f601a738", "comment": "Malware payload (RedLineStealer)", "value": "7733ec090b31f772c9c67f417e88bf512775853ca996f7dfb69878e536675d0175f0d525a430b690272ed0844f2ebe40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652856975, "uuid": "45a70b33-a9d0-45fd-b19d-d1ac1c19e2f2", "value": "T145A4F111F791D831E4A51F308875E7B5677BB9222230984BF7909F6F1EB33809A7631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652856975, "uuid": "fafd970d-8a30-4918-933a-02a66b028ffd", "value": "0d686c4364bc2c7f3a384024716d37bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652856975, "uuid": "7dd5e0c6-3083-4fea-9abd-6f9b0c735434", "value": "6144:kkcM5IgUN6AK4QyiXV5E4SLew4ECxHtH4C9gG4suUEm35iga3wVf+:BcM5IgUNHK4Cl5EChfFuU9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652856975, "uuid": "c0ba9c79-0913-4028-9bd4-c6331cff4a5a", "value": 453120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652856975, "uuid": "d467ddc8-9323-4290-bd1a-52681004fa81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652856975, "uuid": "86f57cfc-ee3f-47ed-a2b7-015c4d401b02", "value": "b7c61366d5396aea88f7466e6075312c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadc4f2a-d6bf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652888030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888030, "uuid": "9b359a26-62f5-456a-a91f-7ecd3a954168", "comment": "Malware payload", "value": "bddf2a91a0a4f77fc799d80772ef5ca6", "object_relation": "md5", "Tag": [ { "name": "BokBot", "colour": "#318781", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888030, "uuid": "a8434037-4fc2-4d67-b361-4359ee95932f", "comment": "Malware payload", "value": "0a497cdeb92189e1611c15669897de70e8aed2be2484346686252bea387abfa4", "object_relation": "sha256", "Tag": [ { "name": "BokBot", "colour": "#318781", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888030, "uuid": "93742e90-299e-4fd0-94a6-bfd98fb648b1", "comment": "Malware payload", "value": "0bd772ca4d5ba68df197e5a6489f06954b3dbc71", "object_relation": "sha1", "Tag": [ { "name": "BokBot", "colour": "#318781", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888030, "uuid": "9999e283-b743-47b1-869e-974d1a466dd0", "comment": "Malware payload", "value": "39cf22c9c5837a04384a64e759b82ee6a63d5fc7b498b316f6a19b809e5864aa0f0838ded0407339c6a41a41184a85b1", "object_relation": "sha3-384", "Tag": [ { "name": "BokBot", "colour": "#318781", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888030, "uuid": "a30c5af8-466e-4810-bdba-b9b60916020c", "value": "T128D4C0B8B6347CD5D56E0A7BD9D6BCE91F6627368ACBB4C880556BC30563331EE06830", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888030, "uuid": "0d7b8fc5-1bf4-4108-a6fc-4c72015db2f7", "value": "4fe581d5c3926b2604cd1a61a376c9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888030, "uuid": "041fb90e-9fb7-462c-b89a-d42f61b67eaa", "value": "12288:oXeXalPtfkm29pOmgR2pLx4rfHMolu69NxI/aLOmWS8aAB/UZkcb:ohXkDEmgRfrk7haXA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652888030, "uuid": "cb4c2587-84a4-4285-a57a-774ba8834117", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652888030, "uuid": "fb6dc4ed-c6f5-4f35-b82c-6911333ecf52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888030, "uuid": "1ed6151f-3d4f-42dc-80ef-520c5f70b7a4", "value": "goq2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f177a8-d6da-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652899535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899535, "uuid": "e49d93e1-739f-4276-bb56-585ca4a808e7", "comment": "Malware payload", "value": "dafb5f90a7e12d6c989b1b3be1ff45f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899535, "uuid": "54f2ecf2-329c-4296-999a-93c55e9babca", "comment": "Malware payload", "value": "0a840e0d003dbbe94510ba7ce6db2c41e5bcdbe4d8dfcb8f1a8b0f15d710419d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899535, "uuid": "aa57b32c-6425-4b45-9bcc-8e542d2b57e1", "comment": "Malware payload", "value": "f52402ea9c8a6fefb872ce51a2fdfbbc212225b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899535, "uuid": "fb6b4ee9-840a-4bb2-85df-714a1d0c6709", "comment": "Malware payload", "value": "9fbe2fff1f53b1d9560a807ecaf053903bc62e63c1a35be9e8bf38e26c5c661e0b68ba26cbabb477f824f6eb3584a359", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899535, "uuid": "1c84f07f-3037-4f61-8ace-b6f8e3d904e5", "value": "T107245D8DF64487B4D82C16B078758C3113563E7598E09B7E798DB3FB27F32A51026E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899535, "uuid": "991c1e03-b61f-4fae-bc88-7874bf41d5c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899535, "uuid": "1b32a151-1bdd-4278-bfb7-64ca3d777447", "value": "3072:7Oj+6aK2lKmb36WWClCp3fL4KHtAvgZ71Nq15jDone/C30YBJm8gXN8seDUdTHVv:qqKgZ3zWClCV3L350WIzVpFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652899535, "uuid": "c0d5e4c7-6c16-4cdb-bd59-f23b79182c5d", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652899535, "uuid": "c4132dd2-914c-43f6-853d-acc93fe0120b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899535, "uuid": "e8e2aa80-ccaa-4aee-804f-d4b436b1a1be", "value": "dafb5f90a7e12d6c989b1b3be1ff45f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71add90-d658-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652843759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843759, "uuid": "f6fa16f9-014b-4938-a1e5-c7e128c36cc6", "comment": "Malware payload (Heodo)", "value": "18dd7b5b8a0d051e6fe7d6545efc93a4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843759, "uuid": "0b66f7b0-35a2-4145-abfd-d2020287fceb", "comment": "Malware payload (Heodo)", "value": "0a87b4e0a8cda685d6387f7b9ecb5d5b96cd7adae8b533a53f89374a6e320943", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843759, "uuid": "0bdcb9cd-0237-41fb-9284-f3d9eb81483e", "comment": "Malware payload (Heodo)", "value": "fddf5b7f356e04337afc803140d075ab63143024", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843759, "uuid": "9dd9bbd7-d80a-40ff-8bad-017af9ac9f03", "comment": "Malware payload (Heodo)", "value": "b7a103fe3c6eaff491d0da9e984798900cf4095340d82242c8c2db0f3de7482fb9b3c87db1b7141b545506757563e8e9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843759, "uuid": "43742587-dbec-4d96-88b2-7b88f71069dd", "value": "T14394CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843759, "uuid": "0ae10a51-9e21-41c3-a62a-3980aba4ff21", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843759, "uuid": "4858e65b-af50-4b91-ab99-bbbc20813730", "value": "12288:M3hV6Pw4aT23s2oSd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ti3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652843759, "uuid": "c5a0c7fa-7b61-431b-83df-39a4ec96002b", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652843759, "uuid": "09d4901b-f616-4e61-b0d7-e55c8b5f1042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843759, "uuid": "000da9a6-e2d2-4e6e-85b5-b16568619d46", "value": "18dd7b5b8a0d051e6fe7d6545efc93a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f246a4f-d648-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836793, "uuid": "740874cf-7c69-4d42-9806-352255d5b527", "comment": "Malware payload (Heodo)", "value": "ef74712e3e703614472c681e9a6624f3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836793, "uuid": "dfc2e54c-3432-4bdc-918f-5a94ee2370df", "comment": "Malware payload (Heodo)", "value": "0a954380cc56822bd29f22eb2b42eb3f9c79e56bad7770599edaf82429835592", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836793, "uuid": "74cbdfec-3b09-42bb-9487-0b1f32c8a648", "comment": "Malware payload (Heodo)", "value": "f1ab8f8b19ce5441ed1bdbf8d971f74915b1806a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836793, "uuid": "bf923baf-064f-48a1-af9f-50c81b7e5bf2", "comment": "Malware payload (Heodo)", "value": "d5dc16c3fce985c0d33652fb24f0b3ff5ce3ef87bbcaf1493c96242759ff9053128193184e3b524a2cad2c8e61c300df", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836793, "uuid": "01d28096-ac88-4ab0-893a-d14d52829d51", "value": "T110A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836793, "uuid": "ab603f48-0380-4ea6-95ff-d07c2523d4a8", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836793, "uuid": "d1df5c9d-d19e-4bc5-b11c-b1a140e6f3cf", "value": "12288:uS4BnAed8BK2o0a3a5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKSa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836793, "uuid": "81d34c13-11a2-44db-a4d2-ded6055b692b", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836793, "uuid": "ab5ce549-e5bc-4b7a-8181-b2d6e747a8c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836793, "uuid": "bcaf651b-4083-4e94-9f79-a34326dbea62", "value": "ef74712e3e703614472c681e9a6624f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046e77c9-d688-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652864021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864021, "uuid": "7b724ade-acac-49ad-aee0-b7af1e8caf44", "comment": "Malware payload (RedLineStealer)", "value": "7292cda57cfe5eb55c52f0a906d8dbe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864021, "uuid": "17b2579f-437c-4361-9b6f-b323d91b59e3", "comment": "Malware payload (RedLineStealer)", "value": "0ae6991fcaedff01a90f34df98af6b932b3769113293d215f47b307fec9f8084", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864021, "uuid": "f33b7cdb-3c63-4003-a634-9343d91ccd1b", "comment": "Malware payload (RedLineStealer)", "value": "da67fbe61f75a3f4e4e8b4148c95314219ecd6fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864021, "uuid": "7b7e7b46-f8ea-4b24-a687-67353cf564aa", "comment": "Malware payload (RedLineStealer)", "value": "9dc18f733e903ef132a916af04c63b6688b445011345e9938c47eac5d738eab7840ff3459d3dbca1147230c440d1363f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864021, "uuid": "4c260eb7-66d0-477d-9f02-b7577ac96b6a", "value": "T12DE4CF05BAAADE02D1C822B7C5D3091447F0A543E127D74B3F9566E70E433EB9E4A78B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864021, "uuid": "733f5352-031a-4048-94a2-de375175ddbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864021, "uuid": "9df03abf-33f2-4ba0-8b94-795972741174", "value": "12288:MqtjJVBinjIUQCdzKc+VfBXrVRmNYZRIMlWFtWPaWOSXqdlaxUXsXzjYbkOMUzUD:MIWciWODLuKsXzryti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652864021, "uuid": "22c84a09-0cce-409f-a39c-aeb9cfa07d1d", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652864021, "uuid": "93886636-c935-46e8-9163-f68bc7835a38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864021, "uuid": "d5fba25e-cbac-47d6-a9b3-a084c97c32c7", "value": "PO190154.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99b8f67-d6b0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652881613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881613, "uuid": "e5d54007-1538-46c2-a896-2c1c7bb058ee", "comment": "Malware payload (AgentTesla)", "value": "e52154ce6d913b6847a8d9d1ee5fd67f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881613, "uuid": "eaa14043-01ea-48ba-a2a3-76fa2f13bd8e", "comment": "Malware payload (AgentTesla)", "value": "0b044c2880b96dcbb307c2d8b5674ae8b85758f84d4a58fae892480f4edd99f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881613, "uuid": "fd398468-27a4-48f6-bb9b-a611d1a48f33", "comment": "Malware payload (AgentTesla)", "value": "4ea9f3c88d4eef5daad5972c8ba303152d161382", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881613, "uuid": "631bdf44-ea0e-471a-938a-ab13dd97df08", "comment": "Malware payload (AgentTesla)", "value": "7972db40f694434baa49efe8bb18b4ba5894e1a5da2dc29cbb3d1b89efef9107ff93322cd7db0b08f6166bc0c92897cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881613, "uuid": "8924f843-1fde-4ef7-9902-4871a6889906", "value": "T17B15CF5D3650F99FC81BCD36C9641C60A660AC27970BE347A4573ADCAD3E79ACE102B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881613, "uuid": "2a6119d8-c0c1-4119-ab47-47e3a1bb2acb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881613, "uuid": "f50165d6-afb0-49bb-994d-143a635d2122", "value": "12288:yF8Rc43iD/I0ZGenpSrV4Pv+izO1iUSoR04DDTAcvYH775MIn6WBlunAaR6lXmqN:ygyD/I0irVXizO1IATAcSn6WBlmAaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652881613, "uuid": "6bd60aee-f275-46cf-9105-1b5f44fef75a", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652881613, "uuid": "9eaaaabc-31be-4434-a30f-ad2a4885395c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881613, "uuid": "23c0f01c-5200-4005-bccc-6f0a7b7a02b4", "value": "swif copy for 348902274880001 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce56574-d6d9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652899147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899147, "uuid": "2c82456b-ca64-4084-a58c-c69bce565910", "comment": "Malware payload", "value": "76b4104c47743ef2ca274a09de5fbf3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899147, "uuid": "abbdda95-120d-4d3c-a220-1241fba2adb3", "comment": "Malware payload", "value": "0b251371b4891fe08157e6b9c84e0267a8c6d33cad2b2a06702c8f2f62381bda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899147, "uuid": "8f2cc950-8a9e-496f-b614-8216c62e542f", "comment": "Malware payload", "value": "ce0c2ca3900c47cc15527b4da6ee867cea454129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899147, "uuid": "b11cf07d-08e9-4829-9c25-801efefafdb3", "comment": "Malware payload", "value": "548a52d27f8618dd82c6b3cff808c39901156bd8fb68d5e3b9c2405cb5de96daa177c4322c6bd6655425a4b403ac41df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899147, "uuid": "155f75e5-14df-414c-82fa-2b10b01f7795", "value": "T1B574BF417493C031E97115304CF5DAB79E3EBD200E345DAF6B941B6B4E323D2EA72AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899147, "uuid": "a6cf5e70-c78a-44c9-95de-1a58e3172043", "value": "55be0c93c66ed8138f777cda7ce3ebbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899147, "uuid": "6a0ac822-e9e4-4705-a973-49711deb031e", "value": "6144:lts43MehbflUNHThahCLQTidsZr1AOIdFg06NuirP66FwM5Sef:l9MehbflUNYlZGS0Yz5Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652899147, "uuid": "5c61226b-24a0-4fbe-9da9-c77f2c7fdf53", "value": 345032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652899147, "uuid": "c83a98aa-9418-48f3-804f-b86b96a06e1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899147, "uuid": "6e586cab-648e-4cad-870a-2399389d502d", "value": "@NorthBearStation-31048357-1123-4cc7-a673-dd6a65322720.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776be78d-d647-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836297, "uuid": "8b5eb18d-b27f-4926-a457-989fda932bcf", "comment": "Malware payload (Heodo)", "value": "a9c9430203ac27a3de007d6a3222b709", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836297, "uuid": "a65ef0fb-0fb7-4295-9e90-1dd5200cae5c", "comment": "Malware payload (Heodo)", "value": "0b7c7d376ee033a1291d3ef7a3e56e3059d28a3d3ca050499efe714f56f0ca96", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836297, "uuid": "e3d76b93-f5e2-417e-bd26-ca47eba726df", "comment": "Malware payload (Heodo)", "value": "460266e2e67e2c115e1f21ed3b19571f118f7e74", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836297, "uuid": "d8aac5dc-da79-4b74-9a64-1577b68a3c81", "comment": "Malware payload (Heodo)", "value": "c4e7bbce2e81b27f6cdb0ccc542ad9c94e86aa1daf40d560f02e30a26da47d68c8f3c0969557290378e2934569520f55", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836297, "uuid": "fafe3176-cae8-4f81-a0a3-e4d8e9487276", "value": "T102A48B4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836297, "uuid": "20cdfdd9-7bff-406a-af15-d356aac4fd13", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836297, "uuid": "90e7c424-d97c-4037-8027-7584cb394072", "value": "12288:uS4BnAed8BK2o0ata5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANK0a34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836297, "uuid": "40c3a504-6c14-43b2-a930-af8cd1c553ce", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836297, "uuid": "e06952d4-95b5-4bdc-82fc-36013c7691e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836297, "uuid": "724c40f4-b39d-4a9f-a06e-353518dd9454", "value": "a9c9430203ac27a3de007d6a3222b709", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632830ed-d6c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652890380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890380, "uuid": "d070f075-864b-403a-8655-6b3f7772f78d", "comment": "Malware payload (AgentTesla)", "value": "ce1fbbc13247772eb945dedbf98d63d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890380, "uuid": "30af0843-c6a4-4ad4-9a1e-67a8ab5c07f0", "comment": "Malware payload (AgentTesla)", "value": "0ba9062b8eb11757bc473d870b85bb111f251d7e3b6e615133c01c99c6076a15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890380, "uuid": "ef1669d0-5f02-41f4-88ce-153232ad4f2a", "comment": "Malware payload (AgentTesla)", "value": "508dd9fd1e404d7ed5054bbfe096b36b10794c06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890380, "uuid": "aa079576-ade7-40af-a818-5f9c379bc0db", "comment": "Malware payload (AgentTesla)", "value": "75ec378a982041e0db51b0ae80d638e3fc5f0d2aac1db7902088f0d2d32f9a0c3a3c66e676aa6f266ece5b33a9b89e3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890380, "uuid": "b8d8e739-4601-4ca6-9568-f22095de1892", "value": "T10D05AEA036BA0B57F9388FFC04A6217047F12172D66BC2961F8371FB5960B961EC099F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890380, "uuid": "9c145a95-d1d5-47c5-b7f2-5f8b4a651b89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890380, "uuid": "c51cfe00-e6b3-4067-b5d3-83f4af88fe4f", "value": "24576:AHSnSfz66ZM/Kt6Wq+v1ffau3ASKzmCi96:USozGSPqFu3BKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652890380, "uuid": "b23c9a56-a716-4d76-a369-98d9de68b89e", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652890380, "uuid": "70e11e15-d650-41a1-90d1-960a5faae9cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890380, "uuid": "63528ef0-a595-4f46-90af-8d696e0132f5", "value": "INV 19003568.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48a745a-d6de-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652901361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652901361, "uuid": "f57efa95-d04a-497d-8262-a1c3289fbb60", "comment": "Malware payload (RedLineStealer)", "value": "1c6c568b7abfbeeda7c6a680a28cad6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652901361, "uuid": "920c5b29-7470-4f24-80eb-970767d6e0c6", "comment": "Malware payload (RedLineStealer)", "value": "0bc6fcf4a893f9381f6fee3773514a8d0dd6f35ba304a9c383bf82f62dfd34ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652901361, "uuid": "1e5111a1-8247-4b9f-a3ba-0602ae7968be", "comment": "Malware payload (RedLineStealer)", "value": "eeee32172e7377525510c648c3b3fb42db900da2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652901361, "uuid": "7fdc0f72-a0ee-420b-8153-00590cb240fd", "comment": "Malware payload (RedLineStealer)", "value": "1bd1647707bb65f8c2b81c42cd7a42fd7fa1c7e1c6473178d5326e459ef2402af01a19e8649c83dcfb3d787a0c5ef66c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652901361, "uuid": "1470e855-9696-4472-a948-bd4aada0570b", "value": "T10694F102BBE0CC32E0911D7044B5D772173BB96356B0518BE7949BAF1EB3790AAB7316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652901361, "uuid": "431682ee-88d6-4d8b-b9d3-e4b6f5368876", "value": "db57d5e3d04b9a257784f752aaee46da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652901361, "uuid": "bb1c2a53-c27f-45a0-93fc-1a74a5e826ef", "value": "6144:SXwQmtqBKJP/1Biy1bqQZ9gkahMtGuoxiga3wVf:+wttqBKpDiy1bqW9RQ0v9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652901361, "uuid": "91dd48ae-d46d-4d1d-a158-fe9e0a7475a4", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652901361, "uuid": "af5180f0-5924-45aa-a225-e7e47df11930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652901361, "uuid": "bbc17d16-d72c-4782-91ee-002931a5aef4", "value": "1c6c568b7abfbeeda7c6a680a28cad6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf40b721-d6e9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652905996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905996, "uuid": "3ac531da-7cf1-4d95-a447-286fdcd988b5", "comment": "Malware payload", "value": "e2c395a5724a1de18a62bb9b4103c3a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905996, "uuid": "8d388656-5ad9-4fab-92b0-b5ba0cfc5b3d", "comment": "Malware payload", "value": "0c9cba304e3a710cdd953cbc87861b2a27b0e23e29502ae978ef60c737290d6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905996, "uuid": "45ff6a4a-46b9-421e-8984-67fdd7c26bed", "comment": "Malware payload", "value": "3d95e4e324131d60298a3bb67b8e68a5edb56ac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905996, "uuid": "10800f46-b201-4e3f-8e23-1652f3b9674b", "comment": "Malware payload", "value": "ffa6643b47d3c5679b1a272ff11a8e67e5085a578949727add08184909f16c6e564e0453411a1f8307ed887e47bb70e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905996, "uuid": "f52692d4-6412-495d-9a06-0d7938474b4f", "value": "T14405283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905996, "uuid": "b495485e-ac74-4a4e-b4f5-fd9d466bb71d", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905996, "uuid": "77450117-6a44-402a-bfab-7372ab7efd4b", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7PmpE3:BTg9UXRD2SeqfZZibm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652905996, "uuid": "27b4c54a-5f3e-44fc-9942-17f21c3a9b07", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652905996, "uuid": "8fc9e111-19f6-4a2d-93a7-1c1646dde9ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905996, "uuid": "8469157b-9c65-4596-9858-635986f51ea8", "value": "e2c395a5724a1de18a62bb9b4103c3a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1897d356-d6fc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652913877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913877, "uuid": "e3b7f864-9e1f-4c29-a83a-8c715ea57b85", "comment": "Malware payload", "value": "d982425dfa667c20f46fc178304f938e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913877, "uuid": "b9bd1b5d-d253-43e3-936d-865ab6c86df4", "comment": "Malware payload", "value": "0cb3578756e46d29fbb45887bbfb0a2432bfd453aebd7adf7ac08bf7f393edb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913877, "uuid": "625241eb-715c-4c37-b0be-546b9df275dc", "comment": "Malware payload", "value": "ec0db0fece51f915d586a65e325ed19a07940ade", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913877, "uuid": "0ac3e8b4-24b0-4eed-9244-d532ca7180a1", "comment": "Malware payload", "value": "c78c7fdaf7b088e95f58c0ca431a596cc03d703563c1f3d143b54b4701cd0c6ef41b2d439498d4a44ea1336c91b6090c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913877, "uuid": "deae6d3a-541d-4e1c-88ef-8ab0267147b9", "value": "T16405273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913877, "uuid": "7a0eb15f-a962-4a1e-9d7a-ea08ec05335b", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913877, "uuid": "20afd506-a587-4e42-886f-371b944cc2d3", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oGaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7EUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652913877, "uuid": "69a6d5fb-c2ff-4443-b4fe-754bf1d940dd", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652913877, "uuid": "2c6d420d-a6ae-46e0-9b8a-bf7f0e38c4b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913877, "uuid": "f54e9f98-dcf2-4bc1-8269-822063880345", "value": "d982425dfa667c20f46fc178304f938e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3cbb036-d6cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652893978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893978, "uuid": "8838c51c-1d9a-4bc0-8ceb-3851602ecb9f", "comment": "Malware payload (Mirai)", "value": "b327952573698a43c8ccfcf7f0566a67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893978, "uuid": "6b30b4ed-b97f-4d42-bb8c-24991f1abf0f", "comment": "Malware payload (Mirai)", "value": "0d4f0ec1a0a8c3445e1315ee2067d1386813e1fee73e54716439120f6a54555f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893978, "uuid": "5d076ff9-863d-416f-8eb2-adcc8f489bfd", "comment": "Malware payload (Mirai)", "value": "bf5a54132cc8c5f656a7d5255a3c9895957a0931", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893978, "uuid": "c66c7b46-e85f-47fa-afe6-8d45272709cd", "comment": "Malware payload (Mirai)", "value": "934b44d2ca417b501fa1ea89d33701c69a9265f95a139dfd160942e11a11c95ad291cddeb6f2779d996d0968627b9b1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893978, "uuid": "3c55cf44-d18e-4e8d-8547-b289fadca967", "value": "T1D6634B01725C0E47E1A31EF5253F27E193FEE99020E5FA89650FDB864231E37468AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893978, "uuid": "2acc21e7-f1d0-4077-830a-a485806d195e", "value": "768:sKcL8O4n1eRtPJf61jNfRhkGMkRaylnJ9v2O47DqSD3fB9m54PSnkC25HqG94hFC:O4Sj61LwM49myKU5KGOZZG6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652893978, "uuid": "2f3ec629-94e8-49a4-ab2e-a550cdb3364e", "value": 70888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652893978, "uuid": "3efd0752-79f5-4bfb-b0a4-eb1e60640c5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893978, "uuid": "b840ad07-d430-45f8-8d4c-f76653bf55d8", "value": "b327952573698a43c8ccfcf7f0566a67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9dc338-d690-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652867495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867495, "uuid": "b97e8fe6-2ce9-4099-94b0-d62a2f880f44", "comment": "Malware payload (Heodo)", "value": "86a68fe21bcd30b17334be485925eea2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867495, "uuid": "0a600e7a-7141-42ad-967f-fd6f1f5a1fc2", "comment": "Malware payload (Heodo)", "value": "0d5e57488f4530825aa7f154216a552a0da810776f27d84c1da51863b149d501", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867495, "uuid": "bba63208-a92a-4aa9-9253-2d11e1fced3a", "comment": "Malware payload (Heodo)", "value": "86f081e6db0a1e74f36577ca1619ed4dc60cabcd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867495, "uuid": "9950d737-2f73-4e79-8f01-3731c48d0f51", "comment": "Malware payload (Heodo)", "value": "2d1868937d563c516885192116c807cf5c92354f7f88ab8ca21b5e645bf3d2e74d810003c28a3b922ced0098b4958e65", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867495, "uuid": "37d33ed8-5174-41ca-bd84-132031a4b00a", "value": "T15894CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867495, "uuid": "54e529cc-4252-48c6-9b25-f02a29b5c822", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867495, "uuid": "9f8ad705-d808-4d5b-97f9-922f7104fab8", "value": "12288:43hV6Pw4aT23Guoxv91Wuwf07EIvH3+38+:sb6Pw4R3GuaWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652867495, "uuid": "f7ef40ce-0527-4498-8a9b-5b3a2c766a30", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652867495, "uuid": "a1f77a56-7666-49a0-a6da-1c24ea77236f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867495, "uuid": "9187b482-558f-4b2a-81ed-e39ef78ef988", "value": "86a68fe21bcd30b17334be485925eea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97408bdb-d699-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652871569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871569, "uuid": "8cd21a61-1702-4af7-bbca-950adf0d78b8", "comment": "Malware payload", "value": "e5c9351ebdaeb386786e6bcb16d1ab72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871569, "uuid": "239e853f-3ecf-4ee6-9722-501ff462ed23", "comment": "Malware payload", "value": "0e5dd52da4fa3d13be08ae1fdf59eddbcce0fe300006f0e84d7f885cb61ff0bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871569, "uuid": "22d45bef-f9b2-4e7b-83aa-c170b94c3a0d", "comment": "Malware payload", "value": "008e440b1e376dff5037981bd3b04b393523d2e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871569, "uuid": "92a6bb34-feab-4a5d-b436-48753d02e9b9", "comment": "Malware payload", "value": "d43bc984f69b53472d254aa2a531f8017cffe45e3e754452aca9fd3817c2c2c50a5cf6b48a7ac49cb0f011e86d2a7f3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871569, "uuid": "e7e63c7a-7b02-4c8c-90c8-cd7fe101dff8", "value": "T158E4F11522A8DE90EDAA43BFD06645FC03757E16D502F74BCEA87CCA3D363C1461AA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871569, "uuid": "124f718d-a61d-4780-a410-de251470979e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871569, "uuid": "78d5fcbf-6cac-4083-8909-76fe5f2797f7", "value": "12288:oFBIGtQvXdDqIWTPWp3KST/Rpi6+C8a/zXHD3ezMQwcal:AuiWVWip3Ko+Ta/zj3ezrwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652871569, "uuid": "aec0c78d-e7db-4aef-90ef-b1d20620e8f3", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652871569, "uuid": "c9694864-53ed-442e-8b56-dc21253c0bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871569, "uuid": "5ec05314-e199-4ea9-8b5a-1880d46d8180", "value": "NMC ROYAL MEDICAL EQUIPMENT ORDER MAY 2022-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70392144-d6f6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652911447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911447, "uuid": "4bf70728-11e3-4f40-a93f-fe157b5de6e8", "comment": "Malware payload", "value": "c82de1ce763ad2b9690d0c0cdf243472", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911447, "uuid": "8cee7b7c-a957-4a35-bb62-fcf063ca7dad", "comment": "Malware payload", "value": "0f50b2e91c97bef6e3099558005963a082ed8e0a1bbc08cbe86bae46b788f8ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911447, "uuid": "7ceeecb1-5b13-4acf-b94e-d3cd34cc8c53", "comment": "Malware payload", "value": "7c120ca1e87f237b7695ebdd566de24fcd6d9d0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911447, "uuid": "b91b85e1-8f32-4366-8775-57368c46f760", "comment": "Malware payload", "value": "ade4f983c45956f713e72ce66bc80bf9ec069b1f5a882cd59cb2956a1d5b8712f3ee5c3ca699ea91b13113fb5d6bfb06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911447, "uuid": "af6adc13-d4e4-4220-97cd-e7b74244d66d", "value": "T10E05273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911447, "uuid": "74db1631-5627-43b4-9a5f-34aa7ed67360", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911447, "uuid": "ace4e45d-c992-4cc6-a045-840c548cc883", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oKaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7cUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652911447, "uuid": "b27507f3-37c1-421e-8729-4a7cc9784083", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652911447, "uuid": "9662b117-5ee9-4654-8cff-6ac2b32674db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911447, "uuid": "bad1262e-101d-40c4-abf1-93fcf8f78bd6", "value": "c82de1ce763ad2b9690d0c0cdf243472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebc0d9b-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908948, "uuid": "af625d06-38dd-4eeb-8de7-8a4c148ef74e", "comment": "Malware payload", "value": "625c8542a28aa57a7e87a94ed1226698", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908948, "uuid": "2516aed7-d5aa-4181-85f4-a85fb40c87ce", "comment": "Malware payload", "value": "10399fc0bbe6c860aa92087a0bcb9f2100c8dd301949153b5b811fbbfd01123d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908948, "uuid": "7ee73420-74a7-473d-ae7f-1336a8a34d0f", "comment": "Malware payload", "value": "d0408c7ee276a80f63daf17940656564c98a68d5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908948, "uuid": "4b4e5d0f-05dd-40d7-a59a-61a1ed920b6f", "comment": "Malware payload", "value": "027dfc6d9f21655315b8e676f23ee406ece58d8225b1d8277574766d714e49fcdb5e8fe46147d0fae8477c0d31e1d497", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908948, "uuid": "6cce7c24-68b4-4184-87f1-668de4e4c4a4", "value": "T1F1A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908948, "uuid": "f2d8456a-2a87-41a3-bb90-95fa556dbf4d", "value": "96:dRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:dRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908948, "uuid": "eb260825-1cdc-4c11-8084-2df21aa28e53", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908948, "uuid": "7750e6af-e1f0-4a3d-966e-90d676b53edb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908948, "uuid": "238c6952-bd80-49ce-b0e6-961cb36eb276", "value": "10399fc0bbe6c860aa92087a0bcb9f2100c8dd301949153b5b811fbbfd01123d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c53271-d6c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652891480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891480, "uuid": "75133a38-2071-4893-8b93-84a104316303", "comment": "Malware payload (Mirai)", "value": "3553e8d1358ce0c632f5772663860bca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891480, "uuid": "c82964e8-3be8-424d-bff5-e06b9e2ee7a6", "comment": "Malware payload (Mirai)", "value": "10a16cf2f4a822c85c9b1ffeb18c64d5d0344192ca025eb1fea5565f3e266895", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891480, "uuid": "823638a3-f61e-441d-9212-ea0562c0510c", "comment": "Malware payload (Mirai)", "value": "43465aca14f1409830cae1190b48353f2e955990", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891480, "uuid": "d6b4495b-8a96-41ce-82a7-9e557cccf7f3", "comment": "Malware payload (Mirai)", "value": "7bc1e0972915c2cdff0aa0aae91d7a09fea4f23c40d02fff282f64c3a50615a298e28f8ea68d319c87d400b5a13992f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891480, "uuid": "5f2c0688-8c1f-4e2e-85af-a31a1e3e8544", "value": "T188530A817C91AA29C7D0577BEAAF108E3354ABD9D0DB7347CC044B917ACA90F0D67B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891480, "uuid": "d61e7e04-266c-4c27-a774-6e561c330ef7", "value": "1536:dOxGfyRWiPLacGXWzM9l6yTzpl84ETjpk19y20Yvck6YceZWGzDzMH:dOxkyRWiPkjX0QckVcwLsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652891480, "uuid": "0b1d70c7-ec26-4e9b-a3de-3a3311f34f7f", "value": 62680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652891480, "uuid": "70c94d32-2d5e-4c1c-8a3e-3ac181a4a34e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891480, "uuid": "a350571a-e70f-481c-a75f-3082a820d85f", "value": "3553e8d1358ce0c632f5772663860bca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837132b7-d654-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841901, "uuid": "223bf385-6144-451d-9325-5e79c9a9dcd4", "comment": "Malware payload (Heodo)", "value": "c151fe03aeac68e4ea68a2b17a281e07", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841901, "uuid": "c984bea1-cb4c-4940-8e05-f1f8588a72d8", "comment": "Malware payload (Heodo)", "value": "119d2928e3dad5680943e6eeadb37d53c6bb5506dbdb95f4cd62e91992008589", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841901, "uuid": "45de0114-0634-4ef1-94f4-2d70c343fbf7", "comment": "Malware payload (Heodo)", "value": "cb9d990cf128e2e4ee13953a653f9ecc4cc12b55", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841901, "uuid": "e141a42c-5400-4926-8fad-49d6dd5a229b", "comment": "Malware payload (Heodo)", "value": "e2ae170c3b7933b18e8d97eebcfea7a253186c51f485d8ca3fa935b241bdb1c51e519832eb98f850fcee28da07847699", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841901, "uuid": "e9bc18d8-1560-4e08-a30f-b36951009971", "value": "T1C2A48B4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841901, "uuid": "7640006b-501e-4e20-929d-2e8636eeefe0", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841901, "uuid": "f83afad7-5bff-42b8-9d6e-398a5ea1d525", "value": "12288:uS4BnAed8BK2o0afa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKua34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841901, "uuid": "2647fc28-e985-4635-b884-2d2456c2424a", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841901, "uuid": "9a087b30-34b0-4497-aea8-0147a08a9244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841901, "uuid": "a3359b8d-4a12-457a-8dc8-af9f6fa6ba64", "value": "c151fe03aeac68e4ea68a2b17a281e07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a50def-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652858578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858578, "uuid": "a29ce98e-37a5-4c72-8f30-e66aa3400f4a", "comment": "Malware payload (Loki)", "value": "63665c4a9af7b5b5b24211c18badb5ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858578, "uuid": "907c03b2-de94-4398-a33c-bbf5f1fa1a93", "comment": "Malware payload (Loki)", "value": "11bd4ebcb491c120c871767c30f6b614c74bba8bd29b3a01977340442e609a94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858578, "uuid": "adcdbd62-2eb1-4d78-b037-782ad3fc3a95", "comment": "Malware payload (Loki)", "value": "3ffd6273bade773818385badf22bcf1d18e218a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858578, "uuid": "e5965f0e-f99a-49f0-be3a-9e17530843db", "comment": "Malware payload (Loki)", "value": "14e31e253e0d17e583b9b5fed36e41dcc412edd05c409657414a7ed6b0b63c0b8459bac1263c4659f6ce113cad0cb06e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858578, "uuid": "d9e7e192-44c3-4c59-9496-7d75f70b1fd6", "value": "T120D4E02852A8DE64E9AD03FED07205F813B46D07D512F35FDEA47CCA3D36381865A62B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858578, "uuid": "2e6460ee-e7f9-4dcd-8428-c03406cec62d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858578, "uuid": "06db8deb-ef83-4311-b81d-fe8ebd40b66f", "value": "12288:ZheI/KlTBNXRPNmyQl27p7N67J4pdiceEnky34TM2ZV9jS:7VSlT79l8ax67JKdiceEnkUGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858578, "uuid": "c833cd1c-7e4e-4d63-8fbe-fcf6b1f4c0c5", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858578, "uuid": "a8143b9a-2b78-485d-a842-27282f13431c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858578, "uuid": "86c5c6d8-a888-41fa-ab24-a9e86fb0ce17", "value": "FedEx Receipt_AWB#5305323204643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987ecd0c-d6b0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652881450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881450, "uuid": "03c19779-3904-48c8-91fb-104ce679d3d9", "comment": "Malware payload", "value": "946ad05d7df7e84f8f271eb89794b1b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881450, "uuid": "50231e77-b36e-48af-84ff-14bcf33cfc1e", "comment": "Malware payload", "value": "1280396a73f57ac4d457bbc0e308ebde91ff8fb8a34819181cde200b8cb754d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881450, "uuid": "8f981aec-1aa2-4ef3-977f-6a0030bc7660", "comment": "Malware payload", "value": "5e2097a2cc225c747affc62710c42828a8a86b09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881450, "uuid": "568039f9-5647-4a6b-9591-8707291c7246", "comment": "Malware payload", "value": "8070bb22ea0482c48d67f00ffaabb1856240349c49605219d6ca6cf05e7b63f3b9ecc1268fdacb97ae98c41e09f11631", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881450, "uuid": "5f20ed1d-517d-4940-addb-e1b5009bdbef", "value": "T1A405BE5D3650F99FC55BCE36C9641C60A660AC678707E343A0573AADAD3E7DACE002B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881450, "uuid": "40fac97b-d05c-4007-9e58-07bd728f5b80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881450, "uuid": "de0641c6-5625-4dbb-b60c-8564bddfe06b", "value": "12288:esY8gNXzC8VU7p3LAgWtex1ks4fwA1DL1IwxBG6eijzyFV/FA4meYmtYac8YkcR0:c/UN3Wztfw41xG6e1ZFxmtmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652881450, "uuid": "4b5dab36-266a-4c42-8ba1-a3938a606955", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652881450, "uuid": "5e87092c-fc8c-420c-963d-a6a3ba514c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881450, "uuid": "f9ec3d34-354c-409f-a5f0-afdc15a3d058", "value": "AWB & Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60490630-d6af-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652880926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880926, "uuid": "35310559-41d2-44d0-b96c-305da6752bb0", "comment": "Malware payload (AgentTesla)", "value": "23c4800586624981bbac4137d52a5a94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880926, "uuid": "9e7bd9cc-dfd4-475f-a640-33531874c2a2", "comment": "Malware payload (AgentTesla)", "value": "12debb5b625d08f6bc4dd6160435cfde52a33c11dccd4b10fa07c225aba9565b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880926, "uuid": "6623d693-025c-4970-a1be-da31b3d810c3", "comment": "Malware payload (AgentTesla)", "value": "5f6b7ee881019b7fa44207a1c4b44b68f58a9640", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880926, "uuid": "a8b988dc-50bc-432c-82a3-00c9110cb970", "comment": "Malware payload (AgentTesla)", "value": "9273bea97cd1328e642bcf154ad42d80257b8b35d4977fcefca0f3c3771b9e524271ed7a8626b03f6277e708bdff5c23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880926, "uuid": "7487cef6-7f13-4277-9098-c2427f549116", "value": "T170B22E31A38B8124DDAECE77E82241BD46EDBE138852D67B25C0FF8E7931D06C5A1674", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880926, "uuid": "ec18ad74-ebd4-40a1-84ff-81a5a05e0889", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880926, "uuid": "1c963f98-ca42-439b-bf94-2cd6e8d11084", "value": "192:7ZulWDxMJLTY20HzeTLM5s49KqiIx3fxYvvu8qH:7AGMJLTY2Aze4s49KqiIhN8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652880926, "uuid": "871bee1d-c6b0-49cb-b651-5da1d1324072", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652880926, "uuid": "f28f3639-a227-4763-aec9-26a24c9d6271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880926, "uuid": "b1cbe802-dfa1-441f-9ca8-f12232a97d42", "value": "SecuriteInfo.com.W32.AIDetectNet.01.30004.2940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099653fa-d6fc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652913852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913852, "uuid": "f12afae4-fbf7-45f4-8cfc-7a399c0b9e5e", "comment": "Malware payload", "value": "b2319391428ccc516da348341f0b7139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913852, "uuid": "c20a9f0c-33bc-4315-8915-74b956186586", "comment": "Malware payload", "value": "134cd12ec24943d67f047d5e8992197d063e9b794d955b310140b660a23668f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913852, "uuid": "ce247081-777f-4c34-ac19-a2697220012f", "comment": "Malware payload", "value": "85085e52d2be77dd7ab970a52211caacf684ece6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913852, "uuid": "5d7aa315-7708-4c19-8e1e-73d24940944c", "comment": "Malware payload", "value": "879a7806554a9f439a62caceb0cd41ca8a2ad1cd3a17343cad43afaa63360fb3799d0c39b05f66e07cbb41ec6aa7a74d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913852, "uuid": "98c0ba73-00eb-4efd-9541-17163b886d0b", "value": "T14205273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913852, "uuid": "18210a03-ab28-404f-8660-3600df894b23", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913852, "uuid": "a68716b3-c562-4d62-9089-33206e22bd51", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oyaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7IUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652913852, "uuid": "10e77c48-24e9-4bed-a167-f15be0eb8571", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652913852, "uuid": "d2a9a570-4f57-44b4-bb0d-3ec43fc376a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913852, "uuid": "f3a3803f-169d-4f03-8148-fcc8106e1b38", "value": "b2319391428ccc516da348341f0b7139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2efad1-d67c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652859228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859228, "uuid": "3a7df2cb-855f-4059-8809-fe4ad1437c4f", "comment": "Malware payload (RedLineStealer)", "value": "9bd097703d199a56adca3324efcc5f78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859228, "uuid": "7e7e5eac-816e-40d4-a9bf-97b54c175a0b", "comment": "Malware payload (RedLineStealer)", "value": "13b380c9a5538e2d28651aaaf00650d097d1f51042c48a4e149b43dc775a962a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859228, "uuid": "4be80a9e-b436-4a78-ab38-d2a86f552941", "comment": "Malware payload (RedLineStealer)", "value": "a05c689e0e80513b32a61eaf3d88edada07b7005", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859228, "uuid": "3f611e47-3e0f-4292-9c81-e2d764cf24dc", "comment": "Malware payload (RedLineStealer)", "value": "6c63ea4d6a6d67ec0f4fe71a0d8c6ec7b745046ef32e2bad50a0ac7a4fd5588d1b2bdbb25ee973246df043ba05fed047", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652859228, "uuid": "a5f02626-6488-46e0-9d40-9f46d34d0702", "value": "T150A35D20679C9F19EAFD1B74B4B2012043F0E48A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652859228, "uuid": "9ced91ec-494d-4bba-a5e0-d6b7a88d9826", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652859228, "uuid": "edae283e-a52a-4e2e-854e-aeb9cd93e4f9", "value": "1536:5qsCOqJGlbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2VteulgS6p8l:X1uOYj+zi0ZbYe1g0ujyzdJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652859228, "uuid": "071da8c5-cce8-41df-a0e4-3c75a95d1b0e", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652859228, "uuid": "2b29030d-50a9-40c0-a3ac-339d855007ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652859228, "uuid": "fd319f2b-4318-4907-87fc-2c4d03cdb1c2", "value": "9bd097703d199a56adca3324efcc5f78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5219701c-d6c6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652890781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890781, "uuid": "1f51816c-41d7-4cba-8855-c10e9fcad5dc", "comment": "Malware payload", "value": "e57f867bd158a9875519ff3aa736cfe4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890781, "uuid": "f3c3ac34-4e50-44f9-818b-3f3eb91f9cc1", "comment": "Malware payload", "value": "153aad8665aa8567743e7513e1bf5f3c0ce0b8dd4e260d2470ba5685ad97f546", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890781, "uuid": "c2e37565-c454-42a0-9b7c-95e8da32eb4e", "comment": "Malware payload", "value": "b92f8c58c074dc8f1750b9eb7910ae7e3b23e498", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890781, "uuid": "03cf35da-373f-48fa-b9c7-e6606d0c81bc", "comment": "Malware payload", "value": "6f0ad07a889e2d11a110798c72a955228d3339dc880939a3a0855ece34f7d4505b8b41d6f34c03dcc7e466b843ea7694", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890781, "uuid": "0d9728c6-bed4-45b5-a573-d4ad2bff08fd", "value": "T143C52268DE6B62D7D2D7447FE2C3C106A41AA68CE3D6D103A7E644D4092A54C0F4FADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890781, "uuid": "ddca7906-9656-4607-b479-c8f4e4092c22", "value": "49152:PDIsreuiWlR8wmOkIaCfHRR2AxEPCnXuA4f0R26j1tnMkA8K1fMC+4Voe:PD5pR8wmYaCffePCjbRLjXMkY1a1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652890781, "uuid": "87d73b88-3cb7-4abc-914b-c491399c55bb", "value": 2656607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652890781, "uuid": "bc52a4b3-4590-4a57-b74f-71ace727f07e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890781, "uuid": "4e0266a1-e211-4025-a5af-4e5e77e00c9e", "value": "bigrat-final.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a3c4a3-d65c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652845173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845173, "uuid": "ebdb4857-1228-426a-9aea-067dc3df25a7", "comment": "Malware payload (Heodo)", "value": "4b151952a7cf3c23f615de307de33bfc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845173, "uuid": "205373e2-26ce-4b16-8b66-07338378209a", "comment": "Malware payload (Heodo)", "value": "15434afcb1dede52c8e8ebac64b5bc5fc669b0fd05603a0131a98c5f9ca2a051", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845173, "uuid": "30f9d1f2-ece8-4c46-9550-edac81005107", "comment": "Malware payload (Heodo)", "value": "7183f03ce9577458fc38d7fdc3e39fd32be08e22", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845173, "uuid": "9b96d69b-74ab-424c-aa30-f770f4a29787", "comment": "Malware payload (Heodo)", "value": "4474bab4a98ce9b56a679e6909748d57ff26a137749355c2d9c5f186a199c6e77f58003d2c0628beb00881ea7bace4b4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845173, "uuid": "9702a846-01ab-4ccd-bdb3-dbba41a0b878", "value": "T1A394CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845173, "uuid": "027e48a4-2da1-4768-a27f-6fc1dabf3ab1", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845173, "uuid": "8aaf3090-8442-4564-a40b-4b5865594096", "value": "12288:M3hV6Pw4aT23s2oOd9zi3BBoNIQ/hsA7:Yb6Pw4R3s29i3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652845173, "uuid": "f9bcbc04-2cab-4b98-b5f4-b3298e11b536", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652845173, "uuid": "85419efa-670b-4701-9e02-21ec7006ec6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845173, "uuid": "40819202-8053-4eb1-9b4e-36d5874250c9", "value": "4b151952a7cf3c23f615de307de33bfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc94dba-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908923, "uuid": "39d3d469-652a-48f0-9741-c29523df7010", "comment": "Malware payload", "value": "874cff9b3d316f80c821513f7e5f1fcf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908923, "uuid": "69002c4b-64f2-4570-a1ec-02384b906201", "comment": "Malware payload", "value": "1568f51d66d3c58ccd5e02c7b6a47e0bd765529542d189eb30ff2d3f3523ac57", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908923, "uuid": "4f0df5c8-9ee6-4a2d-9c88-d83d01c121f0", "comment": "Malware payload", "value": "206763660c1222e46e431d63ffcb3541ae29eaa9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908923, "uuid": "09eb0072-af71-45b1-98b5-dcef35311f7a", "comment": "Malware payload", "value": "503d3251fc354725e3cb7ce6c5c8ee56988757320236b245d91c5995cece2a516ef4ca6948f543081fb4fa7f4d8027d1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908923, "uuid": "cd877500-34ad-40cb-b975-8646b610e1f6", "value": "T12301EF46084CDEE6E4422C7DDD1A0B9AC883116E4C29A92D4CCD52F6F0CC93E9DF7438", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908923, "uuid": "6142df57-b897-48a4-9b4d-bc7230e84669", "value": "12:lDYNvT7AHrQLRGB7YGN218fg0CZlBP4TDGQDsxM8sUeFu7uSlir+8ul8d5AVS:lDooHrVsZShQQUecu5r+8Bd55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908923, "uuid": "20f952a9-9935-4a16-818c-015b7449bb8e", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908923, "uuid": "7cb03387-9da2-45c1-b5de-4a9d0bb00fcf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908923, "uuid": "0dfdaf6f-ba98-4a53-b657-01d58de517e1", "value": "1568f51d66d3c58ccd5e02c7b6a47e0bd765529542d189eb30ff2d3f3523ac57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad11b121-d6b9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652885350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885350, "uuid": "f6c507c7-d8ba-4dbd-b755-16876c58e8db", "comment": "Malware payload", "value": "a78a5efd645168ccb26c58dd3d729d4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885350, "uuid": "41a80314-f242-4b6b-a6d8-291190d6d615", "comment": "Malware payload", "value": "15b35a1d87749e74f3e9e6ca7b897ba5792a9540cfba9cc9c9c74cf673c9cdd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885350, "uuid": "37cbde58-1c72-4755-8e5f-cfcb52a1e0c1", "comment": "Malware payload", "value": "cb6bfb9ef7a5235dcb5450d782d6069727be570c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885350, "uuid": "2d67585d-6760-447a-9043-97595e0e1367", "comment": "Malware payload", "value": "11409539a4536f0a48c224c5dd4617229ebf0510dfee53067be7c1b45d78877826a5ef1e52daad377d01449c2182cd31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885350, "uuid": "f073291f-861d-4eb1-96f7-0f643aa96b75", "value": "T1F994C04A73A50CB9EC7282798C574A01E672B8150771EA7F03E0875ADF2B3D1A93F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885350, "uuid": "23c0a889-1492-434b-81ea-665b6ea435c5", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885350, "uuid": "87764de5-25ec-42f8-86f6-bda40389a2a9", "value": "6144:GgIYnzcJxDpmJIyeV2vR3JDEohAEuRfoP1SKL0w+d7sWOQSH0E9cWdb3BHq:yKz+1pcIuvR3lEoWEu+9T0Rd4Hr9H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652885350, "uuid": "cea35e2e-e862-4120-ab20-71a6e1d78103", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652885350, "uuid": "377cc5c2-e919-41e8-b168-51476670ea9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885350, "uuid": "dd72c5c6-8192-430e-97b4-5ea1bb89d39f", "value": "a78a5efd645168ccb26c58dd3d729d4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05d6b31-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908978, "uuid": "c3c8b91e-33f3-4cc9-86de-41a7fca75b89", "comment": "Malware payload", "value": "4899d442a0664d69fbdf186757911029", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908978, "uuid": "a577d2e4-814f-4650-a6fe-cb05d5443e98", "comment": "Malware payload", "value": "1670998c194838d32cfce8fd5360c0f265f543ce35405c8e11d91440a0179988", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908978, "uuid": "3691bcf5-4b8d-444e-9137-3976c3696b83", "comment": "Malware payload", "value": "9595b9896490ba10d087df6fad8f86b3fab42c18", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908978, "uuid": "71e49ff1-5c83-4238-9863-37fcce292ceb", "comment": "Malware payload", "value": "4a9965051967ed870abf64ea356f44b1d5e7d0944e1add1760674291af1089201837c0b1d187b81ced6d2961facfad2f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908978, "uuid": "c8236220-abb1-4208-9104-f3b2304ae97b", "value": "T1D5A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908978, "uuid": "f198a6b9-e363-4e75-ac78-06a918a6efc9", "value": "96:gRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:gRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908978, "uuid": "90ef74f6-4a96-43b3-9537-7810f7cfa95f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908978, "uuid": "fa829e2e-6560-472b-bbd2-b5e5cc3abb2b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908978, "uuid": "5703d248-41e8-4ac2-a761-c7ee0cb249bb", "value": "1670998c194838d32cfce8fd5360c0f265f543ce35405c8e11d91440a0179988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f100ab72-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909086, "uuid": "d6d02ba4-6249-4830-863e-8f2c266c7d76", "comment": "Malware payload", "value": "ab8e37bf608160618e48062386a19044", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909086, "uuid": "658e298c-d3ff-4111-9548-051483b42bdb", "comment": "Malware payload", "value": "16780dbd0bcce7083ff40225853ec89b699ff89419af210c620752468fd3a131", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909086, "uuid": "0c65bc66-0084-4dc3-82c6-66e9d98ed661", "comment": "Malware payload", "value": "2166442d1cee0a5917181469a292f9a13532148d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909086, "uuid": "1262604f-3450-49fa-b3de-b238d20ba118", "comment": "Malware payload", "value": "ca6e6bb3ad22ca8eba6c4d91b972e4d1107c696e022124419453b594ff1e66fdebe59a73aff3aa911ae8a1db6f6d38e9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909086, "uuid": "d403d52c-f17f-4b7a-9fac-8cf07f7d4848", "value": "T1B7A1E850112C1AB17246597AD26FFA52B90EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909086, "uuid": "d7b2a169-e16f-4bae-84c8-dbb1203a120d", "value": "96:CRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:CRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909086, "uuid": "ff309bc0-1730-42df-957a-084714d4e2ba", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909086, "uuid": "10ac7b99-fdd3-410a-a744-185f1c981bf8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909086, "uuid": "8682f86d-f489-479f-97a2-6694a1c2bedf", "value": "16780dbd0bcce7083ff40225853ec89b699ff89419af210c620752468fd3a131", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f762a21f-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909097, "uuid": "b85ef8ef-4c4b-4e4d-917c-508c3bc98241", "comment": "Malware payload", "value": "2be1a1ba0388b91905e1908bc18ac38e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909097, "uuid": "e7fe1b82-500b-447e-8a29-75ef748da9f2", "comment": "Malware payload", "value": "1679514187bd47ed23ec628e104dc5712cc670017f727f929fcc343a6f9cb821", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909097, "uuid": "af7c3b9b-af02-4dee-8c71-899e97144ac7", "comment": "Malware payload", "value": "223a246949b1b475ad031e045ef4d1f15806537e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909097, "uuid": "ea286b77-d881-429b-8398-10665a65f292", "comment": "Malware payload", "value": "d3d9abcb560614e71df4673910bd709a08c7a11e76fca0d71e48142c9d6df86e3599e9e17567ed70106701a5532a4cca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909097, "uuid": "bf1c195c-c271-4137-be24-d6b53661bd16", "value": "T1D9A1F850112C1AB07246697AD26FFA52B80EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909097, "uuid": "5defc9fa-53b3-4e30-959a-28b8458bc80d", "value": "96:JRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:JRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909097, "uuid": "06fc8398-65a7-4991-b08c-dadd4f8cdc78", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909097, "uuid": "21664011-096c-4a16-96c0-eb97a95e46c5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909097, "uuid": "9486a39f-0920-48b2-b104-67662ca48b3d", "value": "1679514187bd47ed23ec628e104dc5712cc670017f727f929fcc343a6f9cb821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988f050b-d6e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652902925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902925, "uuid": "d2121e16-279d-4e0a-b963-39e31bf23107", "comment": "Malware payload", "value": "58b89b6f710131d483fa64a00265386c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902925, "uuid": "3f06210b-fbdf-4191-a41e-4f98773d4d28", "comment": "Malware payload", "value": "1697fedaa054299b25fd4ea56a7c03c680bbc806e2c4ec5ba5b5b8fd1406c874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902925, "uuid": "4f3d34bd-ffd5-43ce-84fb-afe8b90ccd8c", "comment": "Malware payload", "value": "a4612e96d209701a82bb9e04f3c6d93a6f63f6a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902925, "uuid": "daa59e42-43b6-4c48-808e-87f8c22169df", "comment": "Malware payload", "value": "62d29c12b18272e8a8222f9192b57a19d9bf9e26eaa4794e096d754925813bf04aa7ce7170a721c83220dae0bab3d34a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902925, "uuid": "ecb32b45-56bf-49ac-bced-7319a71b0f7e", "value": "T11505283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902925, "uuid": "a92f16f2-02eb-42c0-94bc-9e7006f63661", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902925, "uuid": "0affa37a-a820-4265-9adc-ab164988b11e", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7dmpE3:BTg9UXRD2SeqfZZiJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652902925, "uuid": "aff2a2e0-a4cf-4a92-8770-eb97bfb7abc1", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652902925, "uuid": "38356e2d-5809-44db-b08c-a7005b9b8459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902925, "uuid": "f66f4fc1-85f2-4f97-beb2-c0420615e21a", "value": "58b89b6f710131d483fa64a00265386c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e96b0a8-d6f6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652911417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911417, "uuid": "0ba28a92-7104-407b-84f6-0c0ae07334cb", "comment": "Malware payload", "value": "1b1edaf33778ee7529a5deea54033b75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911417, "uuid": "8e77c858-5b84-4c77-a5f6-57a81fc685c2", "comment": "Malware payload", "value": "16992a2c9c2e9016fc5e9132c3549e587ddddf55be842cb8700bfddc987e9707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911417, "uuid": "0fb5c16d-f227-456d-a4a1-b36dd4ed771f", "comment": "Malware payload", "value": "37ff3b717456c8864570b2393ea6006275683ff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911417, "uuid": "6b8b4fe6-0cb5-4fb8-ad1e-a2a5671ab240", "comment": "Malware payload", "value": "8fe07a904e375034ca62c068c9f18d92b95c456fdf63fdbfc7bd4adcaf6f084887b5e6b1c211fde1f5cd66377f5def43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911417, "uuid": "30fd70bd-9cf5-4443-9fc5-6edf974b95bf", "value": "T13C05273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911417, "uuid": "17ae0242-a3cd-4b2f-a349-fe4c9415ba10", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911417, "uuid": "be8edd6a-ba2e-4fe4-9006-7da3442119ba", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oyaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7cUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652911417, "uuid": "23b84bb7-fbfe-4118-bd8a-161ac106e869", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652911417, "uuid": "f2e1ed96-4e13-4c2a-b134-b87ba5e5bdeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911417, "uuid": "f2b1de9c-271b-4dfc-abf9-dbde90676060", "value": "1b1edaf33778ee7529a5deea54033b75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904adfe7-d6d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1652896039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896039, "uuid": "30e41aeb-bad1-400d-a5ec-e4269fddf232", "comment": "Malware payload (NetWire)", "value": "a59ac2b148bc88c1dd774b11a78166c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896039, "uuid": "10a11f25-d6cb-4ba9-baaa-f2496a6e8482", "comment": "Malware payload (NetWire)", "value": "16ed90d867f9c477ac4039e888356147f27a07bb2ef02d169f14c21063cc18c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896039, "uuid": "a35497f2-6f67-4df2-8469-92abf70c2e4c", "comment": "Malware payload (NetWire)", "value": "12590c60274e4e0646d495eaf61033e3fb829f1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896039, "uuid": "805bb4a7-83be-4f89-a750-badeef68bed3", "comment": "Malware payload (NetWire)", "value": "e5a3003ef3d770c98e9f92bb4589cc168da54dd2557b3e529b4f8d0ec84e937f0a86db67268035e70ec3654eba0cd05f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896039, "uuid": "9abd1484-2f48-4dcd-8e96-8954820367fe", "value": "T1FB94E1142BBC3953C6EFDAF80090C246427680DF7D63F35A5FA30CDE6984B5592A1A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896039, "uuid": "d0cd8efd-aa52-491c-b8c9-e3513aab22fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896039, "uuid": "a8a0952d-d548-4e9f-b7f2-70d4d8c6867c", "value": "12288:Q63IETZ8gvNfF1KmKhOd4cmbjDUn1+dZ:71VfF1KrsdXmPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896039, "uuid": "4501ab83-f288-41e5-b259-2e785344f1f0", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896039, "uuid": "e00c3b97-54bd-4aa2-a77b-d6116cd883d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896039, "uuid": "7e5010de-b29e-4b30-8cad-cc360600d9cb", "value": "SecuriteInfo.com.Trojan.GenericKDZ.87786.11151.12123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2437f8-d6b9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652885318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885318, "uuid": "5fc31eb5-e0e3-4b15-b559-eceac6eb50eb", "comment": "Malware payload", "value": "7202c4699ee72feac31a05a73fdf2098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885318, "uuid": "da42800c-6f17-4c89-aeda-1e7f81802403", "comment": "Malware payload", "value": "170021c001ec5d94163639765af2b6ed7100556d9ee4fbcc48a6bf6e0cdc665d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885318, "uuid": "c07ae96c-397a-43c1-84b2-61279383ddc0", "comment": "Malware payload", "value": "8b51e994a415b34c40d6673e998a3b663469eda7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885318, "uuid": "497f3fc3-c199-4496-9f0a-d8572c55ef4b", "comment": "Malware payload", "value": "366775ceda12da834064ba83df949878ea754d3612862b1f12bdb5643d9c51eb977cf2b2bddb8f1b9153950dbe29986c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885318, "uuid": "97126bf3-38a3-4cdc-8aac-bd8da01e149f", "value": "T10194C04A73A50CB9EC7282798C574A01E672B8150771EA7F03E0875ADF2B3D1A93F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885318, "uuid": "2357b50d-a167-45a5-a38a-34bf10f2e412", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885318, "uuid": "e0a2cd1c-0b44-4513-bee7-10d94a9e3aca", "value": "6144:GgIYnzcJxDpmJIyeV2vR3JDEohUEuRfoP1SKL0w+d7sWOQSH0E9cWdb3BHq:yKz+1pcIuvR3lEoyEu+9T0Rd4Hr9H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652885318, "uuid": "ce465dd4-a8a1-4eff-bc7d-e9439f1d54b1", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652885318, "uuid": "746aab8f-fa0d-49e3-bba3-91c65180454d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885318, "uuid": "553d834c-312a-4a00-98a1-7ee86e939f39", "value": "7202c4699ee72feac31a05a73fdf2098", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f43877d-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908922, "uuid": "fbb0ad04-5504-4671-a87d-fc3f392d12e2", "comment": "Malware payload", "value": "0e4a4d1076352d08df0308816d1d5232", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908922, "uuid": "8b30288a-7172-4d7f-bff1-540ef2229297", "comment": "Malware payload", "value": "1746e51e02e63cdb9aa8c85f45e485551ba53b51ed1f5c4419b7cfea47fb4544", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908922, "uuid": "3d0b746a-a04a-46a2-aa49-ee5ff699a295", "comment": "Malware payload", "value": "a75a0da195fd6d85eb0bd089d8e64e1301de8895", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908922, "uuid": "c3b14551-efe8-4ff6-a459-df9a1cc323af", "comment": "Malware payload", "value": "1a077c40fe905d6fe837b4097c56311b0533ba77df799ddda8673c89a33352e3c631bff38020a936639cc338b1ea0d11", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908922, "uuid": "ce841d93-9c57-42da-89b6-55668744e5f4", "value": "T18AA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908922, "uuid": "a62de151-0d03-4b19-b071-dbc20c49f568", "value": "96:JRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:JRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908922, "uuid": "0911992e-176a-4b8c-844b-f651effc95d3", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908922, "uuid": "42045b4e-3edd-4e4c-a302-5e4791b19813", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908922, "uuid": "dc5c30c7-7619-4e06-a85d-365df8695c54", "value": "1746e51e02e63cdb9aa8c85f45e485551ba53b51ed1f5c4419b7cfea47fb4544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823cf34a-d648-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836745, "uuid": "3a327c31-3dbe-48ae-8282-b076fb03821c", "comment": "Malware payload (Heodo)", "value": "724b830e32f34642573c1b6b372b9357", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836745, "uuid": "4ea3380d-09fb-4b38-92b5-513ae3ff101b", "comment": "Malware payload (Heodo)", "value": "1816ff66d027fbf27465757cc6d7936e3942f9fcb26b8c801e5c16b73eaab2a6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836745, "uuid": "333e30a4-5d62-44b9-b272-df90a38c9b58", "comment": "Malware payload (Heodo)", "value": "56f6712b3f3ac39bf16aa525d75ce314687d1714", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836745, "uuid": "a4f10f7d-8c5c-4300-b633-b8be51157598", "comment": "Malware payload (Heodo)", "value": "c5b99e3978ca9a362130ea66b7d6b2e391e19f697e7a4168c4230b9c2397b8e41159d8216f39d6759166ba93b5d94fea", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836745, "uuid": "c33941d4-1508-4b23-b1ba-05203b734dc2", "value": "T13F94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836745, "uuid": "a4023841-b090-4a39-9684-773e1d30762f", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836745, "uuid": "b9a139ed-dc23-46eb-9a10-52ffb39298a3", "value": "12288:M3hV6Pw4aT23s2obd9zi3BBoNIQ/hsA7:Yb6Pw4R3s22i3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836745, "uuid": "2fec748b-6147-48c5-a29e-f38a5d1d618d", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836745, "uuid": "ffe382e8-42ef-463d-9386-f651d66be6e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836745, "uuid": "eeed5a38-ef81-4f68-bb34-77a9ddb14a29", "value": "724b830e32f34642573c1b6b372b9357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0741fe1-d6ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652892764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892764, "uuid": "6422770b-1347-4d56-92e7-67310dd59978", "comment": "Malware payload (Mirai)", "value": "56fbb79cc8689fc5409f303693f27c51", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892764, "uuid": "35f5e7ff-d31d-45a9-ab53-1e92a6980c0f", "comment": "Malware payload (Mirai)", "value": "1835db769fb6bd8c075fed56e4eb7d8219fbabb44fcb9ebfb2bf276a00f4ba92", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892764, "uuid": "3052c439-a97c-47fc-9387-ce9ef1dab353", "comment": "Malware payload (Mirai)", "value": "87d16818b4a462b53076320e7d2b5b72eda759a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892764, "uuid": "a7557c67-2a5f-48f8-9bba-0397d405f4b2", "comment": "Malware payload (Mirai)", "value": "896e9f918a4447b38532e69dcf8712c19874fadfc91ac9709405ea1c3198e7174d2ecadd116e82a5bcfb40309f3432f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892764, "uuid": "0a4a55fe-ca8f-473e-9558-a6a6fd58d11c", "value": "T103E35C46FA818B13C4D517BABAAF01493332A79493DB730689285FB43FC6B5F0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892764, "uuid": "87704bc2-fee0-4e08-a11b-366493e5bfcf", "value": "3072:LNRyEc6V5I9vKWob4qjgzXwH5m38XbhrdeXB8lM/9PwWe:LNYEc65IloMXwH5m38LhsXBOM/9PwWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652892764, "uuid": "81635b78-bea9-4795-9c04-db2f37089fc7", "value": 153259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652892764, "uuid": "cf79edb6-8669-4c3c-bf5c-415501728b8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892764, "uuid": "54804c05-284f-44bb-9588-721aa90757c1", "value": "Oblivion121.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdc562b-d690-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652867874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867874, "uuid": "2a844f43-4fbf-49da-9980-6677e20f822e", "comment": "Malware payload (Mirai)", "value": "ab8c6f6fe3efe6f539bf7ee9e76cf151", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867874, "uuid": "cee2b2b6-047a-4694-aa30-f2569f0ec8da", "comment": "Malware payload (Mirai)", "value": "18c392ba15d1556ea7a90396f26c2b31b87b38683e5cdfbf9a3a4222fa2cf84b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867874, "uuid": "926cd78d-e1f6-41a6-9122-54554788fadf", "comment": "Malware payload (Mirai)", "value": "63f88575787675610aeb92b7e5dcbab492214706", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867874, "uuid": "e0cb644c-ce55-4b10-b3bb-a1fe6ecb5649", "comment": "Malware payload (Mirai)", "value": "38caa70fac1798f6155140456fd6f19fb17cd1fa12cc1ea1b997651c1ef016ce4d83fc587011c4fcc76612cf655edb9e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867874, "uuid": "b0fe8864-e66e-4b9d-af81-c33bddac2daf", "value": "T13C23020B61AD1F6182731CF5F4A6C54276B10EF0B4E8F02B3E2C9A4464DB5089FB976B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867874, "uuid": "701eeca2-c3be-439c-b3c7-fb827c04cf10", "value": "768:qvy/2TvkjE2jsvPdbthYXSXP3JyQ/b0PZapBmvs8uJc4029q3UELjG:qve2DkoDuifMeKaposPZqLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652867874, "uuid": "b4353ddb-928b-4469-ae61-546983e27b02", "value": 48380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652867874, "uuid": "6f1899c4-2722-44f6-83ba-6bcd1a1bd8a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867874, "uuid": "3ec9306b-f332-4676-b6a1-fe1829494e12", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285ba24a-d688-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652864082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864082, "uuid": "5e0fe5d2-2c9f-4744-a488-b93fcc6cb3f9", "comment": "Malware payload (SilentBuilder)", "value": "c9a43aec0ee98a562b05fbad788c6556", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864082, "uuid": "122e7b0f-2f74-405a-a778-02aa809ef80d", "comment": "Malware payload (SilentBuilder)", "value": "18e6aa0dd7e7cdfd3f937dac0d917ee9dec0e6a20a4d5ef24c47a45cf53c9862", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864082, "uuid": "e77570d4-67c6-4e6d-b6a5-d132bfcc9893", "comment": "Malware payload (SilentBuilder)", "value": "730d448ec50407fd6b43e4e4a01576be0c4bc3b6", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864082, "uuid": "6293bf34-ffcf-4e23-9607-5091c679f267", "comment": "Malware payload (SilentBuilder)", "value": "6a329ae25efc97a9a4b2dde4ab0c2d25837ca6200e1fef5a5a929fb7b93d7b90e82eec472528b464160b1e3892bf8e5d", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864082, "uuid": "4634732f-e23f-404c-93bf-f06688c26859", "value": "T121734A4ABA8AC96DF611873949D743A9B313FC110FAB074B3509F3627FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864082, "uuid": "95920468-4d37-4892-a5da-053fb51524a3", "value": "1536:WaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg+AezwrMC1vJec/RtbEaNbR:PKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652864082, "uuid": "d0dd99b2-aa6a-4537-bde7-6f0ff017bb10", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652864082, "uuid": "7ead9c5f-d596-41a3-b267-5972615c5038", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864082, "uuid": "3ab29dcf-e66e-4a87-ad55-5b4e0c002481", "value": "doc 882.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee46591-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652858482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858482, "uuid": "fafcda2c-5d79-42ec-a2d0-08f95b84f4cf", "comment": "Malware payload (AgentTesla)", "value": "422933d64d77f6604334f0e98e764d37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858482, "uuid": "7fc582db-a86d-46de-92b1-640c0812e2f8", "comment": "Malware payload (AgentTesla)", "value": "191e0b6b997739d71b92939ca736a43be3e742aa1b8baf025b5f9114f1f3e7ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858482, "uuid": "45cec5f0-3bd2-4834-9b01-f4a21fbe23f3", "comment": "Malware payload (AgentTesla)", "value": "2dd1a22079a0bfe22db258c5f9574b4942ffc29c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858482, "uuid": "0b721933-7476-46cd-8ac2-4de3ed418c2e", "comment": "Malware payload (AgentTesla)", "value": "8bdfc1a728aef625424eff7d12ddfb7fd6cb718d0f9d16e11dbfe684e657fe2483a721d34f2192b0f478b56de93939f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858482, "uuid": "9507a1ed-d0b4-4a25-9e29-744f92c20726", "value": "T107B2758D5F44811FFBB39DF9B9AB425323BA6DCB6271A31B84C81459582F10B08B3D9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858482, "uuid": "6794c0fc-c170-45df-9b3b-dc099f62e70e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858482, "uuid": "e0166dbd-cf1b-4e84-a666-030d44a61d3e", "value": "384:NmUQT3eGVlk0CP7WlWqVDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDydBx:NXQrP4WlWqVDDDDDDDDDDDDDDDDDDDDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858482, "uuid": "f1f569a5-1c21-4aec-824c-0f05065cd341", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858482, "uuid": "6e3fc629-5d5d-4dff-8ce7-bca044501b11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858482, "uuid": "72c7f3ac-4b4c-48c7-afb3-d4dc7b3d07f7", "value": "SWIFT USD 20,179__20220618-0001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6537bb34-d705-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652917871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917871, "uuid": "6b0d7a1f-9073-4051-9e71-283afff37993", "comment": "Malware payload (SilentBuilder)", "value": "51124ee2d7acd0c79a5211e3dee17507", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917871, "uuid": "91812c99-aae0-4d8e-a3f7-6ea0dd7ba31a", "comment": "Malware payload (SilentBuilder)", "value": "197651ad3ab7de21f409bc7fd5560428148de7553a4e8978c723f9208ea74d25", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917871, "uuid": "54b09736-3e8b-4ab9-95b6-e1abc45d594d", "comment": "Malware payload (SilentBuilder)", "value": "d5a377b8900de0201dc61a584b1ebfaf0f7cb9a2", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917871, "uuid": "754cbd9a-eebb-45d6-9a26-ed2ccb0202e4", "comment": "Malware payload (SilentBuilder)", "value": "71cac80d6c2f6ee95292bb2fd854636cba1ee07a8be8a01f5d0e845e0c7d80eee81b29660c208e8437c2ea889f216648", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917871, "uuid": "ec6b6723-a21d-442f-b6c9-952e110d2abe", "value": "T1A7835B4AB69AC96DE5228738499783A9B323FC150F6B07873509F3713FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917871, "uuid": "3e7aac3c-c2cf-4aca-ae2a-6ec1fd750934", "value": "1536:u8nKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgb9AezwrMCtvJecvRtbFMgi:DKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652917871, "uuid": "8cba5b05-f1d1-4048-98f7-963febbe5115", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652917871, "uuid": "48b203f0-7bd2-4151-8037-e2f789e634d6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917871, "uuid": "ccf12b18-3835-426a-8306-f15d1a873df1", "value": "SecuriteInfo.com.Exploit.Siggen3.32399.24702.27085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07a136a-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909005, "uuid": "73f6aef6-fae5-4171-8af2-7e95a544e4f2", "comment": "Malware payload", "value": "605b40e57e8ad72f2c59a744d853ac21", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909005, "uuid": "97a0a8da-a287-4b52-bc95-ae7899e0c21b", "comment": "Malware payload", "value": "19df77fef650a7030ce6626953b5709bb8c0a67d5489b14e76c2bbe0be8236bc", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909005, "uuid": "02887358-70a8-437e-b50b-4fe75b5b7248", "comment": "Malware payload", "value": "6e3eeadfa009755d4c560d1b7e47bc3d01c9f293", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909005, "uuid": "1dbcf944-91a8-401c-9c8e-94e620511cc1", "comment": "Malware payload", "value": "ed39c0778f8511fe81288828881fed12378665dec29fab4ed579a917fdf3ce41e1bfd1f638fc0cf6d03a18c13ed6be22", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909005, "uuid": "d0e44b6e-5919-460b-910d-ee20adfb981c", "value": "T117F533109AD112C9F698CD2A1BDC7636013FEFDE24B4AEE3869287F5040FF85DA71568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909005, "uuid": "1113a062-543c-4971-9d6c-2cc5d11a1692", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvqE9N:G1wwAjzIQOMK2GNKslgus10Y1/UJ7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909005, "uuid": "6f0c1fe7-fef8-4ac2-a4a4-b9fb42a6ba95", "value": 3543040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909005, "uuid": "e1b1e5ce-a1e6-4f6e-8042-c21b94029f66", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909005, "uuid": "825d0503-1d6f-4e1c-8064-82c16d6b31ec", "value": "19df77fef650a7030ce6626953b5709bb8c0a67d5489b14e76c2bbe0be8236bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fc5973-d6cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652894606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894606, "uuid": "169167f5-682d-4184-a414-b179b5261ac0", "comment": "Malware payload (Mirai)", "value": "03d34af6449b0583e978b04dd7f51ee2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894606, "uuid": "3074bbc6-30f1-4453-aba9-036db1a3c813", "comment": "Malware payload (Mirai)", "value": "19e9996e955cb51e9074774ee44e82e9f6a45b09fa91c8fc93f45806a37c3e25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894606, "uuid": "0f9d1e42-1399-4ab4-9a88-9d9f3e008d7e", "comment": "Malware payload (Mirai)", "value": "2d136ee440dcbfeff4c41ae5dfc94e9ab07c3674", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894606, "uuid": "181c9118-af07-467d-880e-3d35a13f4dd1", "comment": "Malware payload (Mirai)", "value": "b6a89cbb570ff14b43d72c8604480462eb3f119927133d7a24b54e96b7483c464d8223dca16de6aacdac240c84ceed64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652894606, "uuid": "aa6ee3cc-306b-4165-8814-1f09f0d77487", "value": "T11F831846F8818E16C5C513BAFA2E118E331317B8E2DEB2269D14AF2077CB92F0E77555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652894606, "uuid": "0316a888-d0ff-4645-bd16-12f38e31e91a", "value": "1536:2Rnx6mu/B72ccGKj0ATxSaCAHIkgqPDIVFmEiNIXHuWXUnaC4tL4IJi9bXVDdu1X:q6poGg0KxpCtkgcDcniWXuKMaGbXVDdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652894606, "uuid": "438ed931-54e7-46de-bc07-029278d8aebf", "value": 87180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652894606, "uuid": "c9f7bc37-922b-44bd-9ea9-d76853b6c94d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652894606, "uuid": "9e36a519-ba32-41c6-8925-b86287e40ab0", "value": "03d34af6449b0583e978b04dd7f51ee2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51a6ec2-d6c6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652890974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890974, "uuid": "197e5160-72a3-43c3-8cf2-02df4fd742e5", "comment": "Malware payload", "value": "c24377eba559431ec08160dca080cadf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890974, "uuid": "386acb22-8811-4bf0-9b92-062f38047a6f", "comment": "Malware payload", "value": "1a4b65f5f8139713163ae7977f6eabf23541098182f37b3933c86a5a18234197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890974, "uuid": "34a05886-2383-47f6-8264-14c10e24e200", "comment": "Malware payload", "value": "638fb1bed8aba9461d5b30b4e02410de7d06e783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890974, "uuid": "d8c53410-87e0-4810-9131-90889f68493c", "comment": "Malware payload", "value": "726ae9ffca0a2b87b114b131088e669710641f1f41c9c1c1d8ac46871bd1af266e0d9d4bbcedc76f2041b3e578564018", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890974, "uuid": "4eb4bfca-5397-4da6-abfc-c789a8d627e8", "value": "T1D1066D12F248753ED06A4A365C379A94993F77727A229C1B37FC098C4F39940AA3E747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890974, "uuid": "878e1fb5-5c95-4e3a-b181-0677148944d1", "value": "cb836c53c1d6b1c3c3026147131efad7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890974, "uuid": "f9e00aed-2fd2-4603-856e-21fe8e5e1d67", "value": "49152:DFoNSuoi/O05wSv1a2iQ/fuHWJ0T7iTybYiLTgxvY:D+hoid/J0TOTybcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652890974, "uuid": "d9e33515-b759-4019-9676-3a63fd092416", "value": 3867136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652890974, "uuid": "5cc55d22-a48d-4cb2-b9ca-6414834e9a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890974, "uuid": "7163603b-c2b5-499c-9e68-9b1127da4878", "value": "Fact_87011MFPSV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8eecbf-d6b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652884810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884810, "uuid": "e94b993b-592e-49cb-a653-5111015ff8c8", "comment": "Malware payload (Heodo)", "value": "5c30e17f89a68d61aaa236953039dffe", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884810, "uuid": "87deefdf-647a-492c-bcd3-0a109fc9d190", "comment": "Malware payload (Heodo)", "value": "1aab510ce5b280f3d3a5de8d38ca21e743181d125dc7e102f1e97680e38878f9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884810, "uuid": "f1750f01-e050-4df8-a0cc-e9ada7a0e734", "comment": "Malware payload (Heodo)", "value": "8c2aec009f8e8887b32a8900e1f23d49122690e4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884810, "uuid": "df7abe59-4b9f-4ca1-b6f4-52623d938b0f", "comment": "Malware payload (Heodo)", "value": "c844642178b772f0758cba3487be3697f17c51c8c790b57d2c1ffdebbaf434afd0c8107eade5f8dfdb9927b9f82a0302", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884810, "uuid": "610521f9-12a1-431e-938b-ddbccb3955a8", "value": "T17194C04A73A50CB9EC7282798C574A01E672B8150771EA7F03E0875ADF2B3D1A93F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884810, "uuid": "9423000c-a6cb-4a7d-9abb-e4cd467f41cc", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884810, "uuid": "92555af1-ca80-4798-ae30-736a693b4169", "value": "6144:GgIYnzcJxDpmJIyeV2vR3JDEohAEuRfoP1SKL0w+d7sWOQSH0E9cWdb3BHq:yKz+1pcIuvR3lEoeEu+9T0Rd4Hr9H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652884810, "uuid": "95372f2b-7624-4955-b7ff-cab0d39e1298", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652884810, "uuid": "99409d43-baf5-42af-9286-2af065f834c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884810, "uuid": "548f6075-e59d-41b0-99b5-6282d1b91f2c", "value": "5c30e17f89a68d61aaa236953039dffe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ea286e-d690-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652867507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867507, "uuid": "9d4e2d3c-14be-4f33-8343-7b183487d5fb", "comment": "Malware payload (Heodo)", "value": "821cec169e2ef783199d62aa9a85de04", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867507, "uuid": "3b9eb0e2-4db0-42cb-9b00-7d5eb959349b", "comment": "Malware payload (Heodo)", "value": "1ad92f96c502189020ef3224faafbc2306592d8c07b9021c06209fd431526a74", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867507, "uuid": "7dbe1116-7470-4969-ba69-c6c29604acc6", "comment": "Malware payload (Heodo)", "value": "6b20a9269306c9fa34a34a563bf8713edf52639a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867507, "uuid": "ecc9135a-b4ed-402d-826d-273f09011a5c", "comment": "Malware payload (Heodo)", "value": "919a6fcfdddd22c94b57f9b8739e8e76fe22be87697d2e0ff294b726bbd5ad8f185f3a1d372917966a2ca1620fb73e11", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867507, "uuid": "aa242ba2-e1e1-4036-b4ca-72288ba1104b", "value": "T19894CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867507, "uuid": "0a2607d6-606f-4a29-b92c-0a3ccc863054", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867507, "uuid": "c1ba8c3e-2a52-4f10-b329-5afce512ac30", "value": "12288:M3hV6Pw4aT23s2oKd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ni3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652867507, "uuid": "cc85ec5e-3c3a-4398-b1f1-7ae10a75f885", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652867507, "uuid": "370f74c3-ff3a-44f9-89ac-909fee0ea519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867507, "uuid": "68b43359-5cd4-41a2-a04d-6c9d57ef3788", "value": "821cec169e2ef783199d62aa9a85de04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9ad651-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909084, "uuid": "d47d68f5-0947-46fd-b222-9b85af7ee29c", "comment": "Malware payload", "value": "b04f965ac9a8b42abad10595d0e9eca2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909084, "uuid": "3d834272-6e72-4e08-9aeb-77a73bccd6d6", "comment": "Malware payload", "value": "1b7c39ffb0935b037f8dd857e4bdba529a93f2d62e9bd3537c90481fe3313261", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909084, "uuid": "4a4aabc5-579b-4243-9282-fe0b0e4ddd62", "comment": "Malware payload", "value": "746759e26cfbf712fafb914943213d7b8d3dc7d6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909084, "uuid": "70e4455b-afdf-408e-b32c-2f17452f30bc", "comment": "Malware payload", "value": "04c5e496c69af8a5f682b119ce64c7e84564b4ab222252beee7afadea9365bb62098d5c4b81e6cd7691a0e9b17c1d260", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909084, "uuid": "aeaa8384-a53e-4890-b369-35a0d8313c71", "value": "T18AA1E850112C1AB17246597AD26FFA52B50ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909084, "uuid": "7330e6e4-95b7-48de-86cc-aba76960fa4e", "value": "96:muRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:LRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909084, "uuid": "729b0925-d021-4599-a9f9-277bb025c78b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909084, "uuid": "32d88267-7581-4624-805c-45980be8d05e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909084, "uuid": "61b5c690-eaa8-4ee4-a986-8e846bdcad75", "value": "1b7c39ffb0935b037f8dd857e4bdba529a93f2d62e9bd3537c90481fe3313261", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca353dbd-d6cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652893989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893989, "uuid": "b669c495-e4ec-4222-83c0-c7260949e7bf", "comment": "Malware payload (Mirai)", "value": "a67582d12546a7f3a738af9c99c77038", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893989, "uuid": "e732dbf2-1420-4992-90f4-6331ae81b6f4", "comment": "Malware payload (Mirai)", "value": "1cf516ca2cb4b58d236f2cb10a5df0b490d74fa3ed9ca2778c2ff0aeb381928b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893989, "uuid": "2aac6052-c4a3-4f06-835c-f90f80fa67ec", "comment": "Malware payload (Mirai)", "value": "e7d532f50e9db40ee78b97e07fc5b5c67616aa2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893989, "uuid": "3207cc84-4fe7-4285-97c2-2145fd73a663", "comment": "Malware payload (Mirai)", "value": "85f308b594a5616feeb3ba84ea4b584d15d73d7be498f47ffab051824e572f2a929650527b7457be457a21239c2df699", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893989, "uuid": "5efe0004-777f-43b7-8efb-e005d4858bde", "value": "T1F463AE25E0058960C4864238B4E6CE751F63FCC483BB5EB5AAD581AB1447EF8F618FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893989, "uuid": "5a628705-23f9-4688-9feb-eca49f2e6fb8", "value": "1536:WaPtCNOqFLF+wtHRHPhJnID/N3zqwT6UpSCz6:W7NOqFLsyhBZwWUpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652893989, "uuid": "0514a979-12b3-40a9-beba-4716b7ce3ea9", "value": 70648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652893989, "uuid": "bcba281f-bce3-4898-a603-69de27036952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893989, "uuid": "ac1c21b6-a750-4fe0-971a-2dd4aabc057d", "value": "a67582d12546a7f3a738af9c99c77038", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c79a6b3-d6cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652893348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893348, "uuid": "f8bf6411-d1dc-40fa-a194-896719f884ae", "comment": "Malware payload (Loki)", "value": "b6498918dc1dd2ef731f8a25161219e7", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893348, "uuid": "a061cc75-c5ec-4801-adb3-133605b0f260", "comment": "Malware payload (Loki)", "value": "1d32ac49e496dcee5b71620a168f4fa6a9faf3d4ef5addd6ff671875a85c1a42", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893348, "uuid": "1b726d5a-7c46-4187-938a-61fe6d80acf6", "comment": "Malware payload (Loki)", "value": "ee9d6487d60bba93886562c93404148569f0e7f8", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893348, "uuid": "e4023804-b885-496d-aeb3-7532cec43cc8", "comment": "Malware payload (Loki)", "value": "b1378604463381e4c8bf8e26855fd393a607b34f5e9052064b0a1e5ce4b2d37957db4740d5816d7a6dd53c57480746e0", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893348, "uuid": "510b002f-4569-4c30-af14-0c637449d75a", "value": "T193A42354CF5D36E6166C10DE6CEC6FC2E81E22CC565F946858903BCBCA18F4B68AC72D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893348, "uuid": "6e231afb-4c44-42e4-840e-3c024c08428d", "value": "12288:v7GGibgJIrTFTI+E8TZmHooS+DJyI4o/JO5ZUMZVZA:v7AA6TFxEMZmInMJF4eOgMZXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652893348, "uuid": "f64ee859-7784-4de0-9242-34ebbc361d4a", "value": 484937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652893348, "uuid": "29480325-dcb5-47b1-a3e2-d99d0a5a3099", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893348, "uuid": "9b83c01f-7ec1-4949-97f6-80eeaa6062b0", "value": "246563604-Pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e60d76e-d688-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652864092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864092, "uuid": "520a647f-ad12-49e9-b5a9-75deba2bad67", "comment": "Malware payload", "value": "e9de856ff475990bdf0a2f6b00125f25", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864092, "uuid": "a06e834b-8e30-4181-ba56-78e264238a51", "comment": "Malware payload", "value": "1e90781027d464fb9631a233fabe63655727163f6698f9b2357da5b1830967bf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864092, "uuid": "ee5db587-fa1b-4b82-8dd5-2948c680b35c", "comment": "Malware payload", "value": "09c497a920280fa2079499ec657ce9c451d2fea0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864092, "uuid": "b5c32173-7066-435b-8661-c1264f40ad82", "comment": "Malware payload", "value": "86aa64b544d372d3867a08c14a636fa94d6b6f2ed7b29188373ae5721a94cd1e1b40e27986accabe1acebe446bc46426", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864092, "uuid": "7e50d904-b8c1-4f4a-bad3-305a02b8ce0e", "value": "T14E2412D6FAB99001CD9666BC48C4E981FB36EE7BD7049CEB7415394AACFB15008193CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864092, "uuid": "dc898b80-ebe7-4a86-8f7a-a6d896b5e2d1", "value": "6144:i6ph+HB8q6DVu4U4AWRGD3x+ty+bTrwpY:7pYhoDVu1+w3oRvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652864092, "uuid": "29e9bd4e-7029-4f56-9804-24a2bc03e9a4", "value": 229240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652864092, "uuid": "50dc9898-cb23-45c5-b174-4788eb527cf0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864092, "uuid": "996350d3-5677-4f59-a063-6d6d8aba80d5", "value": "Urgent quotation", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02aa22e-d681-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652861276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861276, "uuid": "909072f0-625c-4e16-8376-ec40364ab475", "comment": "Malware payload (Heodo)", "value": "91ce70ab0e181b36ee5af8878634be9e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861276, "uuid": "17defca7-4f8f-4cbd-b357-1b752d42e0d7", "comment": "Malware payload (Heodo)", "value": "1ed8f19269f25b135db50faaaebb107c70d331669216e642802e25c08b364bb1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861276, "uuid": "9bca8279-f4c5-4591-9830-b537f0f8b424", "comment": "Malware payload (Heodo)", "value": "f1f04c5077e20486d57b8b1b05aee02b7a43e3c4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861276, "uuid": "16738fbd-91a3-444e-9f13-86332994a367", "comment": "Malware payload (Heodo)", "value": "8d718c767f7c60920ea68bd3b30a1b2c665ae41279e166458a95ade2bfd26bb343adbe337e50cac17f43980f2d403e77", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861276, "uuid": "e497e975-0072-4efb-81ee-053ef33841b8", "value": "T12894CF1572A50CBAEC779239C9434A06E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861276, "uuid": "cd8e8d78-8090-43b6-b041-334850c8d9e5", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861276, "uuid": "f580cf63-d148-4d9f-a8d4-4fa53ba99538", "value": "12288:M3hV6Pw4aT23s2oRd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ci3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652861276, "uuid": "e9bd7ede-dc74-4c1e-a5f5-021aa286a360", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652861276, "uuid": "8abd88e8-868a-46f4-b2b4-b67d63e19a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861276, "uuid": "e36e9d89-91e9-41d8-9835-399e8dfe0c7d", "value": "91ce70ab0e181b36ee5af8878634be9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee38240-d650-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652840229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840229, "uuid": "e96f20de-a29b-4c28-ba8c-6c4d45a6e018", "comment": "Malware payload (Heodo)", "value": "d264c6891ecc40addcf10576b1b4d94f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840229, "uuid": "c310e6d0-345f-46df-beee-353ed88224e4", "comment": "Malware payload (Heodo)", "value": "1ef4b1134e37fd487401ecb4e43f5c8293e994f9eeafa52389642147a3ee471b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840229, "uuid": "f94bcb5d-ea87-4543-b7bd-6c446ed6ebe1", "comment": "Malware payload (Heodo)", "value": "14f655a521ef5aa0b692f576dab153dde3586cf4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840229, "uuid": "03bb6524-1c52-4827-8ce3-1515f75bc27d", "comment": "Malware payload (Heodo)", "value": "635c175c715765e10e638a8e810f707ab425de1a1c15ff2f82cef1ad59a9822c3b1f2958c669174cd7b16983f90ca9e2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840229, "uuid": "3e4ad955-c507-4f63-b3d7-a4ce69cb52f0", "value": "T1D394CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840229, "uuid": "888efcfe-69d0-4cbc-b4dd-06aa4ff5bb2a", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840229, "uuid": "0d9cebb8-814b-4cc7-837d-3978b9fb88e7", "value": "12288:M3hV6Pw4aT23s2o4d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ji3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652840229, "uuid": "e3184312-d648-4913-bdfc-b24476dcf9ab", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652840229, "uuid": "5b418b59-2c59-4b61-a30d-e7d087531592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840229, "uuid": "4607df8c-400c-4cd5-a305-a4027b19aaa6", "value": "d264c6891ecc40addcf10576b1b4d94f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9a33f8-d6dd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652900620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900620, "uuid": "5a25e950-309e-4d43-b158-0a9f67752b5a", "comment": "Malware payload", "value": "d37ac138e891427d655b95ece97c3cae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900620, "uuid": "7db9a530-953f-492c-958d-9a73a89d65fd", "comment": "Malware payload", "value": "1f981b5fac64ceccc1b11bee4e2b4c0003a1800c265a4447809eda53c48db035", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900620, "uuid": "2a99a5a7-36e4-4bda-8fc4-bbfccaa85ffc", "comment": "Malware payload", "value": "c07f6dbcf452fae5f8dd85c1d1703ea5bf5fac0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900620, "uuid": "4232ae6a-e700-44ca-aa28-b60af983d67d", "comment": "Malware payload", "value": "a35285c6ce53712de8f502790f17f031f883b0ed943576a63c1ded9e7720ab7dbea954428c33ef72697fb10c736272c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900620, "uuid": "3dcca467-496b-421f-9fa1-8b2103ad0bf0", "value": "T16505283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900620, "uuid": "b2164136-455e-4c4a-b429-75f6c717978e", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900620, "uuid": "a94b0496-01ab-46db-a18c-db4f950a35da", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7mmpE3:BTg9UXRD2SeqfZZiqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652900620, "uuid": "8bebaef2-8707-43af-bcf2-fae568c3d5ed", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652900620, "uuid": "7779ae64-a531-49a0-8255-b9a9060a3591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900620, "uuid": "abc24189-9802-4709-90ec-06912647d09e", "value": "d37ac138e891427d655b95ece97c3cae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11e9f89-d67f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652860419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860419, "uuid": "a5c57190-8317-4fd0-8c6f-ee117ca07379", "comment": "Malware payload (Formbook)", "value": "478969edc99bd432e476c27c80ac972c", "object_relation": "md5", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860419, "uuid": "cb26f170-b5a0-4523-ab88-b33ead69f76b", "comment": "Malware payload (Formbook)", "value": "203bfe6c0c5879e5951719fa76fdd9de0343e2652b58141660651d84790310ed", "object_relation": "sha256", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860419, "uuid": "d4f2d5ab-8a91-431d-943a-47daee7eb751", "comment": "Malware payload (Formbook)", "value": "2e60de5a8d559fa2ea71868ba60d63ec54b5652d", "object_relation": "sha1", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860419, "uuid": "02875dbd-56da-4af6-9132-3d54b9ef198f", "comment": "Malware payload (Formbook)", "value": "b008e449972119c5dd7b565e0e7655caeee70ed306dcfb8da8ecd3d1e88396a5821430aab539f32ccd4d20d9dc46b0cf", "object_relation": "sha3-384", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860419, "uuid": "989841bb-fb90-4479-be5a-57e9fc26fdf4", "value": "T117B2520BF79C07AED6ED0E7674BE12700178EFA7B812699078DADE1F15A165C0E131E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860419, "uuid": "f32a4722-41b2-4e32-be2c-40275f384b67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860419, "uuid": "c5aa91d2-82b2-4857-b591-0bc27eb02463", "value": "384:9c1vL+weFF7qbmjWEMsZyaho64XBW55DuW:9c1F0TMZahaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652860419, "uuid": "f3bc93ff-ae4e-4630-bfd1-89925b4e4ded", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652860419, "uuid": "6b3e9524-a481-4f39-9215-7373b2c76881", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860419, "uuid": "d40c67fa-110f-48ff-a333-66cf6020ce08", "value": "AWB-2091647183.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a29e89-d6af-11ec-8e58-42010a9c0032", "comment": "Malware payload (FormBook)", "timestamp": 1652880938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880938, "uuid": "451c3e3a-cdd8-40a3-aeec-833a85474f8b", "comment": "Malware payload (FormBook)", "value": "91ebbf46fb689437665c024e2df7df42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880938, "uuid": "09ae8ce9-d87a-4ee2-9142-b303a48791d2", "comment": "Malware payload (FormBook)", "value": "212a9d67f119355da790e8449b6978f357d46bb671d7e038444ad1eae5995bdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880938, "uuid": "d1335b8e-de2c-463d-9b34-6415b0f06be3", "comment": "Malware payload (FormBook)", "value": "3e81ecad66c7b4d28cf5a177b626564ac20efc50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880938, "uuid": "e41eb652-2a9d-46a4-96e7-134a649b80e8", "comment": "Malware payload (FormBook)", "value": "f9c7fe6e5d3066502c939fb18dbedb27db17e641310338b5aee9dcfcbec9914d8713c182e4f4fed9e5ab31b831477493", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880938, "uuid": "1d565196-cd6c-491f-9855-72a48620b7bb", "value": "T1CDE4F12562A8DD60E96D43FED06251F807716D07D512F74BCFA0BCEA3D363C1861AA2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880938, "uuid": "4204b461-a923-4096-98d3-afd695cc5b21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880938, "uuid": "76c1ed4d-9230-4b25-8395-de265ef81aa6", "value": "12288:mBgT05ZXY7Z7072S9E9bPbgb3hANmbfPJAvmdUBXdJ/M3:m40nopS9E9bPbgb3hAYPJ8mdEXd5M3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652880938, "uuid": "0cd3a467-a3cb-49ec-b6f6-1ae23c77df14", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652880938, "uuid": "40bc7f66-aa5a-41a2-971a-df20114b418a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880938, "uuid": "70425dfb-0282-489d-9fa1-9eed8e13e972", "value": "SecuriteInfo.com.W32.AIDetectNet.01.7358.12992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf73941f-d69d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652873382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873382, "uuid": "6b32be56-8695-4eba-a435-8a02fffee7c4", "comment": "Malware payload (Heodo)", "value": "4836567cd65d10a8fa035e9cabbe3f2c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873382, "uuid": "d0fb2257-5147-4573-8998-c107f4c1ad07", "comment": "Malware payload (Heodo)", "value": "212ecd1500036e5fb37e9da5716f7d0b8a692574bf01d89ddddf06ca63abca52", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873382, "uuid": "79763b20-9340-4b26-8ff7-fbe3284a79f5", "comment": "Malware payload (Heodo)", "value": "b568d0836eb278125d93938251e0f3a9f05dcf76", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873382, "uuid": "8b6522d0-fd91-4abd-9dcf-3e0fe3f8f00c", "comment": "Malware payload (Heodo)", "value": "f2cecd5ca2cf993f824053595a54875eaf9e8e94d7d7e46992444afe41e9225f052cc5917718fa562a3d541e9cebeece", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873382, "uuid": "170bbaf6-0dce-4b55-871b-f3d67b67e3f9", "value": "T1DC94CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873382, "uuid": "b6ae2be9-2cef-420d-8b87-7d82fa228898", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873382, "uuid": "cdbfd4bf-ca48-41d4-86ce-cda92990ab71", "value": "12288:43hV6Pw4aT23GuoUv91Wuwf07EIvH3+38+:sb6Pw4R3GutWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652873382, "uuid": "45cdfc80-e1e3-48d9-8d59-317587e58c0f", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652873382, "uuid": "bd737bc8-2dc7-4273-b164-8d39fdc32692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873382, "uuid": "92f08841-9799-4c8d-8d04-53449aa7216d", "value": "4836567cd65d10a8fa035e9cabbe3f2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4d35ad-d648-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836738, "uuid": "42c28733-4230-41f7-8736-b6567e56f20b", "comment": "Malware payload (Heodo)", "value": "05fa793c49255fb3393f8244150f88fe", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836738, "uuid": "c9c57e3e-ae4a-4408-a100-28d5e1810514", "comment": "Malware payload (Heodo)", "value": "216c628e373a63fbe16858c6be29f12326272d086df33c6f19a5c688b22d163a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836738, "uuid": "720cb38f-06e2-4cab-8a1d-def728e0c949", "comment": "Malware payload (Heodo)", "value": "5723228bb068a29a18c8109f9460d2377ac5fad6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836738, "uuid": "5648637b-027e-4073-b2db-5eb1978468a2", "comment": "Malware payload (Heodo)", "value": "800274e1de281efe9e74235faaa412d4c077c1f95bccef8718fd0433ae8f8df5f30479cf09e4c0382bd94cd5e014f549", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836738, "uuid": "f513cf3e-022f-430c-a756-57ee1ebe844f", "value": "T10F94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836738, "uuid": "d6a02dcd-f80b-47de-af97-625cc13fd566", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836738, "uuid": "ca51fadc-30bf-40fb-ba97-58824637274c", "value": "12288:M3hV6Pw4aT23s2oFd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ci3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836738, "uuid": "cfc40973-0458-400c-ab0d-f182da69bfce", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836738, "uuid": "d7c0fa67-9936-436f-853c-e309b7cb81f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836738, "uuid": "deebd012-2f09-454e-8666-0e9e0118486b", "value": "05fa793c49255fb3393f8244150f88fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150e3046-d68e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652866626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866626, "uuid": "2908dfba-49bf-4363-88b0-2979656e465d", "comment": "Malware payload", "value": "6fd6ee66785c4372522436400099158e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866626, "uuid": "529e2467-de1d-4db5-b021-563656888bf2", "comment": "Malware payload", "value": "22a52e86173df3b4e8f689804da03666d668dcd7cd1c991f9e2bd99f74563409", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866626, "uuid": "15571784-d366-4a52-81e1-124982bab3b5", "comment": "Malware payload", "value": "c46e034ed7115678d4cb05e52d4e2f15a7a0b47e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866626, "uuid": "6a772dac-5992-4c6f-90f9-5a9d13a8e2ed", "comment": "Malware payload", "value": "391025a41e804e26814e6763ae08d0c71e3aa72c223512ef1f75d21d9f96b1c03ecbbd56a2fec7ff2171ab286a7754bc", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866626, "uuid": "c397586a-9739-4a9c-be9b-7ac03763cec3", "value": "T135517D383EDA611CE1F3CFB169D9359ACFA9B973A9114D5D0082030A4D52A40EE92E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866626, "uuid": "1029d538-225f-4123-999c-2beef626bf2a", "value": "48:8m8DnZ7OXU8u0CLAr1teyu5R6fcIPj+4ab:8m8Dn4qMA5U64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652866626, "uuid": "169b6014-6fd8-4311-8376-3345d147d737", "value": 2510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652866626, "uuid": "41453851-b5cc-4acf-9755-34e87c8cecb5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866626, "uuid": "1e067274-7576-4946-9185-9b545b235a52", "value": "gescanntes-Dokument.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce78b0d-d6db-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652899926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899926, "uuid": "4e3f2365-7f19-4a6d-97e6-8916ba086c19", "comment": "Malware payload", "value": "11518f9392725b4c00f3db2d4f4044bd", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899926, "uuid": "0ba9f06d-efb7-48e6-958c-f40a1ff17f5a", "comment": "Malware payload", "value": "22f5ce9d198c8cafc4c69566585e979d14512f430ce952af7ce9b697be73ff84", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899926, "uuid": "ac1c9a82-769c-4086-9d89-596b4dd10382", "comment": "Malware payload", "value": "6342239e2bbdc2664d4d6b8bd0935f86c3f26a16", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899926, "uuid": "90fafb63-3bdb-41b7-b507-7b3abb3b9e95", "comment": "Malware payload", "value": "1fc807523d1bf8952e5e31319effda55b59cd84fc3d010c4f7c39da6b018f36935f6f92b7ae1f2f007975a8c8413ec0b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899926, "uuid": "2a8f7150-6ed6-455c-9b98-6e62b5b52302", "value": "T1D3363350AE795D7E837C532420BF5B0A07B24F81B05CF2CB7692E4D7A2BEF524953829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899926, "uuid": "00c13384-28dd-4d80-a8bc-1d47a21dfcf8", "value": "49152:PTTbo6PLOXHDYhVnnq1V2WcaPr0wWbjyxkczFey7B5XAJ/3T5u/8Q1DKfHjrJ0EQ:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652899926, "uuid": "a7ba44c3-cae1-42a3-9d81-d2fb1183d820", "value": 5291507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652899926, "uuid": "36e2b14b-0547-420d-9c66-0e5839c1d124", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899926, "uuid": "710587e3-fd63-4c1b-b1ab-c2544afacf3b", "value": "2fea514e.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22933ed2-d703-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652916900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916900, "uuid": "4dab0df1-a7eb-4922-9fe8-6c69ad7ab3b6", "comment": "Malware payload (Mirai)", "value": "bed998f57837402eed56bc7f404ecd8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916900, "uuid": "4173f21b-649f-4419-8631-ae702107c247", "comment": "Malware payload (Mirai)", "value": "23a2997dd360b903686930dc7e98ccded7d27d393c33372f2f5d6f78e460e1bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916900, "uuid": "6f9e571f-ec40-4a38-965a-a9dac05a0405", "comment": "Malware payload (Mirai)", "value": "06423b90413cbcc20417d1cd87cd88e987367d2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916900, "uuid": "70ac222a-e5a6-4136-be0f-5158994362be", "comment": "Malware payload (Mirai)", "value": "a5c60cc87939db937922a529e4f035c9ee2405a37d401771d7b83740b7a1a23ef18bc2fbf8792f9f2c8a638736167378", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916900, "uuid": "a157d2a3-05b7-42c3-a7da-f430530512ec", "value": "T1B773A80E6E618FBCFB5A823487B78E20A65833D627E1D541E15DEA111EB034E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916900, "uuid": "02f4d586-bb55-475a-9469-ca51dcdf4163", "value": "1536:YZIJO4rSB6xIqzEIXCRIxuF9IJajZvGIyv:LPOBhqzE2xxuF9IgNvde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652916900, "uuid": "aab66595-a5a3-4015-977b-b8e3fbe8050f", "value": 76612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652916900, "uuid": "1ca7e8a9-6a71-4d43-a2ba-6d88e9065d8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916900, "uuid": "e959fb9c-bdbe-4590-8c6e-b13ffd43247b", "value": "bed998f57837402eed56bc7f404ecd8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06088cf-d704-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652917648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917648, "uuid": "724273ff-044d-42d7-99cf-5e4c681ab425", "comment": "Malware payload (Mirai)", "value": "167f2ed8b5486750e1643afbed04c7b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917648, "uuid": "02403a5a-8ac4-446d-8490-f11764d7bd20", "comment": "Malware payload (Mirai)", "value": "255fdc19cd978bf03b6eb24985e7550819db1677959c3b4ee62606f9ad670f5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917648, "uuid": "1e07def3-3c71-4d89-b9cc-ac58e6a553ec", "comment": "Malware payload (Mirai)", "value": "60e3d1696322cca30ced447d4153a5e13a77d38f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917648, "uuid": "b2507f2e-d274-4d59-bb71-c454843c2d1a", "comment": "Malware payload (Mirai)", "value": "3a738b4fb5ea34a1e9513d83396a2e2a31f5ec359945db07fd45480b9b14348f50efa6bdb95c619840e7727070263fe2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917648, "uuid": "f972c928-d832-45d6-9b84-1c35b56b0686", "value": "T131430856BC818A12C6E0127AF66F85CE3B2123E8E2DF77079D211B6136CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917648, "uuid": "0fe78c2c-4636-4516-912a-15139bc466ae", "value": "1536:FH0Rv9hcS5f76tdOE1gSqwcO8rsxBXuL27PEhFBw:FH09gQ3jQBg27shF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652917648, "uuid": "a3f77dba-0628-420a-b2cc-6ba1281faecb", "value": 60476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652917648, "uuid": "321626f8-83a6-46be-82b7-9d7f6b3c9727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917648, "uuid": "ddc1048f-7e6f-4e8b-841f-845483b5ad57", "value": "167f2ed8b5486750e1643afbed04c7b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622f5300-d6dd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652900686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900686, "uuid": "d9191703-b822-4d1a-a49d-757ab6896ef0", "comment": "Malware payload", "value": "77dc75d13de835d32353d8cb62705685", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900686, "uuid": "bf007756-c5be-44f1-92d3-285a80dcd3e4", "comment": "Malware payload", "value": "25606a0f40abcb914f22cb7afad5a0a426e09c5e4f81884750d09b1e7b19487b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900686, "uuid": "f2420cd6-a07d-4dd5-a2ea-ebe57da9bbc2", "comment": "Malware payload", "value": "b217298d83c987af497b5c1d1d56352bfbc4c8cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900686, "uuid": "3bf124ea-1488-4679-8b0a-1ca8953a3bd8", "comment": "Malware payload", "value": "269e2a821032c0991047c595fc3a715375a3e144006813f9a8b19839a693097ab78d5508b43ee9e7ebecfa41a36e0e53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900686, "uuid": "61080dd9-a82d-4d55-97ca-d23cb9e6af20", "value": "T1A005283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900686, "uuid": "7a5f629e-4e28-4a05-8862-9f79ee9bcdeb", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900686, "uuid": "fd9971c6-3ec5-41e5-8e65-e849fa347f89", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7+mpE3:BTg9UXRD2SeqfZZiam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652900686, "uuid": "81b1d0fb-cb5e-4485-b32f-64d5663b0206", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652900686, "uuid": "96db426a-10a3-4cac-be7f-d4a6f654bc5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900686, "uuid": "75fabfe6-6485-4a8f-b2cc-ce4c43e52129", "value": "77dc75d13de835d32353d8cb62705685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282e019e-d656-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652842607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842607, "uuid": "8e5b2bc9-6171-42b3-9e24-b3824dbed27b", "comment": "Malware payload (Heodo)", "value": "2ff9c94f8e17f5f4de10af3cf3dbbd13", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842607, "uuid": "7c0b67f5-c347-43dc-b1f6-b2edfaa7c7da", "comment": "Malware payload (Heodo)", "value": "26028de18a67380c90cd069913e8be25f7e95da2ee5117fc355566a5a78c086e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842607, "uuid": "8ca187e5-57e7-42fa-85c3-91d429377337", "comment": "Malware payload (Heodo)", "value": "7f40b04b908c4f1e7c4037f12153896e057d4f8d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842607, "uuid": "f9039c6e-891e-4f9e-94bf-a042a3d46a11", "comment": "Malware payload (Heodo)", "value": "8c11e27825d1879355c49bb28f41dccd54f8de39dc6f5680dfa7bd37e6cdce67f7182c885e294e351dd2ca4d070741a2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842607, "uuid": "7118d8cf-6ad7-47fc-88f4-6e03835b6428", "value": "T10494CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842607, "uuid": "76459945-4a90-4b88-8da3-b7cd088d2d84", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842607, "uuid": "3e10d9cc-9ac2-4ac0-9688-c591b57887a0", "value": "12288:M3hV6Pw4aT23s2oRd9zi3BBoNIQ/hsA7:Yb6Pw4R3s28i3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652842607, "uuid": "261222c9-cfae-4164-8566-68dfef6b5229", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652842607, "uuid": "e81b0a7e-6ac5-41fc-b3c1-96c4d0dcc6be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842607, "uuid": "d37d2702-a173-453f-bc9a-23697ce10f0b", "value": "2ff9c94f8e17f5f4de10af3cf3dbbd13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e79e33-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909046, "uuid": "5157a734-3919-474c-aecd-420b2fa3b570", "comment": "Malware payload", "value": "262135ba15ca7b0b1d7f17be27cfad6b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909046, "uuid": "6ddb597f-5e69-4a92-a421-823981157631", "comment": "Malware payload", "value": "268ee7a94b881e4c74ac7dad0ba6390cff2bba6a26c3d29b84fb3558c6f2326c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909046, "uuid": "de89d6a4-6ea9-4183-86d9-bda07b7f2210", "comment": "Malware payload", "value": "94a1e6bc9d3257af8bc5fc54054a81881e0f66ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909046, "uuid": "fd316d3f-2e53-4089-a09f-a855fa1d1c8d", "comment": "Malware payload", "value": "0ed7ace78ea9f1854470f343478f46973dc50b7b35ea8d4efc42a00dd51df00018b8e311ef411a80edf5ea5f80da3172", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909046, "uuid": "87a1c0e0-d05b-4e49-89b7-ccc12462fc1c", "value": "T1A9A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909046, "uuid": "e33c5732-6a80-4cc7-8e01-d093994d1d85", "value": "96:ucRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909046, "uuid": "4ccf9401-c283-47a0-873a-217187d1bf3b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909046, "uuid": "43a9c957-ff3a-4ba7-8c9e-e1782776367e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909046, "uuid": "22f60766-d11b-42b8-bf34-03eb108fe6ec", "value": "268ee7a94b881e4c74ac7dad0ba6390cff2bba6a26c3d29b84fb3558c6f2326c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b9823c-d650-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652840237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840237, "uuid": "51a81459-4a2f-4d99-b5b8-e5b83a911e4a", "comment": "Malware payload (Heodo)", "value": "cd1f799c0978733a8cc7a8399e26a6c5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840237, "uuid": "a19d34cc-7200-4674-b194-190b64638445", "comment": "Malware payload (Heodo)", "value": "26e591a06233fa326cc7eeddc894fc70f4f305b63060734d55d36cb547e1fddb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840237, "uuid": "2d55b441-0384-40f6-8c0d-ceab584309f1", "comment": "Malware payload (Heodo)", "value": "25df7a7a8ee3819a4ad7b438190067273941a5de", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840237, "uuid": "8f006b75-51e0-453b-8f35-c05b3b90c0b0", "comment": "Malware payload (Heodo)", "value": "965b1ee0dcb7a5afcf9c5d017ea9ea5aa6730914aacd673c99d282a9e4e1296e364df0f7b05dcd913cf664839599c98d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840237, "uuid": "2350d158-483a-4514-b4c1-4d4a88ea234c", "value": "T15294CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840237, "uuid": "9dc97d8a-c025-4b09-839a-e5357b0b71ce", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840237, "uuid": "78c5f073-53f6-4100-b74e-5ff871690bab", "value": "12288:M3hV6Pw4aT23s2oVd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ui3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652840237, "uuid": "f50975e9-4f0b-4eda-bbb5-aa813236a6dc", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652840237, "uuid": "9bf57bdb-8354-44fa-b98f-aa772f372a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840237, "uuid": "6e275888-ee19-4b49-989a-4ead3f100834", "value": "cd1f799c0978733a8cc7a8399e26a6c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9251dc32-d654-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841926, "uuid": "92fe55c1-3176-4bdc-aee8-7d84bd1be25b", "comment": "Malware payload (Heodo)", "value": "3b09d4668f2025684d356ddffbaffe3c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841926, "uuid": "503bde34-83ea-4a11-bdd8-c5b694d766d7", "comment": "Malware payload (Heodo)", "value": "27586a4aad2704d022f7789c0d8cf4ef87b2074822f53057d7adecf3cc2e29d6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841926, "uuid": "cac7c4cb-94f5-4f8f-870e-0b80ee1368c3", "comment": "Malware payload (Heodo)", "value": "002a6dfb33738d2b2ca9931eccd04bead835a8c2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841926, "uuid": "7c99a5a5-a1ea-48a7-ac85-0a9cf3ed6a16", "comment": "Malware payload (Heodo)", "value": "d2d545dfc32d1c02e7a3b420dff05b004658de00cbb445f493d00c675981f0fe0114c5f8028c1d8e700be1ae3beb41ee", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841926, "uuid": "7aab4e5b-5e51-4b19-9e85-6aa0641c784f", "value": "T1D7A48B4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841926, "uuid": "b504d016-e849-4dcb-979f-30f5842a5359", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841926, "uuid": "4c045913-8e3b-4e49-8038-8d58952b12e8", "value": "12288:uS4BnAed8BK2o0aja5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKWa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841926, "uuid": "37998a0f-2190-414d-8a06-7d15b6ccc1cd", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841926, "uuid": "29a065e7-1f7c-40e6-a19e-b0a08bd41910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841926, "uuid": "bb3fbc0c-81c9-48f0-a6b8-8589e24c88d4", "value": "3b09d4668f2025684d356ddffbaffe3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd4845c-d654-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841888, "uuid": "47bb0bbd-ef0c-4119-90ab-bed1f6218d54", "comment": "Malware payload (Heodo)", "value": "47091a1ba9f27cbde8c6c2deb4d71c9d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841888, "uuid": "5a0b56ee-a8d5-4605-b6e8-09e1457088b1", "comment": "Malware payload (Heodo)", "value": "2796e1a27e2676e75d2372ea4e99fe5a1501683dbdb0dc09e77556661f83dcbb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841888, "uuid": "c72d56dc-e08d-4ec2-a962-84156413494f", "comment": "Malware payload (Heodo)", "value": "2056e59167a611e426a216048f3d79f1db3abaf3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841888, "uuid": "abe94390-814a-47bd-ad63-1a09124a4b10", "comment": "Malware payload (Heodo)", "value": "d17421b391f105289e28232a5201af02dd2effd058f17b0d1c0177e2c9ae69c2f48ffc244d25dd77271c6bffa059ff41", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841888, "uuid": "5a24c0ad-9d23-44db-8a58-1da24ef7a89f", "value": "T199A48B4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841888, "uuid": "a143f5c5-adc8-4745-9d16-3a00de92ac81", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841888, "uuid": "470cd02e-c8c8-43fe-be4e-a8e8ef755916", "value": "12288:uS4BnAed8BK2o0aZa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANK4a34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841888, "uuid": "fa7afa08-20e0-4192-9c98-be54895ed693", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841888, "uuid": "cf125456-5df4-4fd4-92de-7a459d895f16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841888, "uuid": "f32e6bf9-868d-40cc-bf06-e342c2ca415b", "value": "47091a1ba9f27cbde8c6c2deb4d71c9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999f26db-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908939, "uuid": "416684aa-923f-497e-8737-a370cf8d698f", "comment": "Malware payload", "value": "977fe49593f62a0597f1fabda97a540c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908939, "uuid": "bb58a1ab-184c-475d-b187-206e951339e6", "comment": "Malware payload", "value": "2806fd2d2fd44fcc07fcbb4e5255fcc2742b49b329bdf097cf5bd0b91a1135c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908939, "uuid": "c2b62ae3-1726-48a4-9a1e-62f91aae2e33", "comment": "Malware payload", "value": "8b929659b841e22a2f5fb385e596c6ef27695cea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908939, "uuid": "212f6dbb-32b2-4177-a496-f7d79a16839e", "comment": "Malware payload", "value": "81d3f25de31a67b77ff93aa3352963006119c1718203dc5413723609c9e3f8bb5e17fa00ab85f831891100fd6538bc8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908939, "uuid": "cd9798df-1a37-4142-8491-d01bcc32677c", "value": "T11F21FC0DE24A2D4FD9A7217C145B422B74207619F4238413E3668E3F3E3B1D4121E18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908939, "uuid": "3a423c66-367a-43d5-acab-52b0cc7ca37d", "value": "24:3R7Aa8DzSWPpbP78Pwy74+CiCTHRhH/JTiD8ECAfGUiox/03NT1XWQ:lApP3hb/mkTRhfJS8DAfm93NhXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908939, "uuid": "53f49100-7693-4aef-a5be-8aaadfa8e210", "value": 1236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908939, "uuid": "6e4eb089-319b-4b45-84dc-4381f917266c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908939, "uuid": "d17c25f5-0ad5-4563-8702-a9aeb38db3f3", "value": "2806fd2d2fd44fcc07fcbb4e5255fcc2742b49b329bdf097cf5bd0b91a1135c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3717df3a-d6e1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652902332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902332, "uuid": "1ead061b-7e64-4394-b943-92bb3f3ffe8f", "comment": "Malware payload", "value": "a4f7e45bc5355e224c9103bd7d31901d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902332, "uuid": "799f4e0b-037e-4a54-8f5d-67aaa4773fce", "comment": "Malware payload", "value": "296e0c7f7e884b4e4c87fb076df5f3acd41f09499614c28f431bb80aaf74be5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902332, "uuid": "3f5d4023-3780-461e-9d7b-4615a5121642", "comment": "Malware payload", "value": "1038eecc93703ec40bf750e67514e37693561e1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902332, "uuid": "28f7e4aa-7c1f-49ef-890b-340636cb55f9", "comment": "Malware payload", "value": "98d79f3a598a693b81b0eef0b27471128e0a48c05ae7ba7ee67091090fe029d902a7c08989cef3dbae5a068c446381e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902332, "uuid": "f8b8a8d0-6c14-42ab-9118-c7793bc57410", "value": "T12905283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902332, "uuid": "1e83fc57-69f0-4fa7-b390-da6cf2cf0f23", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902332, "uuid": "d52c9d84-4282-4f39-88e2-ac93dd3b39d4", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7ImpE3:BTg9UXRD2SeqfZZi0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652902332, "uuid": "2593a8d4-abb0-42f2-a6e2-cc36d1932128", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652902332, "uuid": "79e3a459-bada-4599-a2e5-c1d82a9590f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902332, "uuid": "edcca461-163b-49d6-9586-2692dafc9152", "value": "a4f7e45bc5355e224c9103bd7d31901d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac1d4fa-d6fa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652913156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913156, "uuid": "80877e35-b1e2-40e6-aa7f-a960847b950a", "comment": "Malware payload", "value": "943e6aa650e7aed223b5ba62ec74c01c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913156, "uuid": "ab6a00fb-aaf0-4cf8-9d90-6a1969c04d51", "comment": "Malware payload", "value": "29950f41687b112e2a061fcb1f73449e804afc9531d879eaab0ab3c03134a570", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913156, "uuid": "77d4767e-977a-4618-9db1-311babece04a", "comment": "Malware payload", "value": "46b174894031dde159a6f12fbad63a2088cb40bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913156, "uuid": "44c79891-91c3-4b1e-9d8b-a8d6c733f43a", "comment": "Malware payload", "value": "c27162dbdf319393a04a7c31a905d80b11b954e50e1e62bbb3a2583b72fa998058e87bee55a48d279c6baf3d2f66c686", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913156, "uuid": "d6f27468-c054-4ec4-9575-6bba16e76049", "value": "T1FE85F50D3E709D04D3A935F6AEE20790D6B99D4E4B218B0A6E7F36547432243ECDB25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913156, "uuid": "31f771c6-0631-4fd8-bb13-8d4ef5465028", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913156, "uuid": "23ba8a61-0ec9-4b6b-9711-271424a8dae7", "value": "49152:lP3kqpqW2awyouylqryB1AergA3m3Dzs3FtRA1VjabE68Glyyb4mXfXsR59N+qYi:wBXwyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652913156, "uuid": "f5677b6f-3540-47fa-9ac7-6e635d8cf87d", "value": 1819648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652913156, "uuid": "4beb8297-104d-44e0-8ad8-c1ad53821ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913156, "uuid": "7fa8d584-3197-4500-a7af-d49f834f9dcb", "value": "SecuriteInfo.com.UDS.Trojan-PSW.MSIL.Agensla.gen.28803.5293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64e28d4-d6e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652902948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902948, "uuid": "3ed90310-5df2-4b7f-88b5-fabcb8f80304", "comment": "Malware payload", "value": "ee8a86b157d394079aa8fe3480b98a26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902948, "uuid": "cd6ac5e0-b7dc-44e8-ac53-17fd0bcd5f4b", "comment": "Malware payload", "value": "299709b32430a572f7427f759ebd8ad97c39e69cacb44c952761c84dd5a6a0c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902948, "uuid": "bd29c5cd-529a-4ed5-a0ac-05b41d8eeca3", "comment": "Malware payload", "value": "4814a10dad121eb1e968e57cfad69c16337049f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902948, "uuid": "4f38c96c-bd4d-4ce8-afe7-5dcfce14ed70", "comment": "Malware payload", "value": "a92280d0c2923bc78958595316a024b71b0d0e967a6b1195d463528a8a8c388dbe15e38d43e12f6788f941ae9f37cc09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902948, "uuid": "a39f09cb-ed7c-4ed5-8c27-995ebece2f88", "value": "T16E05283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902948, "uuid": "be7701a7-13b9-483f-a796-ca378345799d", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902948, "uuid": "8a7c40f1-444f-47ab-a19f-0db3657515b4", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7RmpE3:BTg9UXRD2SeqfZZiVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652902948, "uuid": "50b6116c-d362-4cf8-a7f9-15097a226fe2", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652902948, "uuid": "af95d1e8-cedf-4491-9d2c-691ed13a2261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902948, "uuid": "6f607acd-88b1-4ae0-ae48-13348840467b", "value": "ee8a86b157d394079aa8fe3480b98a26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db48d289-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909050, "uuid": "705e113d-9e60-4146-ac5c-df98a972c2a1", "comment": "Malware payload", "value": "342d3cbc078a71a67ef44d39a8c31332", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909050, "uuid": "b955582e-6d93-488b-a049-96d7c8f48b8b", "comment": "Malware payload", "value": "2a30a5a159e3369d6e328534348928438a32934c141ca16e04ea3bf100655a15", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909050, "uuid": "ead775f7-79d7-4e1b-85b7-6aafc5aa569c", "comment": "Malware payload", "value": "52ea19fe2eb28ee8094304325db8ba758255bc73", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909050, "uuid": "eb1db665-6e0a-4e4c-b6dc-7e0fefbd5503", "comment": "Malware payload", "value": "164336aaa7065fe53f5c19c86197dc7d087650198ad4826c7aa5aa31821de5e1b1d5611fa904be11558224f459f63fbb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909050, "uuid": "765210c2-1363-41c6-bdf0-77ff69f13fd8", "value": "T179A1F850112C1AB17246597AD26FFB52B80EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909050, "uuid": "29e538df-7033-467a-ae74-93b606607f09", "value": "96:/RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:/RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909050, "uuid": "a49885f3-1fb1-4820-88f2-72220b39699b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909050, "uuid": "1ac860c9-4de4-4a61-b112-ac4c8f9180c4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909050, "uuid": "3f6e78f3-7801-4868-8fe6-309388cd0646", "value": "2a30a5a159e3369d6e328534348928438a32934c141ca16e04ea3bf100655a15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d8afa9-d6cf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652894783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894783, "uuid": "a6a11aeb-72b1-4641-b17f-97ffce67652f", "comment": "Malware payload", "value": "fefcf4eedb91424c400953b90f14161f", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894783, "uuid": "176bd96e-12c9-436b-a8c2-de835f6bcc39", "comment": "Malware payload", "value": "2a3946cdfa41774f06c7aa40ed72ceb52e1e5a155027b503d15d0cc3f9468b1c", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894783, "uuid": "f4704b84-e0ee-4dfa-b0ec-3a2a008b202d", "comment": "Malware payload", "value": "e7fed4ba3a0196be67d98ea7043ce064e179acf9", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894783, "uuid": "587be472-d8ad-497e-8c0a-7a28dc36d9fa", "comment": "Malware payload", "value": "e0f75fd10405aee1da4053bf5ba4deb1c1f4bc0739db55be54e7bca97eb3e081569b609c5984cb5a283969de259bf97d", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652894783, "uuid": "40ab5495-4697-4ec1-b04f-1f5eb00197bf", "value": "T1C4D4AF22E3F04833D173167D8D6B676C982ABE513D389DC66BE41E4C5F392813A26397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652894783, "uuid": "f17b3384-48e0-4f99-88d9-6a57c7ae7c92", "value": "ff450e39c2143a90380d4f56a4259383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652894783, "uuid": "80a93862-c655-40ec-9a75-803597c9c4d9", "value": "12288:SHppWamOEUPrsLSyyGq5FXllT1/BI8VwSi9NJIksifQuVS:wsdeQLSAi1qMi9TgiJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652894783, "uuid": "70366894-d7ad-475e-b512-d57606e50c1d", "value": 633984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652894783, "uuid": "3ec4ded5-fdf8-4be2-b96b-6ce181c989a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652894783, "uuid": "0d5f4464-4e89-435f-8eb7-f0da5b5b5d53", "value": "2a3946cdfa41774f06c7aa40ed72ceb52e1e5a155027b503d15d0cc3f9468b1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5e3a80-d650-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652840198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840198, "uuid": "2efd81c6-9fe0-4946-a13b-9dcbc1d852ba", "comment": "Malware payload (Heodo)", "value": "69427ba82bc61dfca48c2a2964bbee44", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840198, "uuid": "ea9906bd-b615-4e35-98c9-7322bc676843", "comment": "Malware payload (Heodo)", "value": "2a6794f3abecd59a72153eb6de3180bbf7750bc11742717394249f29a4629c98", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840198, "uuid": "f04073a8-477c-4c4e-8b35-06734539de67", "comment": "Malware payload (Heodo)", "value": "39056bd9a221dc60a1abc7425463094cc94635f6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840198, "uuid": "61488c2d-ce73-4231-b2b0-34b8db220f3f", "comment": "Malware payload (Heodo)", "value": "38e8146648eef76e1c9cd29051c6abde3ffc895c51a626b257e8c7ddcac0bbf79b845e67073edfa5805fc25ec4143924", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840198, "uuid": "f7e18feb-63dc-4659-92b0-7f68c37ee890", "value": "T11594CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840198, "uuid": "3435a022-7d64-44f1-a8bd-2f1b1cba5067", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840198, "uuid": "63022060-2df6-4202-bad8-ddb2828315f0", "value": "12288:M3hV6Pw4aT23s2owd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2bi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652840198, "uuid": "84af64f4-51ef-46ed-b1c2-f5ccc8c2acd2", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652840198, "uuid": "df317a66-b21f-4bd4-99e5-b1a28ad21976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840198, "uuid": "aaae5a65-7d8a-4fd3-8c44-beca1aca9008", "value": "69427ba82bc61dfca48c2a2964bbee44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7d4274-d6db-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652899957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899957, "uuid": "f050b165-d94d-4a25-8b5a-d057e1ffeb1c", "comment": "Malware payload", "value": "2ee5994bfd2523dfe5d1aa29b3af655a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899957, "uuid": "47a968b3-8005-4bd9-affb-6d6a05b3d6dd", "comment": "Malware payload", "value": "2a835fddb9dffbc52f7526a752442a9cfca7b4cd46cd714d8de60f2cd3e74ca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899957, "uuid": "c4283e2a-ae3f-46ec-bacf-d65165283684", "comment": "Malware payload", "value": "3ac598359b00f95969ae42fb253f3380126e55a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899957, "uuid": "b5925d54-05a2-4001-9528-fce0f40e7dc3", "comment": "Malware payload", "value": "fe9b75efddb0a3f0454eaddc3ba89113fc98a3f8bfd2468191567fbb766c7b56e7dd5934dfc25c57fa7eab0c4f9c371f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899957, "uuid": "597ec80b-16a1-4991-9192-3d57a3ed319f", "value": "T1E805273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899957, "uuid": "d04dd0f1-80b6-4d15-ab09-168543276c01", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899957, "uuid": "c742701f-bdbc-47f5-81c6-eba80d6a4889", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oOaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy70Ust", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652899957, "uuid": "581b2286-dc82-4e5d-a684-c09916ebe2d8", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652899957, "uuid": "bbf48a08-dd0e-4c34-bfdd-a886e01964f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899957, "uuid": "afd7fb72-0f20-48ee-a9ca-bcd1bfe13f1d", "value": "2ee5994bfd2523dfe5d1aa29b3af655a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47adaabb-d6a8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652877878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877878, "uuid": "78b0a201-2205-4404-89a8-37a5fea4f194", "comment": "Malware payload", "value": "459fcc4d01eef99ce7cee1eec1ee4f64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877878, "uuid": "3616c689-9584-440b-ad4c-6954a6e81436", "comment": "Malware payload", "value": "2aa8f6347e3d331950c557528790162d59d5607fadbb111e1cefad5a34ba6cd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877878, "uuid": "92f2bfd9-d314-448a-b4b4-2797dfb3b369", "comment": "Malware payload", "value": "3e193ae98ae9338f33261a42c4d200f1441ae683", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877878, "uuid": "be3d5961-d74a-41c9-85d5-9e4dbbc0a708", "comment": "Malware payload", "value": "bf9336ab38193a8270dd98e1e3587f8b1d21e25e1db37f83b634469ea4cf99e5ac88d10014ef2a168bb61dcce6fadfdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877878, "uuid": "703c2051-5e94-466b-834d-c061df36e643", "value": "T1A1B23F3193878524EDAECE37DC6252BC46EDBE038862D67B14C0FF8D7971E42C6A1664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877878, "uuid": "52075e94-ba5b-4c99-8874-dca1ac7f4023", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877878, "uuid": "b365f376-1723-47e4-8c06-fd3fd361e8b2", "value": "192:HZuHKDx4YIWuHbubLMeTkB5Gxey05rO3dxAvvuxMsH:H2C4YIFuMewGxey0lY/xMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652877878, "uuid": "9ed0d023-652b-44a4-8990-85af0de3a20b", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652877878, "uuid": "d1fe4190-a1ed-4e3a-a458-46f1bca1fced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877878, "uuid": "ba725b66-c254-4649-956f-f8763d074c58", "value": "SecuriteInfo.com.W32.AIDetectNet.01.11379.29753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56d904b-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908986, "uuid": "29d76cc1-847a-4f28-ac93-ad0bfe54f463", "comment": "Malware payload", "value": "c0ef6f37f3e0cf5fe50ef77204f9527b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908986, "uuid": "db35486a-1f13-4eed-82de-8ae733ce5b20", "comment": "Malware payload", "value": "2ab0ebff8c1a3a533e6bb958dbab995387e259b881e397850e5e6e3d50f4614b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908986, "uuid": "2db3ca27-7ae2-4fb8-8553-59fbf5f1169b", "comment": "Malware payload", "value": "19d41a23a057931b1cd9175da80e496257816128", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908986, "uuid": "345ca2b2-5938-49b0-8741-326214260908", "comment": "Malware payload", "value": "81555a54f6c785cf4da6aaccd07f8cbd35c38a8d7a650a5627fdd418358abe9d15dbc5f305d4eb46b2b75b6b03925836", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908986, "uuid": "47ca2f64-eaf9-4283-ae2d-3373fafff45d", "value": "T18FA1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908986, "uuid": "296f8a35-0fc5-40d8-9277-7edbc422fbcb", "value": "96:eRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:eRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908986, "uuid": "2016ace1-3320-4d16-a182-5cbb2a789f3a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908986, "uuid": "29e9eb57-8d07-4500-8a6a-83ec586ba3d5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908986, "uuid": "bb7c0c0f-704e-4505-896f-d29b6b99c539", "value": "2ab0ebff8c1a3a533e6bb958dbab995387e259b881e397850e5e6e3d50f4614b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8616984f-d680-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652860803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860803, "uuid": "007d29ab-17df-4936-b4e2-37a9c5fe1dcc", "comment": "Malware payload", "value": "1b9019cfb5ac0830ac629b81c3b96aff", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860803, "uuid": "a99757af-57d8-4f56-9b6c-e0842064f542", "comment": "Malware payload", "value": "2adb0e66ffcb01ce3d105fa895a443199497e58b40ba4ed3cdd7fb5543c0130e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860803, "uuid": "225557e0-3a28-4859-9474-ac37a7f0f85d", "comment": "Malware payload", "value": "9fbad5e44290981ff544df7cf6d2f8ddffb1f8af", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860803, "uuid": "c8bef4fa-d7ab-40fc-8507-317ec9b5bf80", "comment": "Malware payload", "value": "4651ea5886041c2149045d84c05f04797f2bd5dd9d0aaa48ad881e8e4003e1fb1bfb77cdaf796a6f76499e06e4328a95", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860803, "uuid": "22350b2c-bfcd-4f3d-9a54-d9a70c726f93", "value": "T15994CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860803, "uuid": "e8dc3e2b-b56f-4e14-9d28-0f0c3e5c5d96", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860803, "uuid": "1a91e850-1ae8-46ea-8dce-5e49d49f8d49", "value": "12288:M3hV6Pw4aT23s2ohd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Mi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652860803, "uuid": "17d86a10-d22a-4c57-9c44-ec1ab1e4b8de", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652860803, "uuid": "885a0050-01c9-4f54-b81c-c392b71d4961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860803, "uuid": "d26843f6-5479-47d9-9215-cd6dbd3f48dc", "value": "sqZBrjH08bgiUkcR8e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e92618e-d6b7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652884440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884440, "uuid": "5d007c09-a74c-4eca-b758-211d71ce3f5b", "comment": "Malware payload", "value": "cfd355ae404e723dc2a7e71ab57221c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884440, "uuid": "2de16916-9d26-45e8-9e7e-d297cf1e3229", "comment": "Malware payload", "value": "2b105c4bdab287cb2178a3a14629a778956944e2c329a858726069ee2ff0436f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884440, "uuid": "d6a530b2-8b4d-487a-b702-61e0128601be", "comment": "Malware payload", "value": "29e8f9e608ce8ed04df62a0d8e3de121ce0c529a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884440, "uuid": "4756e678-5ae0-46ad-95ca-3899de21f86f", "comment": "Malware payload", "value": "d71e3228504a519e2b9c1c35f535a37b7e63184038d7b2065f197ccfec9bc58e568b185ffc1674679cd1089d79e76c15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884440, "uuid": "8545bb0b-b418-4c7b-b2ec-99c2a745e89d", "value": "T17086330B9988FB9CE1EA7CE50DDE33D5DF9F287AC55051130E262C03A24799826DC96F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884440, "uuid": "d9176e11-37e0-4906-bc79-340c8dbc2ff2", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884440, "uuid": "9c8ccbef-02e0-4ec0-b54f-5d75ca6d7af3", "value": "98304:4xl+KoLV/0mikF8SDBgPxPRwaTi8NS/6ulxQqk9lAJyIGWwuB0Va67FfV:4ULV/09kKoCRO8q6OJyIGWp0s6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652884440, "uuid": "d9e8de4c-75cd-47e7-945c-ee4c9e64be81", "value": 8444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652884440, "uuid": "10959f99-804b-4f91-ad9c-be4a3aea461b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884440, "uuid": "af9c2c30-7fdb-4305-bb40-e457cd1da3f4", "value": "pphud.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd91b73-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909030, "uuid": "e5b79a65-d506-407c-985c-4bd46bf18203", "comment": "Malware payload", "value": "914da31530e5cf47cba338458c9ddbb3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909030, "uuid": "1270400f-abe6-4fb1-b1ed-48a4ff2070c4", "comment": "Malware payload", "value": "2b2f76c5652a08a96ae1b61dd44889a16a197b97047f8929038959a3c9d77e07", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909030, "uuid": "5cbba52c-690e-4e2c-88f3-9fbdbd4562cf", "comment": "Malware payload", "value": "a8631e082df6de6273cdacac9cdf09265faede08", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909030, "uuid": "e94bd96a-7c51-48fa-a503-9dd009ba04b1", "comment": "Malware payload", "value": "49a51946c9e094ab7c9999c999b5949d668ac11c9e8ed8f571f75ed90ecc62d874e3471d6285d6254423d0942fdf2678", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909030, "uuid": "59c6b8f7-d47b-4287-991d-7f45c60c45fd", "value": "T156A1E850112C1AB17246597AD26FFA52B90EC82B0A7B7B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909030, "uuid": "955252ff-d9e0-4f15-bfe1-91e56275e857", "value": "96:PRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:PRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909030, "uuid": "eaed616e-9174-4351-bde4-fa8487b6b801", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909030, "uuid": "1f1b3374-4e35-4617-afb5-2096611f685b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909030, "uuid": "ee870661-e4af-4c84-be8f-2f58a866e1e3", "value": "2b2f76c5652a08a96ae1b61dd44889a16a197b97047f8929038959a3c9d77e07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db67900c-d672-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652854933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652854933, "uuid": "c63fb943-7125-47af-8d42-6dee2d7ddfc9", "comment": "Malware payload (AgentTesla)", "value": "b5680d05c29db4aaac268573cd17a09b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MX", "colour": "#063C0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652854933, "uuid": "15d50a6a-9872-4c78-ac0a-7a1f6d9ff650", "comment": "Malware payload (AgentTesla)", "value": "2b3f4cc38db496db9fb26595087296fb5d9c0fe1114353ea8ffd8d4be1d5e4c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MX", "colour": "#063C0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652854933, "uuid": "c293eac7-1dbb-4b0a-9c2e-cc99f40fb432", "comment": "Malware payload (AgentTesla)", "value": "ac7706d6bad227adb8259aed7993febf85b87ed9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MX", "colour": "#063C0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652854933, "uuid": "aec74a40-684d-4ac1-914e-0f037e918691", "comment": "Malware payload (AgentTesla)", "value": "d9852c58795e80a4d1a0ba0f0bead531fe0a2b4173a3f7b4a0dc39ddb202a94ce53d416acdda25449e1c3debff799d07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MX", "colour": "#063C0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652854933, "uuid": "08071152-a50c-44d1-b24f-f61c4f01e019", "value": "T109C38E5932449361EFAE8B3565BF87B61FF87D0264E1DA6E7180B60EAE733509012D33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652854933, "uuid": "94044abb-e596-4511-8eef-46c474419c95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652854933, "uuid": "6b05c74b-cd2a-453c-b6a7-e65ec7c21af4", "value": "768:vFmsjoPUch/ZnAsONTpHl7M8+IGWM+mTHJblUsN:vFPj8AsgfzMlTDUsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652854933, "uuid": "70c1a418-c9f5-4d17-b5d3-b70c37aa7aa7", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652854933, "uuid": "fee1add3-347e-4078-ada8-6d1987a0636e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652854933, "uuid": "ae86abb2-2826-43bc-9556-435d01f4550e", "value": "Ffzhofyh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add777c2-d658-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652843690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843690, "uuid": "9b67a116-6825-4fbe-9121-88889ce47ec7", "comment": "Malware payload (Heodo)", "value": "2d1de3ee7d881a712854493beae991ec", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843690, "uuid": "ca646682-cb12-4a1f-9a2b-732005b07cfb", "comment": "Malware payload (Heodo)", "value": "2b785891792ceeba6ced01ad4918799e336c26f3a86ef14d21061e1a3947a823", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843690, "uuid": "3b309446-ab1b-4cdb-b101-013d84f8b216", "comment": "Malware payload (Heodo)", "value": "3aae2336e6d6ee00a9b6aa062e8cba1408aa504d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843690, "uuid": "bdab85b9-4d23-47f2-b5fc-a2dc9ed38f28", "comment": "Malware payload (Heodo)", "value": "0a4e1311b1f3bbd5b786ddd571129da27d504e0760728557e1d9a2d55ab24559ff9d9cdd0160c93449f2997fa705a444", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843690, "uuid": "0771a64f-2c6c-478a-8488-1f159657fe75", "value": "T19394CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843690, "uuid": "196a8c20-1015-4b89-b84f-6f65555703cf", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843690, "uuid": "8b487ff8-4907-4393-bc5c-56f5c3a1e6de", "value": "12288:M3hV6Pw4aT23s2o9d9zi3BBoNIQ/hsA7:Yb6Pw4R3s28i3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652843690, "uuid": "4697ff73-c86e-4e34-8464-88a7ea932c4f", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652843690, "uuid": "974d4d0e-d170-459b-8a19-6c83bb682f55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843690, "uuid": "2dc91481-83cc-4c1f-9b7a-1017d3f04088", "value": "2d1de3ee7d881a712854493beae991ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c451c8-d646-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652835845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835845, "uuid": "e896d73c-9d84-498d-94ab-7f8ce803c685", "comment": "Malware payload (Heodo)", "value": "ca399c7a4532124bd8fa5e45582febcf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835845, "uuid": "d98551e2-c617-42b0-978e-c0122ce366f1", "comment": "Malware payload (Heodo)", "value": "2c2fb92f819eb48603d5d1c10f09f833eabf466fcf1cbe7a9443fdff96c99595", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835845, "uuid": "6dd4c041-b6c3-47d8-87bc-a9e1c40b629a", "comment": "Malware payload (Heodo)", "value": "780c3bef812a6ba5727e79eaa1805f7b0c359a86", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835845, "uuid": "d21fcc6f-fabe-4eb6-ab17-3351783b1036", "comment": "Malware payload (Heodo)", "value": "3d44a51d69abcc301aaa2d833c4e061caa7f508e1259174ef5779934249e45d36f154a57398ca7d1aa34f370bcd399af", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835845, "uuid": "381be3ba-5680-492f-87b1-84f57f328001", "value": "T12C94CF1572A50CBAEC779239C9434A06E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835845, "uuid": "074cbc9b-8f5b-4c52-be95-f2d6be593191", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835845, "uuid": "5c6a0a13-b600-4009-bc2c-6ccd285ddbbb", "value": "12288:M3hV6Pw4aT23s2oPd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Oi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652835845, "uuid": "339a2380-208b-49c1-aef7-7ef7fdaa5bec", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652835845, "uuid": "0e6b7f53-f081-4f0a-a9e3-a79c0e2662a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835845, "uuid": "611a6f7f-0856-4bff-8aa3-8a246bfa35d4", "value": "ca399c7a4532124bd8fa5e45582febcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373e2a04-d6fc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652913928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913928, "uuid": "6826e02d-9305-4b5a-bf40-04831dea93bc", "comment": "Malware payload (Mirai)", "value": "52269e46845d325ad8f0b7774e5ca3aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913928, "uuid": "6ee7aff8-f688-4d83-bc83-81a78b4dd3e4", "comment": "Malware payload (Mirai)", "value": "2c822cd7fc0baf824a7322fa063553649040ba5bb2465235ae894792f6dd83e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913928, "uuid": "4add6dee-0a90-4a06-9f58-46c5c9bc0eb7", "comment": "Malware payload (Mirai)", "value": "cb6a76d100baadd44dd908060d96c12bf579f9ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913928, "uuid": "3aeda3b0-ce51-4faf-be53-d8e834f19799", "comment": "Malware payload (Mirai)", "value": "a48570fee82b47fd4b441592f6c60eb9b854ef3270a867ac8788d92b8f5f63161d5f200512f164f563d563cde7e036e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913928, "uuid": "e92a02b6-51e1-4c20-b8aa-2f1012e9d996", "value": "T153D34B46FB418F13C4D617BAF9AF424933229B94E3EB730649285FB43F8666E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913928, "uuid": "5b797191-bcf4-4b0f-8cd6-25d6c41a2c2a", "value": "3072:f0DvinprSHrDqtVghB3RJxQds/neqfasb2mKM/9M/zrr:f0DvinprSHrDegZJxQds/eqfb2vM/9Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652913928, "uuid": "941983ef-286c-453f-80af-23fc4f8b9938", "value": 134572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652913928, "uuid": "2e2b34f0-45d6-4e9f-ab36-372437f1af61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913928, "uuid": "41cf561a-701d-44f0-8dde-e5da0599e83e", "value": "52269e46845d325ad8f0b7774e5ca3aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944f5b51-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652858679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858679, "uuid": "3e148f61-72ac-4dcc-832d-21f07327c670", "comment": "Malware payload (Formbook)", "value": "66b48386b41a5461669a6967ecdd139b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858679, "uuid": "7c7101ab-7559-4201-82b5-76dbf4afc8e5", "comment": "Malware payload (Formbook)", "value": "2ce3bb2f2bdd62386f03aad4fba2cf7f57fd4cf165a8205eccff61986ddd42d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858679, "uuid": "5e9b4040-62dc-42e8-a167-95e2d521b869", "comment": "Malware payload (Formbook)", "value": "675f469c2886f7b9b92ceb6326a09dd095e73e76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858679, "uuid": "527cef69-4cab-4cb1-bed5-9e5b5a91e648", "comment": "Malware payload (Formbook)", "value": "172a983728153b2a43db607ed0bc296b206fe638ecf2a7f486369220bd7468ac9eedd2370e1bf89bd54caf5faaba4aa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858679, "uuid": "5286aa17-4e42-4b72-a170-fbccc3362957", "value": "T1FBE48D26625CAF51F07FC7B5A011945063F1E81FF721EE1DBEE329EB09A9F408352A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858679, "uuid": "873f771f-507f-42fc-a9ad-986bdb14f64a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858679, "uuid": "0fc3f920-dac7-4ea4-8443-6a0b6f2124d6", "value": "12288:jo6QC7miCOWhvlvoi+QqMpYxU9p8kEoYlRgMeap:jo6BhWhdvt+Q1aUP4oyzhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858679, "uuid": "e368b4e4-e563-49d5-9005-69aa36c3c121", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858679, "uuid": "644c37a4-3eeb-4a05-acb7-b1512007647f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858679, "uuid": "f12ed852-9c74-4c25-8574-9a1d4c9da7ac", "value": "Conpamy Profile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08627ee1-d6d4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652896670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896670, "uuid": "7a6a2bee-4656-4e62-b92a-3a1c443a64c9", "comment": "Malware payload", "value": "d5d8eab1d7b8721fc6913e904e1dc060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896670, "uuid": "25276f50-8ee6-4b23-a72f-474c812668e1", "comment": "Malware payload", "value": "2d6f49a79a226d850abb3bec7fc14a43961b6064a6fbfb5029f4ed6ebcf890f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896670, "uuid": "6729b96c-e2b8-4532-a6ac-89eb6684ce57", "comment": "Malware payload", "value": "f0da424217537f942f0a4ed93ad96635ee67106e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896670, "uuid": "da3f8dd3-c5b4-4a00-b87d-9cae3a27753c", "comment": "Malware payload", "value": "5dab8a4d9b9dc66a9bd47e2ac913ee436a3de0b618bd8bef02a173844801825ed18ad724f317fc331ac189c691023507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896670, "uuid": "8f4c0ed2-b3c0-49ca-8e67-e0b28ad4cb9d", "value": "T1CE05283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896670, "uuid": "cd8aa3f4-1db8-4e31-92f4-a2dc8abbbb79", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896670, "uuid": "fcef6367-a9f7-4093-93ec-10afb975b60e", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7mmpE3:BTg9UXRD2SeqfZZiym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896670, "uuid": "21cf7c34-90f9-4cdc-aa30-61df55f4ac64", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896670, "uuid": "104282d3-3837-4cf2-8657-083ad9c344b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896670, "uuid": "e6caabe2-0477-433e-8e9c-c8c6c1705792", "value": "d5d8eab1d7b8721fc6913e904e1dc060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2abca5c-d6ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652892768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892768, "uuid": "57cd87ac-1acb-4168-b31e-c0f0a3b8d819", "comment": "Malware payload (Mirai)", "value": "7b316ac89e7788606f7a285dcadd3f11", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892768, "uuid": "3983f12a-caf8-4160-b94f-ebfe5f9925c9", "comment": "Malware payload (Mirai)", "value": "2de14997cec3b6b4954425f6c0cf073fa3b05bbf259ffd22e7be1f176a167b16", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892768, "uuid": "decfc934-a248-4b90-bfca-c19c79588248", "comment": "Malware payload (Mirai)", "value": "07cc995ae3729c6aec3c3b8de3d687dde61fbe2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892768, "uuid": "7230f3eb-cf14-460a-8ced-5316801726d3", "comment": "Malware payload (Mirai)", "value": "45b19612935b36427238caa4726b6c3a82b9e764c828856217bf18ae9bbbb1cc10bd1c3a41dd2a882a9db9cd8d59c173", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892768, "uuid": "95eb8245-4ea7-4c5c-8997-878e0a95355b", "value": "T130430861BC915A2AC5E0537AF9AE558E332077E8E2CF3227CC611B107ADA41F1D63F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892768, "uuid": "63988532-7636-4386-b430-85e85a9f1e66", "value": "1536:xmn99eUGL/FXACmvnmwFBRAe6/mC13FMoh+C+pPW8:xmnT2A6uY3FFhdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652892768, "uuid": "1fa8d4ea-d2d5-42f0-87ec-4f1a0ad7e703", "value": 58708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652892768, "uuid": "ba355dc7-4be3-4eae-b107-ea5cbf328f5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892768, "uuid": "34fa9ac6-08a7-4ccf-b528-7c6a66caf872", "value": "Oblivion121.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e051b7b-d648-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836765, "uuid": "f9f84752-b987-4fa2-8f7a-6170d9106dcf", "comment": "Malware payload (Heodo)", "value": "3136d079e14a6bac48e36b51c7a773e7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836765, "uuid": "0b04a2f0-0c23-4e6d-91e4-915ac03d6abe", "comment": "Malware payload (Heodo)", "value": "2dec33f89b396fb83a90c5d5a071733f6309e5741c12d0df4f181665aa5dd736", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836765, "uuid": "2315f28c-d9aa-4e2c-b2b1-c4358546d263", "comment": "Malware payload (Heodo)", "value": "d4c3afea42eebf7ab9cd230c5e00c73ee24bc393", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836765, "uuid": "06b6da06-e424-4771-b011-67d0ea9ee92d", "comment": "Malware payload (Heodo)", "value": "e8ad3f9e43c6430efee2f725272c3752edda0211bdb0825402ee46ffeb759d3ca020c0cbd28cac097a693e2ca0130a66", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836765, "uuid": "feb3b88d-981e-419b-86b8-a45826a0e087", "value": "T11994CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836765, "uuid": "68523f86-ed2f-4822-933e-afc2d1ad5177", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836765, "uuid": "5ebef233-f94e-433f-8237-363d15194805", "value": "12288:M3hV6Pw4aT23s2oHd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ci3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836765, "uuid": "476c73bf-1028-41d5-a5c1-4214b87366c9", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836765, "uuid": "01399519-deba-4c20-99e1-e5b4a8e9b2c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836765, "uuid": "498c127d-0d6c-4984-8e29-db471a01e481", "value": "3136d079e14a6bac48e36b51c7a773e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ffe704-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652858791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858791, "uuid": "e77735a1-fc94-49da-9bac-712c2912d499", "comment": "Malware payload", "value": "c15b74247357963e8ee23759e99e0eba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858791, "uuid": "aea24295-6a53-4f15-a189-115f66817caf", "comment": "Malware payload", "value": "2df0d72bc81d895ec7b0f29bae3682f6ad555df909f946eb05bca7f11dff7f21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858791, "uuid": "fb869f7f-e2cd-4061-a3ad-09cf4444d81c", "comment": "Malware payload", "value": "1b14e0ea8539ff21db89e0e80f88937830241f57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858791, "uuid": "cfddbf8a-1443-4002-8a05-7ecca823d934", "comment": "Malware payload", "value": "f2cce119f6eb01a7ddde3b44a5d91ee2832e7bc4d79b010fe466c721f71328ca9939fafd3414a4b115165ea9f837222a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858791, "uuid": "3c5e74c4-1ac2-4d09-9cf5-df44c18298b5", "value": "T1DC94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858791, "uuid": "e915c2ef-c0c7-41d3-b115-65481991b35c", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858791, "uuid": "f41b013f-8bf8-446d-943d-dc5256646780", "value": "12288:M3hV6Pw4aT23s2oKd9zi3BBoNIQ/hsA7:Yb6Pw4R3s25i3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858791, "uuid": "29fb5da4-ce03-488b-bfb1-29b4dde86a3e", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858791, "uuid": "03be7f01-64ec-4040-87ba-e8f01168b035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858791, "uuid": "6c5be22d-e3da-410e-aa52-e3bcf4e2842f", "value": "c15b74247357963e8ee23759e99e0eba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61412e32-d6af-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652880928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880928, "uuid": "d36fca97-ad63-4437-8ca8-15506147bc3b", "comment": "Malware payload (Formbook)", "value": "1ca1b10c431f04e759b053c40d8b6ba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880928, "uuid": "0b68dd41-68e8-4df5-b9de-c4556ad4a782", "comment": "Malware payload (Formbook)", "value": "2e306d4e802c3797837c61dd955ac3d42c7648747a1f44fca0381069815e8e2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880928, "uuid": "76a9796d-d9e6-47f3-9e7f-7bb6ce03010c", "comment": "Malware payload (Formbook)", "value": "486faef3e354644bba451f8a13977f2f1e229e3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880928, "uuid": "02b4942d-5b45-447e-bdbd-e7ffd263d2fb", "comment": "Malware payload (Formbook)", "value": "6ce26121a6fd1500471994050c74c6b445372ef693596ee23f243c772058546a08ed3ea3473e878cc4363227e2732e4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880928, "uuid": "4e89df8c-37bb-4cb0-af26-40cc01800caf", "value": "T11AE4F1155268CE90EAA903FED06156F817B42D17D912F75BCEA4BCCA3D363C0871BA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880928, "uuid": "5edd59d1-146a-460d-b47b-75bb33d6b15f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880928, "uuid": "2396e4ff-3c33-48f2-8afe-c271e49cbc79", "value": "12288:lKirkUAX1T8/EPHylwP2ej5DcMYGPH8MFxggoDnQZeDBiECl0QXjJcyaD:QakxlATlElj5AMx8E/oDvcECl1qyaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652880928, "uuid": "e0e9f832-2c7f-465c-8c72-17af57dc2b11", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652880928, "uuid": "aab8b21a-5b0b-4139-ae10-af9cdb92367f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880928, "uuid": "375a6799-315a-4a2e-89a7-160be2401c0d", "value": "SecuriteInfo.com.W32.AIDetectNet.01.28105.16936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1663ed11-d64a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652837423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837423, "uuid": "dc13d57c-65e0-4924-a816-9368f3330be5", "comment": "Malware payload (Heodo)", "value": "a143ed46e791027df67b86606a224564", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837423, "uuid": "3c0872af-4cff-42b6-8e55-e0ba1e52235d", "comment": "Malware payload (Heodo)", "value": "2e79aa64d2d4707da005d7b1559dac71f2798c922730bf6c4c9fb2392be88d9a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837423, "uuid": "b3330e32-7a02-4aad-af08-10580d9c15db", "comment": "Malware payload (Heodo)", "value": "940c184b15f318ae04c8a80cf9e9dc2700b0a689", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837423, "uuid": "3c038994-8eb6-4904-be93-cba9683db579", "comment": "Malware payload (Heodo)", "value": "e34aa277e927793020c269d0296c9152f8e4ded155fb8bd014b568d43a9688c82215e2da61e2bbda7766a2ca68d99ad6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837423, "uuid": "f33e62b1-ddc3-4284-8db4-fb4be051f420", "value": "T145A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837423, "uuid": "1d5360d5-53e2-4d10-a043-3b8864c4c150", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837423, "uuid": "ad7962f0-a6f0-4ad1-bf13-7182a16ef79d", "value": "12288:uS4BnAed8BK2o0aua5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKJa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837423, "uuid": "07183d39-6291-4417-9a92-0dec9383b65f", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837423, "uuid": "f80e0312-a0a4-4058-b176-6530f8257663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837423, "uuid": "49871250-bec2-49ae-8d91-34538aa48dbd", "value": "a143ed46e791027df67b86606a224564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2e3eb3-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652858777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858777, "uuid": "ac5690ca-e26e-4e3f-b5fe-5d95ed57dfee", "comment": "Malware payload (Formbook)", "value": "086fc5469b787092cfb94b69a0e09722", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858777, "uuid": "c910b62d-b78c-4579-9165-38144d45eba4", "comment": "Malware payload (Formbook)", "value": "2ed7589617058dc1ce78716a8ca4364ff2507862d464b46c226c8f7535d6a7f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858777, "uuid": "f1ffc080-7e88-405c-ba25-b4f5ac445473", "comment": "Malware payload (Formbook)", "value": "bbf0a0417b7f1449990cd7f2420d3e9dd3976aa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858777, "uuid": "0668117d-bcca-4e93-b376-ee60c9cd68cd", "comment": "Malware payload (Formbook)", "value": "4caeec5cb06c72c6d9dc356b28c5c4174f7432b1b7dc0d277a3faf78e8a65e75109b01fd746db7e33c29fbe9a5b700b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858777, "uuid": "5e945066-45bb-42f1-9ce3-6609cd9d4bd0", "value": "T1FA54E04091C4C56BD4C64EB4CB36DBF12B76ED222099461B23E17E2F7A36B609D0E397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858777, "uuid": "209fbf45-5506-4ed8-9ee9-34b6a5a02bb7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858777, "uuid": "4f7c6fdf-45fc-4b16-ad49-1461e6e6dd66", "value": "6144:aYa6P1t8RTn9Bcq8hzQMHZ+mx2Jt9qZ8U8m5:aYGRhB28MH3x2J+Z8bm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858777, "uuid": "acf0dc3e-9fc3-47a9-966b-7a4b4545b6de", "value": 302355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858777, "uuid": "bbe8e62e-e9d9-4271-a9a4-d491c050c318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858777, "uuid": "daf6b9e1-fada-4ad5-a284-4520a15a8531", "value": "PURCHASE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d538ce-d705-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652917874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917874, "uuid": "50ae0a01-9489-41fc-8449-139b8757a830", "comment": "Malware payload", "value": "3de0c7dbce40d6074a424c1caeeffd13", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917874, "uuid": "1c4fc6a4-7c24-460d-81ef-dca30b139872", "comment": "Malware payload", "value": "2f6ac9f5591a43fd8b4d94d2e530101ff1937e444eb0ed596e1df60e329dd3bf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917874, "uuid": "abfc053f-8e6f-4a0b-acf9-f5be5fe31f5e", "comment": "Malware payload", "value": "5d7f6578990f99cb5aaeeaeb2de26d0bee166e06", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917874, "uuid": "ba6105ff-bdb7-42a9-a680-836091f3a6d7", "comment": "Malware payload", "value": "d3b869002dc480ff8d68b1e1c6ec9b22b63b340390bcb239c7fcc2e5a2bc4d70d04edf6d1a2f41b1d95298e76ee31a83", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917874, "uuid": "b6ff49b0-6b38-4561-a7dc-fb2dd1350040", "value": "T159A5332A3ECD8F57C7A8157180E94026791A7E0CCB2E8E327785FB66713267273D3169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917874, "uuid": "994f1fe0-2460-40ca-bf87-c6f788e6d5ae", "value": "49152:h/r/nybrEwfUHoeUU61Jacm5NoJyYPT1JJm/ySpDM2:hTqbJfUJUB1/m5NrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652917874, "uuid": "7b1ae214-95b0-4561-bb73-54cfe2cb4bb4", "value": 2190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652917874, "uuid": "7d4ddec1-30c0-4906-a2f7-2ab62e5d56c4", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917874, "uuid": "211b1647-2f52-4355-a50a-87726b953a1d", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.8040.8416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3710463-d6ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652892769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892769, "uuid": "35863e1b-b4bb-4814-8732-c41a7c7e4639", "comment": "Malware payload (Mirai)", "value": "06ab8f99e8216558eb8e9db144f29f6d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892769, "uuid": "2bb9cc1f-550d-4a7c-9823-bb00d716be1d", "comment": "Malware payload (Mirai)", "value": "30507f21541bdfd389eb26a3db886f63cfac41f210d37e48f0391b07ba450791", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892769, "uuid": "604a4ce2-9b94-4811-b790-967ae1f05ce3", "comment": "Malware payload (Mirai)", "value": "927104ecfa9bf929387e197d179e035492805eef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892769, "uuid": "5edfbea5-f732-442c-9788-3bc28d710ed9", "comment": "Malware payload (Mirai)", "value": "951fa8f1edb6b42c329865b1e2511b0453c78dc71e49eb37ecbf6ffa0c9d5c9914bd51ae92809f34147b40d26349a54b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892769, "uuid": "5a72ea1e-4d46-4f76-8ffb-8ee5c43ba62b", "value": "T12E93B41E7E258F7DF79982354BB78E22964837C627E1C141E19CEA015EB034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892769, "uuid": "e81abb1f-23ab-41f5-9d08-3257638f4935", "value": "1536:5+NOusT2iv4UnaGZYfovI96yHjEJObucsSkN6K7pYXmLz/95:JuGbvrNY+I3HjWOYSkN6K7pYXKbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652892769, "uuid": "58fc35db-ee18-416d-84c8-1d7a54651b89", "value": 97584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652892769, "uuid": "e0d90a3d-c36a-4a14-9c7c-910befcc1d0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892769, "uuid": "69c28a47-0fc2-49c3-833e-da5f0b4bdd07", "value": "Oblivion121.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1bf7c6e-d6b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1652884150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884150, "uuid": "3558abb7-0a59-477f-8b45-fb334a940645", "comment": "Malware payload (CoinMiner.XMRig)", "value": "be75e9e51767b5a59536afbbf9ffafbc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884150, "uuid": "f29a6170-5030-4b8e-92db-3f894f84b1f3", "comment": "Malware payload (CoinMiner.XMRig)", "value": "30a4788b9d7eb3c50403737f4af3882b79ba75b8201d53aefb359336f5763745", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884150, "uuid": "0021f114-71c0-4c2e-aaa8-62d91077a4fc", "comment": "Malware payload (CoinMiner.XMRig)", "value": "78be65d86a6918643092e8e90fd72ad3b9ab997f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884150, "uuid": "e70310cd-0178-4683-b883-ac31274f43b3", "comment": "Malware payload (CoinMiner.XMRig)", "value": "178e3121a944c5362d190ae9bcf5a1d8b904e04f68de0aae20b79cc712916671c38a0e8797527a9e73c57633b5c0d407", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884150, "uuid": "3717247b-bb2a-4b5c-a118-cc58b4ec234b", "value": "T1DD0512A1770C95CAF8290276080BC94519B2FC7E45F4736E66AA736ECDF6352107B84B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884150, "uuid": "fdd19bab-f248-4f2b-b1bb-645c0bd6da74", "value": "12288:MbewlQtfYJM9j+lVfZ+GsZEw2dkjH/+4x8g8+OK8sMcUHywVbRKfwLvFB:MbewefYJSqlnaaD4mci+OKDUHyulDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652884150, "uuid": "0d8e56af-f2e4-4373-b5fc-09530c358f0d", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652884150, "uuid": "4fe3c664-3670-43cd-88a2-b5fe7f2056d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884150, "uuid": "782f7771-3b31-4053-9ebc-279bc7508867", "value": "be75e9e51767b5a59536afbbf9ffafbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e1e63b-d6fc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652913898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913898, "uuid": "df33951f-50f7-425f-bddc-eccb876b9cad", "comment": "Malware payload (Mirai)", "value": "70a8ef646c188945010ed4e0446b2f75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913898, "uuid": "0b10d82d-b4df-47da-bc9b-3c70bb888d85", "comment": "Malware payload (Mirai)", "value": "31276a829330b8c5579e85e6cbe496e5d72e5306957e2a79c9af282951a3b62a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913898, "uuid": "6bcfd687-c038-49a6-b08c-8015fced4051", "comment": "Malware payload (Mirai)", "value": "d0ee354c19acd64e7cbcfb6fdf5d079c556f6814", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913898, "uuid": "1ff3f625-bd38-430d-821b-8ed3cdfe76c5", "comment": "Malware payload (Mirai)", "value": "b10615dbdf9e03555249cae0ccd8c843ec9191e0f2bfb76f9b9689c72970c6b18e6666ec89c87b4bfe01fd52f33a8b0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913898, "uuid": "e288b2d3-578f-4eec-8c21-fc8dba48d0e8", "value": "T18A430752BC818A16C6E0527AF92E85CE3B2123E8E2DF73079D211F6176CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913898, "uuid": "cb4a8958-3dd8-41dd-8beb-ea064982aa56", "value": "1536:Q64i29YzaK1r5mTPAzHcEe7P1suV27c3hMDHs:Q6ia7ds1b27Yhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652913898, "uuid": "86ed2849-6959-45c0-9687-dcba0fe397af", "value": 60444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652913898, "uuid": "dedbf81d-7d47-4869-959d-dc06272c48c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913898, "uuid": "87bae75f-d6af-403c-a202-a81aa237078f", "value": "70a8ef646c188945010ed4e0446b2f75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b049efbe-d6a7-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652877624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877624, "uuid": "5b3fbb2c-04b3-4354-8e51-3682d852e677", "comment": "Malware payload (SilentBuilder)", "value": "ae59d66091fe0865cc0b26ca81b745b1", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877624, "uuid": "a0214e7b-cba9-42ae-af73-ee41f4f02f8c", "comment": "Malware payload (SilentBuilder)", "value": "31d59aabd93bc849e17e002a2eb686832533be088dfd9e96e9bdda05be739f7b", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877624, "uuid": "fd06b705-46dd-4b55-a174-7901bf15fe42", "comment": "Malware payload (SilentBuilder)", "value": "f6402a93363f8d2994c3a7c255f878b2edcc5fc9", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877624, "uuid": "61940a9e-a97e-4168-9ba9-1fe20d10f74b", "comment": "Malware payload (SilentBuilder)", "value": "620fadfddf7aac2b295024ab62e890199cbd59e3b2e9d608e0676c7d6241a628d3052b14a92e021121fe3b4152553213", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877624, "uuid": "7add29e3-0445-4f39-984c-5a0e54425c17", "value": "T1BC735A4AB599D96CE5238739499783A9B313FC110FAB03873549F3A13FF49E05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877624, "uuid": "967eb882-38a2-42b1-818b-49838594e0a1", "value": "1536:DMXKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgxBAezwrMCtvJecvRtbM5J:KKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652877624, "uuid": "e249cc3d-f295-4244-9c01-ad6f6bb939ba", "value": 75282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652877624, "uuid": "b80db0a6-7ca0-4080-bc90-dde6b2d23a50", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877624, "uuid": "6bd84f70-ac0b-4671-b2c2-51d58e0711c1", "value": "Details.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ba2313-d6a9-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652878353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652878353, "uuid": "9bb97da6-19c3-48e0-b578-3199ef1fca8a", "comment": "Malware payload (RedLineStealer)", "value": "115543518d636e19c91176451e5e3f4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652878353, "uuid": "b90f0d8b-ec8e-4c3a-8840-4e2f2bda9958", "comment": "Malware payload (RedLineStealer)", "value": "31dee2992c492212b1d090004f9aacd895b65c116cdd343049a444598feba9cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652878353, "uuid": "4b94e67a-9ffe-428d-871a-12a96428c8d1", "comment": "Malware payload (RedLineStealer)", "value": "1af5899c56a94496b65735629bf5ea5f09b0943a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652878353, "uuid": "20689d1b-5fcf-4e86-b7cc-00324ce11d68", "comment": "Malware payload (RedLineStealer)", "value": "4136525512ac393ef68e07ca7269119a66b3855a10394836b5bc29a3103bd7a2110f779c333ce1fd4d3d6c7f7bea2ff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652878353, "uuid": "302d213b-ac38-479c-b052-a181b302f84a", "value": "T1DE64BF4231A7D072D521163209B5DAB9CF3DAD510A205EFFA7A05B7ECF303D2E632A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652878353, "uuid": "57125562-96af-42ae-bfd7-84921294b6ea", "value": "c0864c9bc2a9439a8dca02c3a6407cc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652878353, "uuid": "96266d14-25e5-4a71-b7d5-1d08e0252e9a", "value": "6144:lCbUTVEweSlQwZE0SjhoAODSoZp+23AzI9gRVjfr5VNHf:lNuwe2QGX8nFzI9gRVjfr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652878353, "uuid": "91b9c049-ad39-4456-8b71-2aacdb29701a", "value": 336328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652878353, "uuid": "608d974d-24f0-40a7-b43f-2f27bd70a2d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652878353, "uuid": "631e159a-591c-4142-821d-d1b19989bf94", "value": "Vape_V4_Cracked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7faa1a22-d6c6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652890857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890857, "uuid": "47ff3827-a8ed-43ef-9b17-ae7dbfd9243d", "comment": "Malware payload", "value": "77698ba58295df23c7628670a7236ecc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890857, "uuid": "7957bd4b-f246-499c-82ff-6e950262cae3", "comment": "Malware payload", "value": "322fb74b0a235aa5050a98b9dd20c301b8d37681b6a3e57d83a47bf760dc7915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890857, "uuid": "43961323-88a8-4734-82e1-bfc1f7b49599", "comment": "Malware payload", "value": "447e612b37aac413e5833f5cb68836c365c00a25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890857, "uuid": "037f9ffd-1137-4dd6-ae4d-e49fa2086ad6", "comment": "Malware payload", "value": "b0ffe7667f97af139301712f7235d958246e121a63972c9c69b86abff3c68028f6e25ee45766a6795b938bfe5594d661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890857, "uuid": "523ad1cb-4a76-4635-90c0-c2aa1242aea8", "value": "T12394C04A73A50CB9EC7282798C574A01E672B8150771EA7F03E0875ADF2B3D1A93F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890857, "uuid": "48829efe-9669-486f-b54a-83bdd9c9f3e3", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890857, "uuid": "0c14684c-186c-4bd8-a695-f5ecc98536aa", "value": "6144:GgIYnzcJxDpmJIyeV2vR3JDEoh3EuRfoP1SKL0w+d7sWOQSH0E9cWdb3BHq:yKz+1pcIuvR3lEo5Eu+9T0Rd4Hr9H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652890857, "uuid": "5fa71835-718f-43ed-ac16-1c5b3fb15428", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652890857, "uuid": "4d736292-484c-4db2-a203-36ce5fb8024d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890857, "uuid": "1fcf5068-b81d-4525-a892-d1aae97ab692", "value": "77698ba58295df23c7628670a7236ecc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5296aa-d6d2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652896031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896031, "uuid": "b719aa0c-c507-4801-9cf7-e935037958b1", "comment": "Malware payload", "value": "d81b35a76ff630de9f6b769d9f257580", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896031, "uuid": "f4e97886-aaa4-4005-93ff-8a75ac611b9d", "comment": "Malware payload", "value": "328d2afddbe8e9235437788706f4a64f193d0aad020e695daa2a4afd8f09c475", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896031, "uuid": "2a9911f9-0dc2-4846-9111-7aecd8a2b04d", "comment": "Malware payload", "value": "9b418b51583de0bd6d4d9d38b0c908eb5a6f93a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896031, "uuid": "7aa2d4b3-caae-4ebc-9547-caf8e205af7e", "comment": "Malware payload", "value": "d481e078d7d4fabf98f0b652ac541b24d135b16912a0768a350e44e38c97f3410683d8563ca4fdd36e3de3fc0d22b8f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896031, "uuid": "d3945a09-39e2-46d0-93cc-b02cc7f2b396", "value": "T1A765BF22B2D14433C43317749D0F97A1A9377E512B6494BA2BF56D9C5FBA6823C3A383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896031, "uuid": "6066ec6f-d32f-4644-8b77-13b3763984e5", "value": "36c0ffdab89e265b5a748a59648230b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896031, "uuid": "1e92e379-8875-4c34-b462-f7bb232f11b1", "value": "24576:IS9G0VKjq4R7Bi2JvS761Y9uIyd73h517nOVy00xBORvOZO:Ie1WxOPyRhvOVX0Sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896031, "uuid": "cc34ea2e-74c5-4689-846b-7409c256ade5", "value": 1461248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896031, "uuid": "640e62e8-4a74-4fb0-8b5f-dc10ac197b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896031, "uuid": "35cc6ba4-7434-4549-a6e1-3da9d30868de", "value": "SecuriteInfo.com.Scr.MalPbsgen1.26772.19662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88f9240-d674-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652855761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855761, "uuid": "b9d6aea7-5b45-4507-8b53-0c2460832a48", "comment": "Malware payload", "value": "74bea4a7fc12a74788044e68fcdaf42a", "object_relation": "md5", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855761, "uuid": "f15f10cc-ee65-4103-b99c-d71485614401", "comment": "Malware payload", "value": "329d77b0ab5af0e568b9d56e3c3f7afc4266bf2cea0bd816ed4e67d4c9a09692", "object_relation": "sha256", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855761, "uuid": "1dd3f861-eaed-4306-9b36-c708d43bc96a", "comment": "Malware payload", "value": "0db859f4e93665fab7daa4945462cf8996886cdf", "object_relation": "sha1", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855761, "uuid": "a2aa6711-a0ae-4623-8d79-0c5e10c4bfcf", "comment": "Malware payload", "value": "fd7896e41403b4093eddd187c11b632e18a1bf7f1e245d5ee37c458843763ebd62a49032904703092f268524f0e41922", "object_relation": "sha3-384", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855761, "uuid": "6faf9364-089b-4d97-bebe-1e3c0e759d7c", "value": "T136B6334673D80CF8F5F9A436D40BD626EA65700B5358838F8B449AA13E279B36CF7790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855761, "uuid": "f15f7418-a81c-44a5-851d-aae8f2d15e63", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855761, "uuid": "b80eab4b-5c31-4c59-8016-1943cb542967", "value": "196608:GqhBA0L2Vmd6+DlNJm3AqxnNgwQ+dtLtlQ7kAVBJHd0qcfvSACxe/2Q:1vL2Vmd6ml/m3p9NjTQ7BVBJHeqcIe/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652855761, "uuid": "39610526-b1e6-405b-a85b-b5a406523e62", "value": 11067705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652855761, "uuid": "6bcf05a6-213b-493f-b76d-36cc27eaf8d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855761, "uuid": "34a15e25-bda4-43bc-8a6f-6648be9c9927", "value": "Eth_Pay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e248de-d669-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652850810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652850810, "uuid": "3f9d6861-a2fd-468f-8727-ed0fdb66e9c7", "comment": "Malware payload", "value": "7e088808e52ed5eb88d4a2df6c77cfae", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652850810, "uuid": "ca0b7a41-a338-4b17-9d2c-f7843474a820", "comment": "Malware payload", "value": "3342d74ec2b0c7324d6cc94a6e9989f002ec02b43927fe6b0951e160829843be", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652850810, "uuid": "b695636c-b254-4a61-afa6-3ca170c25215", "comment": "Malware payload", "value": "c43241f4e342dfac9bf3c119e3792b937409fe06", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652850810, "uuid": "54d1500e-8791-43f9-8186-527d6b91e848", "comment": "Malware payload", "value": "550c57ea95bf864ef90c9d75a50b5a0d933ea03818616e229841a78aad421bb2b6880133233ebe8b588205a49cd85fee", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652850810, "uuid": "81bf9554-aa01-4f76-a459-fd4ea56e0cce", "value": "T1B795C9F530887C83E127D045710D7A8A2A11FA9E93C6B6C873BFE2B5715A543EB4C993", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652850810, "uuid": "f5dab07f-41f2-40dd-ad02-91130fb31314", "value": "6144:glSlI2JkvqsLvDHJDXN4HKzocg/X1tpXX3T7ucEYAc6O7EOIzI2XOITEJg4COZE8:2zbxNI5Ta8cHRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652850810, "uuid": "810c1a84-0ce2-4e95-87d5-f7122b0bc10d", "value": 1982466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652850810, "uuid": "26a2c5a7-30fe-4986-a818-9ad6fa301448", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652850810, "uuid": "1caed27e-fd2e-4d53-a390-84267c586ec8", "value": "Donot.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1509f349-d695-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652869633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869633, "uuid": "d4114825-6777-4a5a-a7ad-05dd398614fe", "comment": "Malware payload (RedLineStealer)", "value": "5be20154f6875c12a83294dffbe69152", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869633, "uuid": "48d5279b-b4ae-4473-85ab-7ade0827e484", "comment": "Malware payload (RedLineStealer)", "value": "3350b461fc9e5ee4a6495969d6d7e962e809db4150e7673a94d430a780d6481d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869633, "uuid": "4aa60e76-6504-4abf-bc51-2b8b4d50082c", "comment": "Malware payload (RedLineStealer)", "value": "feb0c2efc01859eaf2a8f416e050da48cd153cf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869633, "uuid": "cf5f90fc-fc6b-4724-902d-b74bf1d47e81", "comment": "Malware payload (RedLineStealer)", "value": "9f3b7a6f41241d59cf4cf11d4f2dd36f981992b2a706eb0fe970415d8189fc654317592082fe6fe164dec3df82bfef2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869633, "uuid": "0546fc90-fc82-497b-a371-b20724208307", "value": "T19594F101B391C835D0A12E744871DB799B7BF8262570990BE394AB3F1EB33D09A7735A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869633, "uuid": "2f9020a6-23af-4c2c-9865-006515c10f7b", "value": "151adccff5e70213fb31de55ca880f7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869633, "uuid": "0fde8488-6fd0-4e0a-a288-965010a6245e", "value": "6144:wBbn227V7njG3Quq31ITey2juiYe0wxrXCI17UQGZaiga3wVfN:sbn26njG3Q90tOuViB5IlZ/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652869633, "uuid": "2b507cd3-2c87-47a1-a920-5b6833b7b3ef", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652869633, "uuid": "c5e4a528-17b8-4cb8-945b-e97de2b34ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869633, "uuid": "b7267ba7-0924-4c15-abf0-002e2f418feb", "value": "Offscum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a044842a-d67a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652858270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858270, "uuid": "78f44493-4703-432c-859c-b0d68731e6da", "comment": "Malware payload (Formbook)", "value": "d794ffc235dd5610c7e546a2d1496398", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858270, "uuid": "245e5310-0e78-419c-99ee-2a916959d05f", "comment": "Malware payload (Formbook)", "value": "33958f83cf4a924eb65d09942693c4983643cf9aff50aa0478db8b0b5b5ca97d", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858270, "uuid": "83422e89-9aa2-420f-8338-a3f2a56ecb5a", "comment": "Malware payload (Formbook)", "value": "ee1371bab0bc28575e2b8c9a7bcd60bd5a349bdd", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858270, "uuid": "e6112a39-af40-46ba-b1a1-9f23c278ca5b", "comment": "Malware payload (Formbook)", "value": "34ed01778f88a98a2493d7cb317c6df21427910f7da11ac8c2bfbe648486a3e8b91ea96534ecbae6a00cb3dce7c28aa9", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858270, "uuid": "0d0210ff-d611-40fe-b801-2f10f0832bc3", "value": "T165342308C9B950AEF6B60370EA969F107462F4504F79EE71BE130308B9E5D97AF01A77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858270, "uuid": "06c62373-1b27-414d-8129-887c22015cc4", "value": "6144:PpU8PLHEPCB1KEj1wD8FWgp1dn/ozb6GtluGRX78g:FPLHhB17ZwD8MWd8b6g4GRQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858270, "uuid": "9b43e9fc-1d94-4d00-8b9b-971e09491975", "value": 248131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858270, "uuid": "fbf70cbb-062c-424c-a243-1b07ed64b9ad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858270, "uuid": "bd8b097b-2393-417e-94a4-de3e0b4462a3", "value": "0067765457890000087658.ACE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c820ea2e-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909017, "uuid": "7b0b5cfb-9d8b-45ba-baf5-b8578e6e23e8", "comment": "Malware payload", "value": "04892a3f3c7d0c27e6866a4d39af41cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909017, "uuid": "b466d331-18b9-4598-89f3-6f7f5c0d8b40", "comment": "Malware payload", "value": "3397c02d41ab124e24e1bff70f088784d65c2b2712aaa2f73de7edbc438b2280", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909017, "uuid": "855d68ba-78e7-4f07-aac9-86a13b16346e", "comment": "Malware payload", "value": "b6a582a6037eba2f8a8577daf2bffdbfcc3e6ed7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909017, "uuid": "0b0eb321-2b68-47b7-8083-7fcda2501934", "comment": "Malware payload", "value": "f15cda2eaa4ab8153c658a1484edaf1ce13cde8dfeac4a677da3c9c44d00bd963ae955231fd8c26ef0fbf7461e4eee44", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909017, "uuid": "b7bba0e5-aaa2-4cd7-9665-89b96b2ef15b", "value": "T16DA1F850112C1AB17246597AD26FFA52B80EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909017, "uuid": "73c03022-6753-47c7-aa70-3d1e83134c6a", "value": "96:GRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:GRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909017, "uuid": "c21f3bb7-6a62-424f-a8da-bbf004b039ec", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909017, "uuid": "559c1872-28de-4541-b7ca-71ad5f1e8b8a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909017, "uuid": "69351831-6e4f-418d-954b-296044a4f0cd", "value": "3397c02d41ab124e24e1bff70f088784d65c2b2712aaa2f73de7edbc438b2280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b9ca33-d65a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652844512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844512, "uuid": "4176d695-e3b2-4095-aba7-2f9e85cb7f6b", "comment": "Malware payload (Heodo)", "value": "3f43c236df83527b0a9ed3a7a8d400bb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844512, "uuid": "1b3f60a9-f90f-4eeb-bd43-77357822707d", "comment": "Malware payload (Heodo)", "value": "339a7333a093f8a0234e58ddc5b84c381111a8ccd5b60a39253f6fc18e7d4d78", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844512, "uuid": "f403ebb1-08e6-4d41-ab73-116a27cb06ef", "comment": "Malware payload (Heodo)", "value": "cf933d266f8a479166d5e8a7429a544a866ba50c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844512, "uuid": "ccc63636-ce01-407a-8093-61e4d21e96bf", "comment": "Malware payload (Heodo)", "value": "f732a55184b442a999a14a907dc6b030addaf3f7bc296778b501fb82db60535d48c9634e5362ff20efc62f25dd2b281d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844512, "uuid": "740788fc-d3f7-43c5-9d8a-ec8b1748d0c2", "value": "T142A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844512, "uuid": "baf23e3b-ee40-4c9d-a256-202bbf07ebe2", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844512, "uuid": "03fb9dc6-ef3c-4a7c-9372-4b774edd7184", "value": "12288:uS4BnAed8BK2o0ala5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKIa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652844512, "uuid": "211a9537-696d-4d8b-8b44-e77e7afd1098", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652844512, "uuid": "1c24d1b7-1b77-4ca8-8efc-c3a75a860fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844512, "uuid": "af39a367-f042-436d-81ba-f212938b8f1f", "value": "3f43c236df83527b0a9ed3a7a8d400bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be44b294-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909001, "uuid": "7313c197-fff2-40ba-82da-7c1e3344e222", "comment": "Malware payload", "value": "be7330af49a20abc82dcb3f1dab14d89", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909001, "uuid": "8194e597-68c9-4537-886e-53ac910751c9", "comment": "Malware payload", "value": "33a3e7004aa8d6b54c979e016c321d97b17771abda3a33a5d337233e40724393", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909001, "uuid": "c886e1e6-ff98-474f-bc2b-13782820bfa4", "comment": "Malware payload", "value": "1c110e89c938a4bd500edc99298dfff2b71ca543", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909001, "uuid": "4eab9c14-94e2-4609-8c74-c335694d88a6", "comment": "Malware payload", "value": "5978db5c94590462e9d0636aa05252c2466cc61ca449f26a6b38cba6728be3e0270a562b597ebdf95ec3f912a65e13d5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909001, "uuid": "c89dd2d5-01fa-48e0-8aff-a314aa8d6da5", "value": "T18CA1F850112C1AB07246697AD26FFA52B50ECC1B09777B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909001, "uuid": "190c2797-ccd2-4867-b36b-ed7cc9a59b46", "value": "96:gRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:gRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909001, "uuid": "c6b7a5fa-4d40-42d0-87c4-cd738167f040", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909001, "uuid": "721a5523-6998-4d10-a56d-ffbadef2d70d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909001, "uuid": "216b979f-4670-4430-a7e8-dadb22e23a27", "value": "33a3e7004aa8d6b54c979e016c321d97b17771abda3a33a5d337233e40724393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79182a5-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908990, "uuid": "ff34b17e-f241-45c1-a1f0-39a1207559c4", "comment": "Malware payload", "value": "d0d80bf3bf7ff058cbbf89ed1b10e410", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908990, "uuid": "e6afeb9f-88d6-40ca-af5a-af3e566e6be0", "comment": "Malware payload", "value": "33b5dfec447dbd52c3fceeaea3f8f02e68b2428ef1c731903c3358220412f26e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908990, "uuid": "2cd36ac8-d19a-4bbd-a93e-ca55c9dae14e", "comment": "Malware payload", "value": "8bf79e13b83b02024a39247e27e0fb95534848af", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908990, "uuid": "5065239b-20ce-4a1e-ad16-dc17168965a1", "comment": "Malware payload", "value": "77d780c182eda4faa1de1eb78c489e3d94c39d005c66ff0a2c50ffc7835273273563d328ba192422651a98f050184598", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908990, "uuid": "34e95fb6-7602-4ccc-b43e-bbe70c990358", "value": "T1683160D4120184BE6DE5F9177AF44714B292AC5B6DFC3E48B4E939F8804CF9C2055657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908990, "uuid": "5fbed2c5-b3a9-4743-8698-7eb673214a2d", "value": "12:q0F+N4a0FJG20F9iAu0FjexZed75a0FnLZp0FLica0FVM3+0FPFLpTt0FkMS0FIo:vS60j9zrjy675fwLv6PFtit9+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908990, "uuid": "defa75ac-d530-4e62-8e53-e40c05c1febe", "value": 1743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908990, "uuid": "76caf2f6-33b9-4d49-8cbe-4b2bf1e90ebb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908990, "uuid": "7042341d-6b90-4ba1-9878-0252665b7a99", "value": "33b5dfec447dbd52c3fceeaea3f8f02e68b2428ef1c731903c3358220412f26e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e02c91-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909096, "uuid": "e43f09aa-905f-499b-89e3-a3f3dd559147", "comment": "Malware payload", "value": "48368ea31d0c65f11427234639aebb1e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909096, "uuid": "cdf5f537-8244-499c-a365-cfc889018bdb", "comment": "Malware payload", "value": "33efa7c4bc4414eed6b462cacc7d06e6b7dfdf3126346a336d3e7b3d89b00856", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909096, "uuid": "e18bd1ba-fc57-4421-9eff-fc6de35ac135", "comment": "Malware payload", "value": "6e0b273ce7bd5cca2465336a63f32cb247c5a74d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909096, "uuid": "efb53e02-203b-440c-9e3a-5ef5083f3d21", "comment": "Malware payload", "value": "a51faf92b8853d8d098ebd3de34561304fbe9d8b7109c9f12fdc796a954e89ebf7ce2263639ece91dd37e0df29a37964", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909096, "uuid": "fd6b8a47-50c8-49b4-b540-6b1875ee2c9f", "value": "T1420384028EE7DE147376B0B4E5CDA84C7A9A40C65F8B5E243C4DA3AEEF5277051F4688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909096, "uuid": "4dc7e2ca-992b-440f-baf4-b9c0afdb2c24", "value": "384:v4NqqoC/XmFIywe4Xz2Ye6/NBfuRLa4zBfty1jX1Gujt1lifvzM5re2Mb:EqFIywe4Xz2YeGNBfuRLfcjROgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909096, "uuid": "43004658-e47b-4b9d-af9b-dbf8787cae00", "value": 39426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909096, "uuid": "c13f4941-81d0-4f41-8927-059082254dae", "value": "text/x-perl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909096, "uuid": "98902e5e-d287-4604-ad01-eee39799e418", "value": "33efa7c4bc4414eed6b462cacc7d06e6b7dfdf3126346a336d3e7b3d89b00856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67db614-d6db-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652899968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899968, "uuid": "179202c4-38d0-4aac-a1da-7d6b75a0607b", "comment": "Malware payload (Mirai)", "value": "53d14ba47e1dc9d5fd364ed0b30f1754", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899968, "uuid": "91dd7964-404e-4aa7-b33d-ab679b5ada67", "comment": "Malware payload (Mirai)", "value": "353ba71ac542c87d7658a59dc95582680d6129ddb9253728c1620a2b75bcb2f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899968, "uuid": "f01c13a3-099a-4f9e-89ec-034e7f15c412", "comment": "Malware payload (Mirai)", "value": "12111846ff8a0fb4043019e9f51aa436bae380bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899968, "uuid": "5cba4828-623e-4de0-a0ce-40ed3e3efdbb", "comment": "Malware payload (Mirai)", "value": "eb9fa64554834c52b27ffeb18e446e70656813f30f1e5f800702dd38fdd15489fa74d7eff98766fb42346d94b0b51920", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899968, "uuid": "59db7fc2-dcff-4f13-83d1-c18c096ecae0", "value": "T1FF33930ABF610FF7EC6FCD3745A81B45348C641A22A97B756934C828FA1B54F46E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899968, "uuid": "4ff3b52a-f462-4753-b250-0ec4a1402e17", "value": "768:TTowKmPldbWOjvACzQjUe2YD1pmeXeiOevwnH4ZHWgIXiyMS4l+:TTowKmPldvkCkUtzijO0wnYZHWfMD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652899968, "uuid": "fb228d0e-4b9e-4978-b0c6-9a37d61ed807", "value": 51172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652899968, "uuid": "9492d34a-3dd8-4a6d-9bb2-0c45b0f1a72f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899968, "uuid": "a9754651-0a37-441a-85e6-0bc0c340300b", "value": "53d14ba47e1dc9d5fd364ed0b30f1754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b095ec06-d6b5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652883638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652883638, "uuid": "c4b658af-7257-4375-88da-3b6fbd111542", "comment": "Malware payload (Formbook)", "value": "83ec305214dd082cf21b26aab0734fc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652883638, "uuid": "167d61ff-3ce0-4364-8df8-125e423b9ec0", "comment": "Malware payload (Formbook)", "value": "354693c60234f7896f1074b7237808aaa50c855a9b284f619365449ed0082b21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652883638, "uuid": "6c63ad6c-7bb4-4ba6-ab18-6da434db5921", "comment": "Malware payload (Formbook)", "value": "b7e0f4ead1c3f1debb85d97d1ef9fdbbbe25f45a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652883638, "uuid": "161e8cb9-b252-4698-9a11-471c02b41031", "comment": "Malware payload (Formbook)", "value": "643797cc84e79b814f4c1a4faea6d4f0ac9bd71bec2c558258bfac2f67f4a894e13aebe70edafdd1858d8ae8098d85af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652883638, "uuid": "2bd4451e-063d-420d-a686-555f9b22bcb6", "value": "T17474E0D2D6404486ECA51B3224379D2916A7FE7ABCB1F70E4FA675246FB32D34127A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652883638, "uuid": "ab063041-1fb4-479b-88ca-c447d150af59", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652883638, "uuid": "674d9a9d-01e7-4ede-8ce7-0179ec03da9b", "value": "6144:fOtIzeY5pLtWYvvQqjlTib3dbYVPaMz64KD5HQ86L01kMviq:fOTrYvvQqBub3dbYVPxzM5G0CMvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652883638, "uuid": "a646337e-9bf8-4dc4-b707-f36c6891c819", "value": 360446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652883638, "uuid": "15b09cad-64bf-4614-aa4d-7ba2c9728fd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652883638, "uuid": "ca71830c-b3ea-47d1-861f-9462da6555eb", "value": "QTE00038319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a645608a-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908961, "uuid": "c7c5f2a8-79d0-46c3-a102-e85003f9c8d2", "comment": "Malware payload", "value": "758b03aa1ddda46612fe26f5d1ec9623", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908961, "uuid": "d7c7322b-3d7f-4fb3-97d0-a75af47f755e", "comment": "Malware payload", "value": "356e2118eea638312c5d84cd54fbe2d036e384997109022949839c5bcdbfae40", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908961, "uuid": "3ab6c882-1d58-437f-9816-0e8b9769ebff", "comment": "Malware payload", "value": "5fdcd087c21209a262fe080744ebc9833c374a54", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908961, "uuid": "5debd881-3c84-43ce-b03e-ff4dea6215fb", "comment": "Malware payload", "value": "c53f913d2be470bc1f26e20ae2f5570cefcd2e4dfe2cd8b3fca1310bb3090ffceac3a1fc75eb9b220fdc34acbeb56770", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908961, "uuid": "a438d241-76a4-4f37-a729-989493ff3cef", "value": "T1C7A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908961, "uuid": "921e1700-be17-49b7-8c25-875abfd66f53", "value": "96:nRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:nRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908961, "uuid": "89b44513-f320-40ca-ba71-951514a7c42c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908961, "uuid": "b5f3b0a8-ee52-4d69-a1e2-ee85e3759d4d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908961, "uuid": "9120f2a6-72fa-42b3-b3f5-ef4761b96665", "value": "356e2118eea638312c5d84cd54fbe2d036e384997109022949839c5bcdbfae40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c747fe-d6d3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652896639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896639, "uuid": "818d9180-a71a-4c92-a743-7df94869747c", "comment": "Malware payload", "value": "e068b09221ea5b3fdf6e206d75f5764c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896639, "uuid": "75313a0e-7c08-462a-aa38-fe6fbd7cff5b", "comment": "Malware payload", "value": "35ddd3233a90d43b0b78b1ad2d84070782bd14af4ebe02e9ad08656b4560186e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896639, "uuid": "c8c15c8a-1b40-4907-898e-a6b8efc2e57d", "comment": "Malware payload", "value": "609cbf460f221af923a69d3f78615d1af70218c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896639, "uuid": "7ebf2555-e6d3-4165-8ae5-01758216abb6", "comment": "Malware payload", "value": "4e2d4492225d6fe1ea191ae274a4f36567d392ca7ada794ae0620c2003065fb67725425b77b6908c331680415be369d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896639, "uuid": "4ce13afb-a70d-465a-91d1-aef4fa7fe7f1", "value": "T18A05273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896639, "uuid": "f481b982-3073-4867-86f8-a67191729f7b", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896639, "uuid": "c5879e8a-bdc0-40d7-a741-6d07c0fed66b", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oXaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7XUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896639, "uuid": "ece6e513-2b2a-410b-8cf2-61bc221e318a", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896639, "uuid": "f15c7f3a-a0a0-445d-8b62-79490019eedd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896639, "uuid": "d6582b62-1c90-4b3f-9c0c-12d99b3569ce", "value": "e068b09221ea5b3fdf6e206d75f5764c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c1c3f5-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909062, "uuid": "58c0c05e-6dc7-4cf2-bccb-feeea0529da8", "comment": "Malware payload", "value": "6e94f557aacaa7971f10e2fd550413be", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909062, "uuid": "396caea3-a00d-44af-aa54-0ca81a32dcbb", "comment": "Malware payload", "value": "35f5c12c21c483464f020138ee701136d7f4c6cff52773712be1baa1c81c48a3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909062, "uuid": "aefcb058-69b6-4380-9333-9363e1d5ed2f", "comment": "Malware payload", "value": "344406738303d0f89fa4db718fca96ec463fac82", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909062, "uuid": "314b8117-55d7-4a48-b37b-c7aa63f28162", "comment": "Malware payload", "value": "bff8e0c8274f135b4035adb3a89bbc949c8c281bac93afbd424788cec56faa79ebe61ab27b8e459f9baf4b30a48908ab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909062, "uuid": "54b8227a-1229-4ae6-9617-e6362af25a86", "value": "T191A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909062, "uuid": "e2fe27b6-389b-4f57-8629-d4e3f33a8b5a", "value": "96:HRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:HRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909062, "uuid": "4e031561-2182-41bc-ae33-7f2127cf07c9", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909062, "uuid": "b9cca806-8cc5-48f1-920f-df45f7f9fd40", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909062, "uuid": "8b068372-f97d-4181-9a29-89c18f1665af", "value": "35f5c12c21c483464f020138ee701136d7f4c6cff52773712be1baa1c81c48a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78d4025-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909043, "uuid": "d71a225c-29c0-43ce-8350-25df639ac5f4", "comment": "Malware payload", "value": "5ad3be690471c8c1c04b1de2a66ed1fc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909043, "uuid": "72eee862-5974-4670-9baa-ce9d3244e064", "comment": "Malware payload", "value": "366b8fecf6bb55efd432660575d63acd79e83970bdab84bcfae7cdee1bd51717", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909043, "uuid": "dc5e89be-9030-4eaa-a7ab-7b6794de9e3d", "comment": "Malware payload", "value": "3fe7fbfe9041f118f1865c2438c7a29991782bb0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909043, "uuid": "45f9656a-5a49-440c-a363-6233b32c23a2", "comment": "Malware payload", "value": "972aff7c8a206397b168cd775553d44398520788e7b1be24223cfc1ceba311fbf454f6ed74aa2d4b86153860113e2f31", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909043, "uuid": "c3e803ab-5421-4675-a6b8-6d24814649f5", "value": "T111A1F850112C1AB17346597AD26FFB52B40EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909043, "uuid": "1bdee6c7-161a-4e27-bc10-b4e44c55439f", "value": "96:BLRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:lRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909043, "uuid": "b845b5c1-7d46-4dcf-8cf9-5248b007de8d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909043, "uuid": "a180481d-3999-4613-b245-f2313fcbc2fe", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909043, "uuid": "7e4c202e-46be-4170-b9ac-c45ab1869a1e", "value": "366b8fecf6bb55efd432660575d63acd79e83970bdab84bcfae7cdee1bd51717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ce8a03-d6a1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652875103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875103, "uuid": "85ff5b5b-b4c9-42b9-8b47-7f0f9c98ce73", "comment": "Malware payload (Smoke Loader)", "value": "4c7ad0bce55143a5c6751b3063737a47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875103, "uuid": "326dfca4-c5c8-42fc-b7d9-9b48bf75f274", "comment": "Malware payload (Smoke Loader)", "value": "3675d239f3a7fe82634e98680149821d4e573e349f183b0aec58261450d4807c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875103, "uuid": "eba9bc3c-fa44-425a-9595-dad235f54795", "comment": "Malware payload (Smoke Loader)", "value": "e8f30156aa22e1c7dafd6349422d3834caba2257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875103, "uuid": "6d9b2028-a38e-47c1-b464-cff0703942af", "comment": "Malware payload (Smoke Loader)", "value": "cdb8e2b721559b2a19946b5de44b7046055feed80eea99203f37ca2de32c8fcec929a6ec5ab304272461f164d6ac7891", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875103, "uuid": "6386d06b-5f4f-4330-a443-6bd5c393c3ef", "value": "T12864BF11F790C6F4E0961D307465DBB24B3BB83A2670540BF7906B6F1EB73909AB631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875103, "uuid": "ba1cc6bd-595d-4f1b-be2e-43f247e99e47", "value": "db57d5e3d04b9a257784f752aaee46da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875103, "uuid": "77396235-013e-4b34-96e0-13b9da239876", "value": "3072:AW3eMvu1bqO7c4fx/wmhpC5OXe9wmeeSsxkgaBChUpZa9uD6Vdyhk:dTGqO7c4qOfulPiga3wVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652875103, "uuid": "a926621b-325e-40e1-87fd-3ff0c3fa4483", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652875103, "uuid": "52900a3a-8c2d-4c56-bc05-2a886525f772", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875103, "uuid": "fa442e67-10fb-4b3f-a473-2fb831e1f2c5", "value": "SecuriteInfo.com.W32.AIDetect.malware1.27703.21509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a25179-d681-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652861284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861284, "uuid": "fb6fc907-ead2-431c-aee7-e3ac9895cdcb", "comment": "Malware payload (Heodo)", "value": "095005561b5704fbd01c86158320e193", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861284, "uuid": "a5188d85-045c-4818-903f-da196922406e", "comment": "Malware payload (Heodo)", "value": "37bc82fc48b50248368142af792af1bdbb1b38afc57e288fdac8e4633874f006", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861284, "uuid": "ab4cb530-71ea-44b6-af84-409318e06261", "comment": "Malware payload (Heodo)", "value": "ef1106f1c5b6b40b71a4323a1820d64ee98bc5f1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861284, "uuid": "91605a97-2689-4f07-9137-82c7a89257d8", "comment": "Malware payload (Heodo)", "value": "30aeb67f57c06d2f65ec92908e0b85f3d4a111415fa63ecf31a246e7699602658b6041553ffcba8441f983f39c151f88", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861284, "uuid": "28e0472f-58cb-4f3c-87ff-d1ba2f88d7c4", "value": "T1D094CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861284, "uuid": "a6258741-6ba6-4092-b79a-93d56443e949", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861284, "uuid": "4242a846-68e9-4356-8c60-fb28c7ac6984", "value": "12288:M3hV6Pw4aT23s2ord9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Oi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652861284, "uuid": "193aea73-5f30-4a8e-b1eb-c83a2bbf100e", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652861284, "uuid": "72ed6cb0-ddcd-40a3-a20d-d14b5459bb4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861284, "uuid": "37ee319f-5bfa-4c82-aee0-6750f3738092", "value": "095005561b5704fbd01c86158320e193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c180de03-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909006, "uuid": "ecfe5978-499c-4c72-af59-df7b8a034cc7", "comment": "Malware payload", "value": "1630101b8c841ba44d2cb1bbf7b27c26", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909006, "uuid": "3d1f496a-8217-49e7-8fd9-76c22cf8fa5d", "comment": "Malware payload", "value": "37cc81ee3822a85a0d0c00bf84c3ec780616c7579921708cb2ee923b314b4fe8", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909006, "uuid": "d58cd712-7e19-4c3f-b331-9ebef2f2ff61", "comment": "Malware payload", "value": "68cadc4d90faad7bd8db74373c872ddb96f9d73a", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909006, "uuid": "420a8b79-9fce-4b24-9d31-37c1f14a4acb", "comment": "Malware payload", "value": "ef1f5883abeefdb49710104f7d1a355779a2f11d400bfa3939f88c8091f514ca44957637c9b6a4e73b1e29227a0a8b01", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909006, "uuid": "caf8c997-063d-48e6-b51c-09ee7ed94cfe", "value": "T1F9C533319E3BF5D7807E0A19655253B39AB2FDDC181AF404F3B59ADC21CA4F5A0C2E62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909006, "uuid": "79a66ee8-8759-47f4-906a-50333e5fee3c", "value": "49152:DJMych6OZaIU6M9yZ29jsE4dKi4qi7/RhQrM+mvsx562dQ10LIKR7aL4gxQzg+5:DJmAJI9M9yZqQEmKlqi7REM+mvb2TEKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909006, "uuid": "f48e2303-9b8e-42eb-8153-19357aeabe22", "value": 2564096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909006, "uuid": "0ed921f1-77d4-4988-93ab-48f373d6cc15", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909006, "uuid": "233ff3e9-d1e6-4acc-92c2-4feeadb1ab26", "value": "37cc81ee3822a85a0d0c00bf84c3ec780616c7579921708cb2ee923b314b4fe8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7485936c-d689-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652864639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864639, "uuid": "2d5be94c-399c-4250-9ca6-861addf91dcc", "comment": "Malware payload (Heodo)", "value": "345724f456cae2b6e0e67de112ec27b4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864639, "uuid": "ae84c879-a148-4975-a442-603fc238ebca", "comment": "Malware payload (Heodo)", "value": "3851535eab0982ddce562c08dae8198fec85b78636262631dd30869245006707", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864639, "uuid": "50bc9f6d-8a42-4d30-bdb5-9293b93a20c4", "comment": "Malware payload (Heodo)", "value": "e3cd52151f807cd5288cc80d2db02ceb6cf14b8a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864639, "uuid": "a0064e70-3ffb-4be0-8fa9-a8364ce975b0", "comment": "Malware payload (Heodo)", "value": "45b2b5891c8e7703b99a6486bee2b17dc9ade92f0e8808785a42b59d4e5ca8526a6d2c28314fde7611787eeafcf464b9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864639, "uuid": "eda89f60-bbbe-4c61-980c-4d2b2f52bc91", "value": "T17F94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864639, "uuid": "10e44c8c-279a-4f1c-a2e7-3aa787fd920c", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864639, "uuid": "eea707bb-108f-4b9b-a626-a329cbad7f69", "value": "12288:M3hV6Pw4aT23s2obd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Wi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652864639, "uuid": "ca8e771b-8f71-4b9a-ac0a-bc0a7a061d5b", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652864639, "uuid": "7d8a7f5b-b35b-4993-b90d-f77bef64e6ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864639, "uuid": "75ef316e-6368-4237-b777-624ac31f3163", "value": "345724f456cae2b6e0e67de112ec27b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b1a2c2-d6aa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652878648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652878648, "uuid": "41f57e9d-e79d-422c-8d5b-33418121f40d", "comment": "Malware payload", "value": "2209f275caf109eca59d42da9867acac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652878648, "uuid": "fe0c3dc5-1448-47be-b741-dd0c2e46c452", "comment": "Malware payload", "value": "38be045c7a70a9e32c5d998df90e8e3da3a7d29edae0833b2f47ab91bb3cee2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652878648, "uuid": "c256aff7-c689-464d-821b-b7cac3318748", "comment": "Malware payload", "value": "ca88eba59920b58059474418f3f7c535b3631218", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652878648, "uuid": "59aabd32-8068-49ae-a956-c12de830ee91", "comment": "Malware payload", "value": "de233652b84bce29f73decf2c0b3d6f943406718a27631273d10cdd1e076a02b05c2ca28f3454f951436e3fb46a87b5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652878648, "uuid": "d67dc993-1461-487f-9acd-7abfe9e65569", "value": "T113647C1233E1C877D5A601334A92C359B2F6BE51AD3686477BD03B0EEE70252CF25B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652878648, "uuid": "28d1b1ec-aead-4881-b5ac-4f174795bfc3", "value": "4660d4f55970ca074db150bc25297558", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652878648, "uuid": "9caab42e-2b51-44d5-87d4-53aa7b69c02e", "value": "6144:ULwpEFWtfJqN4ACGWkDQoYshnGMApM9LXYKEPf:NqN4ACGWCQmGMApM9T7EPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652878648, "uuid": "b81ac6b1-eacb-4394-a43b-609600154eb4", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652878648, "uuid": "88942e8b-a72d-485c-b7a7-aa7a2ce49462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652878648, "uuid": "f54843b9-9572-4d37-89e5-be2cb5326f64", "value": "2209f275caf109eca59d42da9867acac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9a5c61-d704-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652917670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917670, "uuid": "486db7be-0d2e-4789-9d8b-fbcad5ce62ff", "comment": "Malware payload (Mirai)", "value": "b5c38795f4662d549d90ed80f7054671", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917670, "uuid": "6f1bb38d-ddeb-46c7-b133-22a44a874256", "comment": "Malware payload (Mirai)", "value": "39525ae01d6e932c46f476bcec4ab7c87f7f56ddcab26d39b2c7be91b312fe9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917670, "uuid": "4d2e3204-eb0e-4e76-9ee2-ce219551d627", "comment": "Malware payload (Mirai)", "value": "5bde6d3fcbafbf9593cdc2f71ffecba4fe766cc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917670, "uuid": "ac23f413-8082-489f-be25-c247195f499d", "comment": "Malware payload (Mirai)", "value": "f6846b6124122cacb14e8173e46748a643ac5e5a81df03a1f3d7d4887f1bb1a007d66e79458a0307b623c66a188cfef7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917670, "uuid": "5f92c58f-d953-4165-9912-2042ccfb4cf0", "value": "T19A73C519BF610FB7ECAFCC3749E91B46298C945721943B367934C818F68B25B5AE3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917670, "uuid": "43611598-9757-4fb1-8eae-ba673f236202", "value": "1536:cJfEFvGQrH19rskjDosd2dT3IROY9lbWZephJT:cqGQrH3rskjDou2VUbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652917670, "uuid": "92aaa798-b73b-41a2-9dd5-aeb5eeab847d", "value": 78244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652917670, "uuid": "6fbbcdb0-5a90-4e65-a47a-fba1250e4ebf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917670, "uuid": "d41a22a9-ed5b-4755-b363-cee79792d3ca", "value": "b5c38795f4662d549d90ed80f7054671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bcaed1-d6c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652889933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889933, "uuid": "da61f239-c30d-44ea-a498-038d7fc00bc1", "comment": "Malware payload (AgentTesla)", "value": "75cfb120b8c16328b07bc41d2388754f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889933, "uuid": "5a932b5b-a701-43a4-b464-7872a4418ca8", "comment": "Malware payload (AgentTesla)", "value": "395eecdb77b7712a6b03d2aadc271d3aba5819af234565ca0d7a5a69bbb901a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889933, "uuid": "841c534a-c37a-46b1-923c-e8e407f9fd6c", "comment": "Malware payload (AgentTesla)", "value": "2ed0972afd14199ea054e7ab8276d72c49b8ced5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889933, "uuid": "d39b6aaf-a11a-4e2e-87e8-30f1c208e7f8", "comment": "Malware payload (AgentTesla)", "value": "cbff5f03938b9d516aac9b91a53e1dbcea26e4ec5503d2da49fcb6723cca7351c03e86c21605c97eedc9089f2eb3c2ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889933, "uuid": "f00bec9b-f0c3-44aa-9472-f06da517faf0", "value": "T15CF49DA0367B0B96F9288FFC00A6217147F13172E66BC2991F93B5EB1451B9B1EC095F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889933, "uuid": "ecf10fe9-e5e3-4cf5-921e-31f533478c5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889933, "uuid": "93c6fce5-c0fe-4371-b849-0f4d09bbe5dc", "value": "12288:1Yubx2LgCbMzXRUgv5TzfyIGssdRBfIjaXH5ZnoFuwLbizutt9cAoLv2DNcst:1Y+2c3hUgv9LGsuJIjaXZZnSLPhtuL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652889933, "uuid": "3fa9946b-7c8e-4b9c-9127-f08cec3feb31", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652889933, "uuid": "0220b6ab-71ad-46be-8dd9-1be82fb542f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889933, "uuid": "a0be80c5-2d02-4f20-b6f2-ccfbb323a96b", "value": "Cotizaci\u00f3n tipo de cambio 18.05.22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f5d0cb-d65a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652844539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844539, "uuid": "01470eef-e109-40d3-9cb0-9fe8c5e2be65", "comment": "Malware payload (Heodo)", "value": "1d2fb1ef3cafb42e1604435109f1834b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844539, "uuid": "2bf1855c-c0fa-4ba4-8bd5-7ac12b2f6193", "comment": "Malware payload (Heodo)", "value": "39b0f58b8658e9d60b9ee239fe4c7107ad7e43eff67ba6be37d6b236edf57c90", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844539, "uuid": "00b89790-eebf-41a5-ae2d-013f70cd8541", "comment": "Malware payload (Heodo)", "value": "17c2c3560eff1f1b2a4d8a8a1ec439039ac522e0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844539, "uuid": "d06e1e63-dc77-4c2c-86fb-582b93f4d344", "comment": "Malware payload (Heodo)", "value": "d361c471b51e1e187cb1265d3b21590c319a564b5743ace2bdd4ecd0dc0f2f6ecf9431fab72e04c952a6f6ff5af6e72a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844539, "uuid": "9f5f05bf-f79d-4116-a715-0d54a0f0b9e1", "value": "T11994CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844539, "uuid": "0fc48628-2a6f-4a61-b8bf-1d2aa9d0fd84", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844539, "uuid": "070e80aa-1208-4186-a85b-f706ac17b45f", "value": "12288:M3hV6Pw4aT23s2ofd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ki3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652844539, "uuid": "de1c3f19-9c3b-4cba-978a-5cbf4fbccfcc", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652844539, "uuid": "bb03c4b2-1292-4553-b2ad-525d66bd5931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844539, "uuid": "ace5f008-67a1-4e4c-b599-9f08ee6d4a5b", "value": "1d2fb1ef3cafb42e1604435109f1834b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f507dc53-d652-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841232, "uuid": "6ad15b49-8f1e-40d7-b479-60cf3b39fb6a", "comment": "Malware payload (Heodo)", "value": "85e39db9c4dfdb014f04f871a829c5fb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841232, "uuid": "f5f4ffce-6b58-401b-a95e-eb3023a8a964", "comment": "Malware payload (Heodo)", "value": "3a059f24f2b9d86631ab98f887312196d4878ac5b89d092b0621dc5563c847c5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841232, "uuid": "0ffc5c15-de42-4938-9d55-7d216d41473d", "comment": "Malware payload (Heodo)", "value": "ff7ff30a2d49b8e385e17d1c534acbf2a27e7f73", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841232, "uuid": "246994b3-22c7-47b4-a25b-f2efd53fa389", "comment": "Malware payload (Heodo)", "value": "33cf4f40cb9482a05b12ba3af88b31b01229cc7a10882b4e8ee5336e0b764c59cf9e45c6e241eb1cba7071f9e4342c7b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841232, "uuid": "70c2e16d-6591-4525-810a-eb36924d2fa1", "value": "T11D94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841232, "uuid": "609020fe-43e0-49fb-9102-5055c5056790", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841232, "uuid": "fcabc764-07a9-4f10-b8fb-8120ee8c230c", "value": "12288:M3hV6Pw4aT23s2oId9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ji3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841232, "uuid": "e4a351af-b30e-4279-bd45-5df8d621ecc3", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841232, "uuid": "a1ad9de1-df8d-4c01-9d87-c65be5bed20e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841232, "uuid": "d9de60ab-abce-41ad-9d44-4433494649c8", "value": "85e39db9c4dfdb014f04f871a829c5fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba4e791-d687-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652863604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652863604, "uuid": "c4d1c2c0-b557-4765-b11b-99b14eeb93b0", "comment": "Malware payload (AgentTesla)", "value": "e069e17913271fb059e4aab74eb7c771", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652863604, "uuid": "08be0647-3713-41fb-9096-b33dbf3b7692", "comment": "Malware payload (AgentTesla)", "value": "3a13239ecf04c3bff2995ab036f9cdd78aa59fb72857c1e99374f5720f7bb170", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652863604, "uuid": "eaa070d1-a5e5-42df-b31b-a51b10a9644c", "comment": "Malware payload (AgentTesla)", "value": "8c621ecaac7e191762b8c57914d4188868e4dc2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652863604, "uuid": "bb510ba0-9d95-4cb0-b759-ee3ffcc9ff46", "comment": "Malware payload (AgentTesla)", "value": "a0874c15c5d4ff191d367e8334547ec8a0c6b00975383ee3e78eaa91e306f57b2a518e1dd1668cfa7197eb14faed7ec9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652863604, "uuid": "b1cc834d-8eff-4e03-85e9-da82a9eb5cc9", "value": "T1C325CF0EB7997E86D15A2F35841343A883F9C0636736F3BB29E4AEE218127DD491F117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652863604, "uuid": "fdecf169-869f-41f1-916c-26ea6139db3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652863604, "uuid": "2b2b1dfb-8341-4129-8143-c5d199cf8037", "value": "12288:Ob7UbFoOxJDdN9+B/Ftcr781Jhj9nxz6usac1KvoG721pYCS7te32PjosnCgQNn:Ok5QnkaL9nt4acRi21pc7GIf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652863604, "uuid": "e6c031d8-8d5a-45db-b239-c93cb8aceb4f", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652863604, "uuid": "38e9989c-853d-41c2-9391-24765ac9d581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652863604, "uuid": "ea768bc7-2fb6-4634-a237-ac9af5631bde", "value": "3a13239ecf04c3bff2995ab036f9cdd78aa59fb72857c1e99374f5720f7bb170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb139d17-d660-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652847255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847255, "uuid": "0e63f125-c009-452d-ae60-b3b4db396b4e", "comment": "Malware payload (Mirai)", "value": "ebcb1e78979d982e83fd93be4b39313d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847255, "uuid": "eb73c514-2580-4f16-b286-04de8515761c", "comment": "Malware payload (Mirai)", "value": "3bf232c2cfb93bfb89560403e7e5fc41f9c12405e75b362ac44fdde3343ea14f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847255, "uuid": "59e3e129-41d1-47cf-b1ab-9f3b1eea1438", "comment": "Malware payload (Mirai)", "value": "ecfdd2fffa27eee70e22bbf794aa96bb7674accf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847255, "uuid": "91352d94-5b6e-4d8d-8985-0616f8422d16", "comment": "Malware payload (Mirai)", "value": "a019200fe74d860035e60f2a1e4aa62e50ee0f399084bc0422d0a5b90ae02790783b830300f70075d297270e989c4062", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847255, "uuid": "e54433da-2f4e-40b1-b3aa-8e50af79461a", "value": "T17E93C509BF651FF7ECAFDC374AA9170624CC651A21A93B397934D818F64B24B09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847255, "uuid": "6c4a7c90-da45-4ebf-8c67-636d66908523", "value": "1536:4xME7bIdRtA8RRkDUFJBLq5Bx8qKt6bWMZdMDjiwhF:4iE7bIdRDRko2Kt6iM1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652847255, "uuid": "2fff4327-4720-4c63-b72a-cbddf539dea2", "value": 92652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652847255, "uuid": "76123d51-c004-47f7-9b3f-ee247dbe78f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847255, "uuid": "19c74a7c-56ca-48c3-867e-fb0b4122795f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d13352-d65c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652845213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845213, "uuid": "a7cd9f9d-e9a4-4edd-b318-c54df8bf4035", "comment": "Malware payload (Heodo)", "value": "f89333673fe9ae933944d7ed4c4a8e07", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845213, "uuid": "dc4a8ca2-c1f0-4976-bf81-15b5d86c6e16", "comment": "Malware payload (Heodo)", "value": "3c51d55da6f72d7fb136b57ac391a897537bb3bf24eb04e49e8b8eb8ae3cf93a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845213, "uuid": "d11ce8dd-7f51-434b-82de-3dba8640c323", "comment": "Malware payload (Heodo)", "value": "9bbd02a02b100bd0668d920ba050dc34f0e2b7e2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845213, "uuid": "baccc683-dcaf-4032-a202-51705949e262", "comment": "Malware payload (Heodo)", "value": "6c337db0a4b1ac692cc4e8c79f007e37ae7d57f560021aa973f518bcff9fd19f70ec84fecb11e79fed955c7957bd1dfc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845213, "uuid": "4ec1e30a-63a5-47e4-99b1-b18cc9606762", "value": "T190A48B4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845213, "uuid": "9650d4e0-7eb2-46b2-bb51-b7e2528baa0f", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845213, "uuid": "fbf8c779-158e-417b-8129-c497e14b77cf", "value": "12288:uS4BnAed8BK2o0awa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANK/a34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652845213, "uuid": "af10dccb-f850-40cf-b024-cdda953e902b", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652845213, "uuid": "43b804c9-9476-4f11-a6a4-b93f3cb13a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845213, "uuid": "fb7e298a-77d9-4fb4-bee2-d42f0f9ccd25", "value": "f89333673fe9ae933944d7ed4c4a8e07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf2770f-d6e8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652905266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905266, "uuid": "c915afed-143d-4050-afc3-e50493a95047", "comment": "Malware payload", "value": "d6de7def8f0d920507755b3efd967399", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905266, "uuid": "a680b154-48c6-4dca-8447-d47441bd7723", "comment": "Malware payload", "value": "3c6e97a2b1779842702f234206ea3fd824ade829685471d86c70d98eed6520c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905266, "uuid": "04208c2e-27a0-4101-877d-3e32ce17cf34", "comment": "Malware payload", "value": "1d7890475e0b32e24f19d2cb27bbe1af0c78a11e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905266, "uuid": "65c25949-cda4-4ce0-92ec-1ce4697ae8ee", "comment": "Malware payload", "value": "392aba54cd82c11f2d277b65b334458db219d8c4d2f5589705cef914e0238b5b161618dfe67d8ab0f650471c4a3c6688", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905266, "uuid": "c0c3610a-e0c7-413b-b167-1a5282fd788d", "value": "T13705283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905266, "uuid": "0613f884-8f2c-426a-8b3e-457eff02a732", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905266, "uuid": "3295ef66-6a51-41dc-899a-e531bf057150", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7UmpE3:BTg9UXRD2SeqfZZiAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652905266, "uuid": "5b8e1fa6-349d-4e4d-8047-60ee3f12d104", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652905266, "uuid": "7e64307d-49a3-4bcd-851f-db1f6670e526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905266, "uuid": "93688b73-c207-44a9-be69-72cfe55ae763", "value": "d6de7def8f0d920507755b3efd967399", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb2eef6-d654-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841973, "uuid": "11e372ba-659b-493b-a8a8-cf7d3c8a81ee", "comment": "Malware payload (Heodo)", "value": "9aa4e8aafc133fc38eb197335beab790", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841973, "uuid": "bb844356-1999-4121-98d5-12279600fdf9", "comment": "Malware payload (Heodo)", "value": "3d9e695ab2fda292dbccf904a30544895d7f094001e8bda0cca755774db84e4f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841973, "uuid": "0a440847-01b9-4ce5-8925-7a2ebcb2b285", "comment": "Malware payload (Heodo)", "value": "94fee4f11f36564b6a0d9b06cbd92e8646e03475", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841973, "uuid": "29252b21-9217-4d0f-a0f1-e67a7fcb4808", "comment": "Malware payload (Heodo)", "value": "885c339aea208373fa88a27c8df0017a9f2830cedc08fec8fd62b2a1000f409f45f8f24fde122e736918edf31f4bb1e5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841973, "uuid": "4ba4aeef-a238-409a-a8e8-8c9e25f5ac00", "value": "T15BA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841973, "uuid": "ae8015d1-4691-450f-869f-ca00965ece44", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841973, "uuid": "b5c26b94-7b03-4b2c-af3c-c4d2a4cfc87f", "value": "12288:uS4BnAed8BK2o0aaa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKBa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841973, "uuid": "e3d8c267-ad20-4f00-82b8-807e4b3c9b56", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841973, "uuid": "23f4df0b-d570-4971-88d2-e8d7912e7065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841973, "uuid": "d52fb11a-c34f-4d01-988c-d0a4f7bc9661", "value": "9aa4e8aafc133fc38eb197335beab790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc7dd94-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908950, "uuid": "097fbf8a-5d8b-445a-a62c-cd705b88d68a", "comment": "Malware payload", "value": "9e5342389c612b2063a66f970c56d141", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908950, "uuid": "4bb75ca1-99c9-4d72-985d-1b48254206ca", "comment": "Malware payload", "value": "3e81750806950bdb1559ef90df2954c8e89bf802e9be5d290f9657742cd7759f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908950, "uuid": "1b372351-b695-4372-bdbe-42263372d44f", "comment": "Malware payload", "value": "7ea780555ce2e678731de59e7d680170ec2c1311", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908950, "uuid": "6d5d980b-aa53-47ee-9ee0-f67b9cb8fdd5", "comment": "Malware payload", "value": "3295bd7f7d7cff9a550f151a00f9a015ecb762abaff81b16b3665afe330e1d1cf8cdaef00a6917ba97262f6fdbc0721e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908950, "uuid": "6e88b6ad-b065-4543-92e2-c8d5e31dfa5b", "value": "T153E210058EE34950A373F46667CDA4097F9B84C74F8BAE243C4D529AAF9137493F4A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908950, "uuid": "eb59672d-1940-49dd-a6da-2bafd006bd7f", "value": "384:AIoq47z2YEERHBC+B4z6JdfB7SevtTJJJ2JJJ2efveSPN788T:AIoq47z2YEMHBC+7XDPiZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908950, "uuid": "7aaa463c-dc25-4c57-aadc-389821acac5c", "value": 32857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908950, "uuid": "cc1faf46-99f2-4145-b071-46b9bab5b9f1", "value": "text/x-perl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908950, "uuid": "f82871f6-af8f-4a9e-8b23-f42b746632b7", "value": "3e81750806950bdb1559ef90df2954c8e89bf802e9be5d290f9657742cd7759f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff818f20-d6c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652888495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888495, "uuid": "e6be6c0c-585e-4cb9-9aa7-88f4972cd36f", "comment": "Malware payload (Smoke Loader)", "value": "4183fdaae3671eb00cb32af2da6b8f39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888495, "uuid": "9a14a1b5-5539-4c46-a21b-53655f1b4413", "comment": "Malware payload (Smoke Loader)", "value": "3e81f3497be93eb5332e0635a74a360c07871c7f3c48806ad82659533f3d2f5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888495, "uuid": "b85893c1-27de-4913-92f4-1ba32fed6af3", "comment": "Malware payload (Smoke Loader)", "value": "8919a112016e104190774233e805340d2bd2c8a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888495, "uuid": "dcd579b7-9484-4f54-8865-bcad0b566aa0", "comment": "Malware payload (Smoke Loader)", "value": "5daf4d60eb737febd4fdee16ee55bfdcddef34c507e7b5d4aec5a5d70308156387eb1581e560ed00bef025816f857354", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888495, "uuid": "0191b20d-dceb-4636-853c-4d03aba07920", "value": "T18454AE11F7D0C875E0521E7048B4DBB15B3BB8225670944BF7989B2F1FB33909AB632A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888495, "uuid": "820e9a3d-3538-46ec-9249-8c4fc3540285", "value": "772437747c205badf1dd67f2dee75de8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888495, "uuid": "e2f198c5-98e9-401d-bcc7-aa0218a42250", "value": "3072:HLldjM7uEqWofCa35d4cesxkgaBChUpZa9uD6Vdyhkd:r87udWen4cbiga3wVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652888495, "uuid": "43eb7e0e-dd84-49df-86ca-9b07bc1111e8", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652888495, "uuid": "d1daf414-e7ad-4bcf-8082-e2a1cbe0dc45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888495, "uuid": "1b767e61-4b72-4afd-b1c0-82af36e6e1bf", "value": "SecuriteInfo.com.Variant.Babar.52465.7107.27532", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff53ce3-d6ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652892602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892602, "uuid": "2e66d603-7940-41e6-9432-9fa837bdfc10", "comment": "Malware payload (Mirai)", "value": "0c7309ab4606d7aa5e050fa4bc9e2d32", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892602, "uuid": "c150f151-ad28-4d59-9466-a87f1b06e855", "comment": "Malware payload (Mirai)", "value": "3e9998199ac33db878a22e5b3093b2fdc9b763c6837e7ad9adede822bd79c8ff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892602, "uuid": "ecf55e97-5552-4506-9153-630564a561c3", "comment": "Malware payload (Mirai)", "value": "7a82273e7d017f86bde37399b520243b35d0a1f5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892602, "uuid": "104c0727-1b22-4a2a-8eb3-1de32b07f9cd", "comment": "Malware payload (Mirai)", "value": "533ffdef93b2a8fa5714a5fa9876b6652118a381b8c8e2abdb7e1b8b1bc28e751f7e7497e3a61d4b29a1af22958f69fb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892602, "uuid": "f8d813c0-5fff-46c8-b368-d5351dd601a7", "value": "T168536BC9A593E9F4EC110A71717ABF338673E13E301AEA83D398A573BD41642E10729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892602, "uuid": "bf7e7e89-7908-4200-a418-f2b9933cbeec", "value": "1536:Qa2gpfCCeK74vc1KOm5lgMnxiKze8eNAvfEB+X2Mizk4ahYoLz5xqOE5tS7q6:mgpfCCeK74vcI5lgMnxiKze8eNAvfEBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652892602, "uuid": "f38ebcd1-d692-4164-b35e-3bc08de6ef66", "value": 66448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652892602, "uuid": "a91a536a-de70-4bb0-a05a-ed519489a72d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892602, "uuid": "d516d1ee-df92-4979-9926-c8dad454d826", "value": "meerkat.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d50ea4d-d67c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652858909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858909, "uuid": "316813fa-5eee-4be0-b079-45569222a55b", "comment": "Malware payload", "value": "d8303334d443f4bd2a8167374787b3ca", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858909, "uuid": "c1de2e45-0943-42a8-8270-50a1064401a6", "comment": "Malware payload", "value": "3eb1aa70fa3505927b52dbb84b702ffde2eee28674ab6fd73077f7d04f8a1d45", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858909, "uuid": "b1aaa56e-62e4-404a-a916-00bbbc3ddb97", "comment": "Malware payload", "value": "c3472cc632a212deb0d51dc85e57b32d2de6c704", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858909, "uuid": "2dab536b-0232-4707-9a04-4dc1aec494d2", "comment": "Malware payload", "value": "c92c5394b843d1d56987a7f1c9e9c89a670faeb54596e659376b00378b61e378c8a4f2f1edd79914423fe426900a6654", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858909, "uuid": "0a964c01-a29f-41e1-a14d-3534730c8ebe", "value": "T11551E02829EA6118F5B3EFB16DE97595CFA6F97378125DDE0042030B8912640FC91F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858909, "uuid": "4de165c3-e2d6-4f1a-affe-b7c27b834aae", "value": "48:8mehOc77vzXcx34gCViRdqlQBUosz98OqH24h4ab:8medPzAylQsz9xy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858909, "uuid": "5e142056-04b8-47e8-9b24-9a79df8310a0", "value": 2638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858909, "uuid": "1c79167c-6ee3-433a-a34c-3ba1b9b66ce2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858909, "uuid": "f1a0cde7-f14e-447d-b20c-feb92d075535", "value": "County Contract - 2022-05-17_1856.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72958301-d647-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836289, "uuid": "27191b1f-4415-49fd-adca-493e240a4630", "comment": "Malware payload (Heodo)", "value": "d74b72479814da0930278a021a4735de", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836289, "uuid": "db551de0-7f34-4b2a-b570-451fcb0e3faf", "comment": "Malware payload (Heodo)", "value": "3f539be1c8fa525b1e24f4fab9cf4cb3ea33b49eb11fc7938968333d976f0c6d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836289, "uuid": "f4576aa4-9d48-4712-98ba-eb636bb469f9", "comment": "Malware payload (Heodo)", "value": "25092c6218631008951da013f0513f8575cd9019", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836289, "uuid": "c5af3e91-69c6-4fca-b5fc-ad6b59d1c3a4", "comment": "Malware payload (Heodo)", "value": "4033b0be44c38c23beabac93509655b5771b899d359eb8b786ac1a45e6f5183e4802437c92d8c54038eaca07baf1ea64", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836289, "uuid": "f20e7b6b-92c5-4d3a-bfdc-9fc9448c17bc", "value": "T13EA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836289, "uuid": "ae7dd7c9-373c-4afa-90d4-ea7db902891b", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836289, "uuid": "eda2d7b5-2d29-4599-9a06-dc26b4942eb6", "value": "12288:uS4BnAed8BK2o0aPa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKea34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836289, "uuid": "512a1dbd-3153-40c9-ac89-6b25b435abf1", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836289, "uuid": "0b7b4e53-360f-4f73-a76f-20ff287758a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836289, "uuid": "3323607f-1886-4bd5-be20-7328e8591843", "value": "d74b72479814da0930278a021a4735de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c1e25f-d691-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652868044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652868044, "uuid": "955bbc89-f7c7-484b-a193-227cfe55972b", "comment": "Malware payload (Smoke Loader)", "value": "505382fd3c3894f1a735aeb8d99fff79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652868044, "uuid": "b59d051c-4a5a-40cf-aca9-a074c0c0210a", "comment": "Malware payload (Smoke Loader)", "value": "3f89fba90859c4f64e63edf60b10f9f07165703eced2bdf954eb5068f205d9c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652868044, "uuid": "4bf71034-c536-4936-88f1-903c83489ce1", "comment": "Malware payload (Smoke Loader)", "value": "bcb05f6e37b87d39de6f9dd975fad8214df75521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652868044, "uuid": "81c49da6-b521-48be-923b-714e5524b093", "comment": "Malware payload (Smoke Loader)", "value": "434807b61116c59e039be8cb08f2ca2ec783362f013c0d044614fda67f04aa7c57c5b642628299d15ea3d2f2dbae681e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652868044, "uuid": "abda1b32-f49a-46ea-b865-a7158819774c", "value": "T1ED54BE01F390C470E0A62E304875FBB15B7BF8625574684BF7949B6F1EB33909AB631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652868044, "uuid": "ffa4e311-6a0c-40f5-821d-c03f07265539", "value": "151adccff5e70213fb31de55ca880f7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652868044, "uuid": "ed13adaa-52f6-4cb9-916e-eac6579610f0", "value": "3072:swgDh5ZTZY4eAmDM+E/0sxkgaBChUpZa9uD6VdyhkN:lmZToBM7Biga3wVfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652868044, "uuid": "b0b7d77f-3d00-48ea-8c61-e9de8108d586", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652868044, "uuid": "860033f3-3cef-4412-979b-9dcaecf706ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652868044, "uuid": "c455e6ac-b20a-4c0c-b05b-007ddb757855", "value": "6523.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c9bd8e-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652858781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858781, "uuid": "1f5e2833-90e0-4a0f-aab7-7479facd20db", "comment": "Malware payload (Heodo)", "value": "2715d503f1ea84f97fb61d54846f53fb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858781, "uuid": "0e3352ec-e67a-4434-87d4-914c3beee8e4", "comment": "Malware payload (Heodo)", "value": "3fa07d6672e9c1831b957e52fd0a2eebc1d8b354a9103bf85eece4d9cd74f30a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858781, "uuid": "e17759a0-a72f-4a59-98ec-80ed58d82b1f", "comment": "Malware payload (Heodo)", "value": "0e7c6308eeeff5ec99079cd36ab69288a1614eee", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858781, "uuid": "db317de2-bba8-4d19-b606-18145a343156", "comment": "Malware payload (Heodo)", "value": "3c8146073f798a2be3cae0909d367f160fee6ea97e6b2921ffd7477d338e17341e0d5dce7df0ff2897695a89c6a50d6f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858781, "uuid": "3793f385-aaa7-423c-bed6-cff3ae7282ee", "value": "T1DC94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858781, "uuid": "180f57ea-d793-4573-9011-12b32751391a", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858781, "uuid": "553d9bd6-fafa-4b7d-a6d0-21d699bfa972", "value": "12288:M3hV6Pw4aT23s2o/d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Wi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858781, "uuid": "a11d3a42-c43a-45e7-af94-a3ffc048bd29", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858781, "uuid": "31b8ada6-fe8d-4df4-8cc4-593bde5ac1e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858781, "uuid": "d168dd7a-415c-4478-8fe8-9b21818949a3", "value": "2715d503f1ea84f97fb61d54846f53fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a103f2b8-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908952, "uuid": "5e1eabab-11f9-491c-915d-072136d34bd0", "comment": "Malware payload", "value": "27f03af6ba54440c1ee33466d9cb634d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908952, "uuid": "2abfb0c2-3dcf-4215-a7c4-bf52f6bd1080", "comment": "Malware payload", "value": "412a12b22bc6c104aab3ad25c878d1fde00828462325ead2ab3cd7ab0e3cef53", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908952, "uuid": "05d7fa31-90ae-4108-8401-6824da000e96", "comment": "Malware payload", "value": "97cbf11b534ddc34ce644b3df3abfc1ad02ef313", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908952, "uuid": "c1ba38a3-f0bb-4581-b700-4aa449fa793f", "comment": "Malware payload", "value": "65af5d1611b4669afedce6829f4312b4dceda9345e07e7c54dbe4c7e3cf1bc11d62a67ea3581fb56add0327991e10f97", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908952, "uuid": "5c010e82-2ca7-40b9-b018-ccdaf93b06f2", "value": "T11B2165C633A62AB12D99A92B716A484574C4B686A8C5BF5428DC3DEA488DF083445BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908952, "uuid": "34c49bec-9e59-4d3b-a2c3-faa6874535f8", "value": "24:wv8WbDv8WTv8WVc4Nv8WjK8v8Wzv8WTDv8W5Bv8Wx9Pv8Wp:wvdvRvA4NvRzvRvBDvzBv39PvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908952, "uuid": "317faf69-930a-4cc1-b5a2-7563615e1f9c", "value": 1192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908952, "uuid": "56da2c1b-4b45-4174-8f4a-bdb631d48cb8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908952, "uuid": "935eaeeb-32ad-4c8c-9119-8f726d3a69e4", "value": "412a12b22bc6c104aab3ad25c878d1fde00828462325ead2ab3cd7ab0e3cef53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e07ba12-d703-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652916946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916946, "uuid": "543f53e1-5413-4375-a207-1f4c8f85a5be", "comment": "Malware payload (ArkeiStealer)", "value": "3d1d048187f54d5961817a5866042e13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916946, "uuid": "5492f93a-5e1d-463f-94ea-bdb1a5a6eced", "comment": "Malware payload (ArkeiStealer)", "value": "41be5f61865ee6502ddad6af8bdfc5c5c1fe132e555cddd19634fef1c6068dc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916946, "uuid": "aa599cff-f205-45f2-8db9-01c2b07b20ea", "comment": "Malware payload (ArkeiStealer)", "value": "1fa3c9856f49ebe802f81062a0030482ea24bf68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916946, "uuid": "f462ea50-023e-4f96-9c85-59fc4ba19bdd", "comment": "Malware payload (ArkeiStealer)", "value": "83d9b7909a115fc56ce0c2790e81719577a06c1f7d7ca395fc26f66f5d44828ca1cb621a51c343fe024bc17f5878ff12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916946, "uuid": "8ccec364-9249-407a-96d6-b8a08f228dee", "value": "T1FF94AE00BBA0D035F5B326F54ABA92A8793EBEE15B2450CB53D52BEE56356D0DC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916946, "uuid": "da37c0d2-db10-41fb-84c4-cd52786517b4", "value": "0328a7958ec44d4b27f5ea8928c8e8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916946, "uuid": "3cac010b-c37c-4961-8e9b-493bc96d572c", "value": "6144:3o+gOu4zscAqjWF3sCTTbsuWy4lt2gfZz5yX3Fz772uGCLJ+hU+M0kRot:3o+tdfViF8CTTbsLtzSX3J772uGu+eA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652916946, "uuid": "f2523ae5-8b4d-4650-bab9-3375082d15d8", "value": 433064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652916946, "uuid": "4c693847-5162-4296-b9a3-dc0de3972a1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916946, "uuid": "37c3c9d8-3819-47a3-b5d5-af387bc326fe", "value": "3d1d048187f54d5961817a5866042e13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb02390-d64b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652837895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837895, "uuid": "120190b7-3843-475b-a0c6-2617bf450e32", "comment": "Malware payload (Heodo)", "value": "d069d1220c5f82f4ef2555e89c1bea42", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837895, "uuid": "34701a48-adb9-4b98-beac-e302120f5174", "comment": "Malware payload (Heodo)", "value": "41c4d8e9057dc725f0c47122c7dcd34c99f8c2403b45f2153b1b40347e9fd707", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837895, "uuid": "2e6bb4c4-40ee-48ee-a084-17a1532070ea", "comment": "Malware payload (Heodo)", "value": "24b18018c4cc8d41a3beebf0342312552d4ecb80", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837895, "uuid": "a5ab4715-0167-4431-8df0-fdcbfd1ce92b", "comment": "Malware payload (Heodo)", "value": "c33465f3eb5ed102eafd7a7a22716a68030ac2d4838d7bfaedb14b0bb0c2e9bf30f6e9bd73fd6d79cf4ab83128202985", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837895, "uuid": "8d896a03-f539-4f8d-b664-3cb6bc38e044", "value": "T1DA94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837895, "uuid": "2c79aa00-aaa6-4541-8db3-70420c7b9aa1", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837895, "uuid": "7d44211b-2408-4a1a-a9e4-f851f6ae7ffc", "value": "12288:M3hV6Pw4aT23s2oMd9zi3BBoNIQ/hsA7:Yb6Pw4R3s27i3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837895, "uuid": "f7015bad-4aec-4118-a239-21cf4fe556d4", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837895, "uuid": "d953f42f-79a6-48a1-ad22-ab11f738c911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837895, "uuid": "940a1eac-c763-4e2f-b11a-1d5abf2be0d5", "value": "d069d1220c5f82f4ef2555e89c1bea42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553ec197-d66a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652851272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851272, "uuid": "36b8de9e-1719-4d59-848a-a35864bc4e4c", "comment": "Malware payload (Mirai)", "value": "66015897f0bbcd2344440cde2ac21163", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851272, "uuid": "7be4e86c-7fb9-40d0-b381-05c510606a11", "comment": "Malware payload (Mirai)", "value": "41ee73fe779cf62b1aa65ffd391c3e09d163e6fd4c3186e6d23ec07629d4f196", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851272, "uuid": "8374e1d3-8ec9-4799-a5c4-56ef712d060b", "comment": "Malware payload (Mirai)", "value": "b97474fa3c8aee77bf9eb92e94198444dbda77fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851272, "uuid": "c6e3ea71-922c-4b79-b3fa-39eeb0072597", "comment": "Malware payload (Mirai)", "value": "e645be1feaac90163cc875da22c2e6974bbd99367b60a83373841cee5dc2449d746ecad2913300501a50fefa5461208b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851272, "uuid": "089a5530-e657-4d90-a7ac-d1f3e9499bec", "value": "T1D582D07B1F62352FC45855BEB3091EE4E61DDE0C27AC824DC75C9E49F2871AA607C1E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851272, "uuid": "09719590-25f2-4e70-abce-646f9ccdf72d", "value": "384:MojuoDNsGONkia2R6NXxtg+RfSQoCGJhCO70+xkWH:aDGbYR6NXRfLZHfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652851272, "uuid": "e65e5010-36c4-4ac9-98bf-21cc9e26d372", "value": 19052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652851272, "uuid": "3d9d219e-ab63-4030-a12c-27c1bf98cbd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851272, "uuid": "838d6c45-f47a-4890-9777-60ffa5cca0f8", "value": "66015897f0bbcd2344440cde2ac21163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e0e5e3-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908992, "uuid": "2607ff19-8c04-45b0-a96f-beda27574833", "comment": "Malware payload", "value": "a54a0f6e79c7e4927021f2b5e3cdde9b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908992, "uuid": "c66a4fe8-f50c-4692-9a81-33bf9ae5324e", "comment": "Malware payload", "value": "422460b7c6e1ec07ed223f33370b922bad5af40a8d287ce4505106c0688726cb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908992, "uuid": "700eed62-ba39-42ab-b1fc-970220391a25", "comment": "Malware payload", "value": "c9599c529a72f1d1837c534137817d6ff0ea3de7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908992, "uuid": "e8d986e7-7832-4d18-98a7-d59a93d81614", "comment": "Malware payload", "value": "55cee427e46f6f89c367909265706b36fb78050f02de364e7733357ba43132dac1d1e96264ae7ee2f65b5c2a08c8b66f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908992, "uuid": "38ad1784-27d3-4b6e-819e-46278121f64a", "value": "T103A1E650112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908992, "uuid": "bf0ac6aa-355f-411b-a89b-2b55d4ba3879", "value": "96:rRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908992, "uuid": "ad48cdfa-9ac1-4052-84a9-d04095bcdec4", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908992, "uuid": "fb056cc4-c95b-43cb-be41-f3c251abb41c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908992, "uuid": "7d149322-d380-468f-92fe-97e13b563a0c", "value": "422460b7c6e1ec07ed223f33370b922bad5af40a8d287ce4505106c0688726cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e93c96-d67c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652858865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858865, "uuid": "6b2f9f18-64cc-481a-9b16-f6b43a1c2ade", "comment": "Malware payload (Formbook)", "value": "9d3b79c56ef25087bbebc165e692ab61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858865, "uuid": "29340215-9d03-4360-b3d1-46f9b971ecbf", "comment": "Malware payload (Formbook)", "value": "423414951e84e3276b4bd7436fb382393da69a5b92e1c2acd89387d20d065df6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858865, "uuid": "ff96596c-cb93-45ba-854b-0fcce24ea6f1", "comment": "Malware payload (Formbook)", "value": "1bb6c014dd9fb11e8f0b7197aedc0588dd4b7733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858865, "uuid": "6e03194b-60e9-409b-8fe8-7fdb783efc0d", "comment": "Malware payload (Formbook)", "value": "75a48af54b69a5b5942d320d934cc97730b590839ad74903688df3a1d770c5497dcca7c20c0cc39224ac76ec09744551", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858865, "uuid": "90243081-4a2d-45cd-a982-0bd2eca3c2cc", "value": "T1A31473E2D124809ADEBC1BB2AC776D7831A33D396DB4B00C967FB63557732D2049A50E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858865, "uuid": "4e197655-1a7e-46c1-a3ae-5a6214afd534", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858865, "uuid": "240675a2-000d-4e97-abd8-77cef0b850fc", "value": "3072:sLT10if4eAlnFouxhgHv5u3xdbCrJihJZCN5i6aTzep4bP8mJrI8ZH:KVABFoWPxdGrJi36aTKp4DX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858865, "uuid": "f924c9eb-49d2-41e9-9f9b-b321eec58ee2", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858865, "uuid": "379b4c15-5168-4db3-b604-14f88a6e474b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858865, "uuid": "d752a871-f052-419b-8ee1-f8c72ce3b79c", "value": "Pepsico LLC RFQ Information.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc635783-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652858800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858800, "uuid": "19b3e6bf-eda4-4b8f-8d4a-248562e0c063", "comment": "Malware payload (Loki)", "value": "07cf462fc4e3db6e4067273d2669dbcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858800, "uuid": "721188f0-ef94-487c-b9bc-2ac6b744605b", "comment": "Malware payload (Loki)", "value": "42b9985586ad99224f2b238f89dcafda4c2dea3c6c76a70314e6080c41f0ab01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858800, "uuid": "ed60bb10-b9fe-4f9b-933c-e0120d418bb0", "comment": "Malware payload (Loki)", "value": "6b3925aaba48a0b863d60ecebeb46c1570240670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858800, "uuid": "6ecf4dfb-cd17-43ee-be74-0eecb1aa55e4", "comment": "Malware payload (Loki)", "value": "52747f8ec496ae938ff5b33fd6aecd09f00d52ed13a30b26104ad6c1014ca376e87e07984e3ef610d1ef6593f304b72a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858800, "uuid": "5afe7567-9081-4575-bb2d-68307855c4e8", "value": "T13AD4F11D7A96EE22C26983B6C0C3902403B19587A337D68F2DCA63C55E037A65DC97DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858800, "uuid": "1ceb7806-ed3d-40d7-aeaf-effbaecaab16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858800, "uuid": "5341ffe1-ec20-4d40-95a8-c85f52186080", "value": "12288:4/yLacLUuRqZQSb4axPWRvm4zi+4giw4lt:4/y/UxqC4adWw4zim4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858800, "uuid": "83346bfb-59d5-4c17-9fc3-b6b51f2e06dc", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858800, "uuid": "3558789e-3190-4963-84c8-3b3c78fec4a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858800, "uuid": "e98115b1-6c1a-45dd-9ee6-e95ed637a552", "value": "Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f0f45d-d64b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652837870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837870, "uuid": "55587eb8-4858-437c-98e9-3fe1a0176def", "comment": "Malware payload (Heodo)", "value": "477940e18f95e741e68dc9e1a722acee", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837870, "uuid": "0dbbf178-31de-4ff5-afcd-d592063d867e", "comment": "Malware payload (Heodo)", "value": "43239fe724610ea64b0e440d5613459b9d4fa678668e08de41b12ab541b526e1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837870, "uuid": "7a255f8d-1525-4d51-9254-5253d7257ca4", "comment": "Malware payload (Heodo)", "value": "ae618d8a07d4ddd8df382cd4de7ff345a0db4de7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837870, "uuid": "d60ac8b8-0f2b-4627-82f3-5dd86c4e9465", "comment": "Malware payload (Heodo)", "value": "2bf01563f69ae8a59766acec3544d3d6f060b18795ddb1ef0575826b0e4cde91ebf70e593a8e027afc6a84e1ea760410", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837870, "uuid": "ca13ff97-4cc1-40a1-8e7e-e5b010fafdf5", "value": "T17594CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837870, "uuid": "18a4b051-e80f-47f0-ac6c-8dea784abff1", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837870, "uuid": "bba65c44-f27a-4ee8-b0a3-c9fa76f564a2", "value": "12288:M3hV6Pw4aT23s2oKd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Zi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837870, "uuid": "2cdb3660-76a3-43d5-99cd-c1efee5394d4", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837870, "uuid": "652cbad4-6acf-4377-98d9-9815950bb464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837870, "uuid": "b013f891-7234-4e4e-b761-650abeb87832", "value": "477940e18f95e741e68dc9e1a722acee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0778a6d7-d653-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841263, "uuid": "65b2f0b3-0906-4fb5-9151-0fb695dc2e98", "comment": "Malware payload (Heodo)", "value": "5ac2ebbed2bfc355d9fb8a61ef0999a7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841263, "uuid": "696e694d-cc2e-4187-8d53-d44d14ce28b8", "comment": "Malware payload (Heodo)", "value": "4404f29b232eb7b7754ce54babce633279f7b6b3ed50155002d32892aec80f70", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841263, "uuid": "0feacc83-18c4-43ee-ae52-2d6220eb6ebe", "comment": "Malware payload (Heodo)", "value": "5bb2106394255398a2d4959e1788d50fc218502d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841263, "uuid": "c5ab435a-1c2a-4dc9-9fd1-cb7c5149de96", "comment": "Malware payload (Heodo)", "value": "b0fca76b43f9a105524d2dd4f4d7b42ce708c85cfe8c152f4d46ff705dfd544df23a7ff80eb47109df0140d5bd070346", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841263, "uuid": "c0b49891-58c0-49d2-b09f-570f1b85d24a", "value": "T19CA48B4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841263, "uuid": "b45ebd1a-dfab-4a11-98fc-2304bf4ec3af", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841263, "uuid": "43b5a242-1221-40c4-a8b8-3288fe8f7731", "value": "12288:uS4BnAed8BK2o0aZa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKEa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841263, "uuid": "50e84faf-ae6b-41f3-82d9-d9f5b9ce8060", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841263, "uuid": "222f9bce-ca12-4872-8084-c384ef7818a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841263, "uuid": "4bd7f160-1b44-4809-9d06-90d4e68f658c", "value": "5ac2ebbed2bfc355d9fb8a61ef0999a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8cdce5c-d6db-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652899945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899945, "uuid": "78fcae5b-34e2-4ee0-a1d8-925898b2b8e0", "comment": "Malware payload", "value": "41023fe0e0f9d03aaf64340a72458fec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899945, "uuid": "145ad352-7f36-4f11-a5bb-dac0f968048b", "comment": "Malware payload", "value": "441ad6533996d616f24c1d8e26aa4a5565f7d5db1862cd359c91e9caa79822de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899945, "uuid": "ea73e787-64cb-4ea7-b423-c0f2c7b20335", "comment": "Malware payload", "value": "a63c2d3420dc74f16f2cdb8dfd188cb703f5ed5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899945, "uuid": "3e9e1c20-2485-4db1-bb25-221da8b91bdf", "comment": "Malware payload", "value": "7357a955c2e3a6e21eacab5ad57ef574fb6f904672b7e908d70e6cce56a57a128bfd86a8dd758df68493b9a66e0c562f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899945, "uuid": "36069a8c-ebd5-4274-8348-73a23f54ca97", "value": "T10905283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899945, "uuid": "df17f8b7-592a-4e65-9167-ffa190477b93", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899945, "uuid": "8a706995-712f-40d7-9ed7-9f3c80d9ad0e", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7smpE3:BTg9UXRD2SeqfZZiQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652899945, "uuid": "6eed185d-0d23-4644-8956-c4c23941429c", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652899945, "uuid": "273a127c-2100-437f-bf34-5e9c0524a669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899945, "uuid": "49074d2e-7f4e-485e-a880-528300692893", "value": "41023fe0e0f9d03aaf64340a72458fec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b218d66-d6b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652884783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884783, "uuid": "459db2ee-dd20-4ff2-b231-907f4c338eec", "comment": "Malware payload (Heodo)", "value": "704e230aaad41cf37659f03dd142e5a5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884783, "uuid": "6eb7806c-0293-4160-baa2-1f726fd74768", "comment": "Malware payload (Heodo)", "value": "447edceed7f0ffb448467761c3a12bbf0cc87e645445839a3812c8a9f5798c05", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884783, "uuid": "dc6ad5ec-74d1-47ed-81d9-26718f2dc117", "comment": "Malware payload (Heodo)", "value": "b3c8eb6f171f840d0de0b9c6ec3af6c8ece9723d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884783, "uuid": "3765de0d-26a8-44b9-926c-c1a3193dc3cc", "comment": "Malware payload (Heodo)", "value": "949d9d19c6d4b30d7b184ef55bf078bf3d85d7b45268fb2605ba43f603202c3db2fe5c7a529f8d1d8ff5c03f68db9717", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884783, "uuid": "a5e12bce-3818-41f2-9255-766b68f88fe4", "value": "T13A94C04A73A50CB9EC7282798C574A01E672B8150771EA7F03E0875ADF2B3D1A93F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884783, "uuid": "c94b9e12-5d73-4c40-a285-0f4f310da9cc", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884783, "uuid": "360eea17-5fe5-4b24-88d6-9e9b01814c2b", "value": "6144:GgIYnzcJxDpmJIyeV2vR3JDEohQEuRfoP1SKL0w+d7sWOQSH0E9cWdb3BHq:yKz+1pcIuvR3lEoyEu+9T0Rd4Hr9H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652884783, "uuid": "9b42022a-3e5c-4f3c-ac1b-259e9edbdf7c", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652884783, "uuid": "5ac40193-72a1-44ff-a73f-389cd5604d07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884783, "uuid": "6f8c4183-3f5b-4497-9c74-61784598d0d3", "value": "704e230aaad41cf37659f03dd142e5a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0f1561-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909048, "uuid": "2c3de090-6dc1-4d0b-a2a9-db464b14a521", "comment": "Malware payload", "value": "0b767271d9f875f000e979b1f04a66fa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909048, "uuid": "07fee321-351e-4c35-a443-57c9b9d6a121", "comment": "Malware payload", "value": "44c0dbf87b701f4d1f1d3fd2f94d8a75edd972f9ec297599f5aabbda2dae5ea8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909048, "uuid": "2d98af37-4068-4298-8b66-8bed3e07cfcf", "comment": "Malware payload", "value": "90fb08a7f8423ed74aec9abf81370aa89e012b34", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909048, "uuid": "be9d7d9e-4e37-4684-800f-33fcf663aae4", "comment": "Malware payload", "value": "d875dcbbbce0b96e6ef4f5c90de2034917faa07cdb4de14466f087ae91c3615f6cfdf835663000956b268e8d095cd406", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909048, "uuid": "5695919b-1bff-4345-865c-385c770073fe", "value": "T18EA1F750112C1AB07346697AD26FFA52B80ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909048, "uuid": "1ffc9b98-8041-49c1-8467-2c553801ecf2", "value": "96:HRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:HRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909048, "uuid": "7730dd4c-1a3a-4633-acc0-78167e346e3b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909048, "uuid": "554e106f-382a-4e86-9cda-1dcd7907d9f3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909048, "uuid": "0940f92a-f43a-4d64-bb33-cfc64e437556", "value": "44c0dbf87b701f4d1f1d3fd2f94d8a75edd972f9ec297599f5aabbda2dae5ea8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1544b9-d676-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652856461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652856461, "uuid": "18122c5a-9c47-491d-8f8c-3ab9f5085c76", "comment": "Malware payload (AgentTesla)", "value": "cecfb2fd1bf4aba031e54763130c22b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652856461, "uuid": "95acd4d5-a5f9-4e05-9f6e-9d08d50f2b2a", "comment": "Malware payload (AgentTesla)", "value": "44f663eeb66184ce6236d3a89a9d03579309dcf45aa1e370fe2e4250340816e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652856461, "uuid": "86f2eff0-5288-4304-b864-76143f18b52d", "comment": "Malware payload (AgentTesla)", "value": "a146694ca76a6f462f19e336c7cecce39630c50c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652856461, "uuid": "73588dc8-b369-4a08-8001-5c2c28651744", "comment": "Malware payload (AgentTesla)", "value": "b55186c75b2ae68e9e7f79563f57229596e1b3bb8df7f4fe7450b9b831ae306aae518a40df7554d817f45c926e7f2e81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652856461, "uuid": "67d3724b-2ad3-44a3-b695-7e611a460d0d", "value": "T11445120A715CA727D4BC7FF9105122A443B5E52B7015EB6C3FCE81DA7BAAB402660B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652856461, "uuid": "e0c01bf3-3fd3-406f-af2b-00b4fa23fc9f", "value": "12288:qsWsFYvNRmxgcmomM8UHTivxZTuRV4FSxT8QwD5BRxv:qsWsFqvmmcmoziJZO4FoT8DD5BR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652856461, "uuid": "4c9ad3ae-08ed-4311-9b18-9487b4a93bef", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652856461, "uuid": "002fd999-6909-47bb-82d1-83ab4fc2d5d1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652856461, "uuid": "32b9fd07-f028-4e98-ab3c-9b859bba479f", "value": "JB Quote.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae86b0e-d6dd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652900701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900701, "uuid": "088c65ce-6dee-47f2-be7a-5f5f5a62a1ae", "comment": "Malware payload", "value": "e3d9ac246370c2705b34963b96f3ccd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900701, "uuid": "4dc460b9-a53a-439c-8808-dc54b825f822", "comment": "Malware payload", "value": "4540d93804c87e23a55abba0b85451f4fab05085caf4965569c635a835acfdf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900701, "uuid": "084e99ba-465c-455a-9823-d296c1713ef7", "comment": "Malware payload", "value": "7ffd0dd4090c581635ac7b27dc30aa8aad45b510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900701, "uuid": "5fb2277a-a0d5-4a03-9821-c7daba6569b1", "comment": "Malware payload", "value": "458f8688ab1563614c98e467848c6fd5d7aec7a339b574ce6c91a70e4f3dd2330011147d9337175d4528b56fa2b1f081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900701, "uuid": "fdbd71e4-bde6-4533-9f63-c7338840ac61", "value": "T18005283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900701, "uuid": "d2e9a458-3b61-4d7d-8ac5-774f14d6e0af", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900701, "uuid": "e4150756-38ba-445a-8061-8bf83e19f683", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7tmpE3:BTg9UXRD2SeqfZZipm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652900701, "uuid": "e3bacb06-a004-4f0c-ac4e-63a7ec74c2e1", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652900701, "uuid": "835cf6a3-8a51-482f-ae55-91e04a36b616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900701, "uuid": "65adf7c4-b7df-4b2f-a8ae-1d3d7f18288f", "value": "e3d9ac246370c2705b34963b96f3ccd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13436909-d6f5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652910862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652910862, "uuid": "670e3e2c-0c0d-49dd-bda4-355a960da54a", "comment": "Malware payload", "value": "298a18db753d40380aa41c3cdde1825c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652910862, "uuid": "656797a0-281c-4026-8dd5-34682d025b7c", "comment": "Malware payload", "value": "4547b578ed4468731e348a47a16a26beeaf192c616b70d575f3a04328978a981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652910862, "uuid": "cca742d5-d45b-4c7e-b52c-39e469fa0c2e", "comment": "Malware payload", "value": "a54eb952b7687bd8ad82c3934e3a3538547fb4a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652910862, "uuid": "58f526b0-ee2f-46cb-b5c6-1e6bfb7a6bcc", "comment": "Malware payload", "value": "53fd63bfc56cd52b7c8644032a766d2802ca6d11e609ebf0e443f5fe2e6b1332c1b58a99981a098c73dff73eb69c5edd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652910862, "uuid": "a0ccc298-acf0-40cf-95d2-1ee1e34b5662", "value": "T141845B2B32968F5CCB2A0373648D64504B617F9F6043C6CEA6C97EB6DDA1322C517F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652910862, "uuid": "dd68c6af-ceaa-4d48-8685-d89b3579f2fd", "value": "6144:rqJbcjfxGqz7J1Bn+F7potY9kxq93hEnU:rqpcj5fR+MO9kMREnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652910862, "uuid": "3bb25952-c218-4e86-b76b-baf496a72a22", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652910862, "uuid": "a8342155-c7c1-4e0b-b4f5-e75fb92bf751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652910862, "uuid": "9c493895-0391-4b9c-80b7-d9be801a3483", "value": "298a18db753d40380aa41c3cdde1825c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7cd03aa-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908963, "uuid": "c7eb3918-ccce-4470-8e01-787c2fb6591a", "comment": "Malware payload", "value": "6014260e6cd43b5d0f11052e5a9c1375", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908963, "uuid": "70a99b1e-945d-49f9-985f-89447cb178aa", "comment": "Malware payload", "value": "45c6de4d5b1397876197c510a78b1966fde5a2916d96ce7129e730705c423079", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908963, "uuid": "0446bd13-819d-4e98-87d9-8aa57996128c", "comment": "Malware payload", "value": "be5141e4643480193c84ae4b6baafb49590ae13f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908963, "uuid": "5a2b1aae-a407-4c10-9146-a1d70decc0f7", "comment": "Malware payload", "value": "5a2fc65b11ac25ea02fdd736f7e459981f18d872b87d2a74aa35b3d9ee4fedbc2a2949a2fb0d56e36bea29c3f8a58f23", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908963, "uuid": "f7e2bce8-ee16-4215-bee9-44f4f813ad3e", "value": "T1DFA1E750112C1AB17346697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908963, "uuid": "1858bb5f-5b79-4227-9e21-764a48435bd5", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908963, "uuid": "a5637534-5dc2-466d-bf95-7993056e6c41", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908963, "uuid": "4c745a14-b962-4bc1-a94d-6ce2336bea82", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908963, "uuid": "9e8a1afc-d708-4101-84a4-c14b8c86c70d", "value": "45c6de4d5b1397876197c510a78b1966fde5a2916d96ce7129e730705c423079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b9eee0-d6b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652884738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884738, "uuid": "32bb6012-e16e-4f75-a5b1-5dc355126d56", "comment": "Malware payload (Heodo)", "value": "732aea47e5b369fa6773c6b5d5add502", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884738, "uuid": "38ee8a00-86e4-4937-8820-f541e9354813", "comment": "Malware payload (Heodo)", "value": "461ad4550f1daa4d4eff12e011f5ac7fa1dad64ac8b4562d8d2958f291770014", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884738, "uuid": "4b04cce2-c5f2-4666-a652-a3f192a3c73a", "comment": "Malware payload (Heodo)", "value": "1068e759154aaf951cfe3230ca4e470c19ed964f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884738, "uuid": "fe214413-8b0f-45c3-9877-659bdfb13d44", "comment": "Malware payload (Heodo)", "value": "a27ec652095551a8d642eb20ad5ccd5868271a14ec66a35b4d2f14bd47ba751a7000458474c81707d49e8e1305522ea0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884738, "uuid": "ac6222d9-9594-4996-8b2d-99930d27742f", "value": "T1FD54E007A2E940FBE9678278DC570B06D3B2B81257659B9F037147662F1B3A14D3EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884738, "uuid": "966f164f-da5f-4f4c-a840-28b267918378", "value": "8814d1a94d80f9b49a103ad2cb419460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884738, "uuid": "80555819-5249-436a-b363-287f1d96b373", "value": "6144:yRjSsk3AzLPQWlgbZJpDphv4MOTRqhTAK3yUil5FCsCfHG72:ojVhTQWqblv4RqFAKiNL4tm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652884738, "uuid": "dba85f7b-0f07-49d2-8d6f-2e865c30fd74", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652884738, "uuid": "5b201c39-a227-4b2f-9d7b-2492fc78072a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884738, "uuid": "ef9d4e7a-4bdf-4d93-bb23-f6125b000728", "value": "732aea47e5b369fa6773c6b5d5add502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a849696d-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908964, "uuid": "d6c07945-503d-4edf-9f54-ae47399dac87", "comment": "Malware payload", "value": "b0a9df25bc5e8cb366db5fad75453981", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908964, "uuid": "0e7a603a-3bba-40dc-aa55-79b3dba53190", "comment": "Malware payload", "value": "462fc0c39bf1c30bf063b5c3e06fda69cfbf612dc123301d2edd31ad9b3f41b1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908964, "uuid": "0b31b718-5715-4ca0-8055-eab11f50976f", "comment": "Malware payload", "value": "bdf86393b073535b622f895ed5d920a74685b213", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908964, "uuid": "bbadece8-032f-4f17-a7bd-f88a7dbc4eb3", "comment": "Malware payload", "value": "0f3f8d59e94820c3e72f9c6837e808c1c6d8b7166882c3c67f369f60e182de1fe4b56ab9f6436e840b279d097610a42b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908964, "uuid": "7a57a829-0634-4d7a-a991-14ffde81de83", "value": "T1F5A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908964, "uuid": "0721e891-0e70-4502-95aa-304295b276bc", "value": "96:7RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:7RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908964, "uuid": "94f44a41-5a61-4641-a64f-30f8cd5a487e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908964, "uuid": "dab23c05-34f2-4e2c-a4be-0209c296cd1a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908964, "uuid": "484416e0-1428-455b-ab23-7ca0df8c159f", "value": "462fc0c39bf1c30bf063b5c3e06fda69cfbf612dc123301d2edd31ad9b3f41b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34696f06-d640-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652833178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652833178, "uuid": "461beaed-3ce7-4faa-83d0-be25162c2d0e", "comment": "Malware payload (Loki)", "value": "1d0f883734eb02e89eb694ad01c21a86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652833178, "uuid": "4bc812bb-638c-4654-81d8-4658c0321758", "comment": "Malware payload (Loki)", "value": "465168d19bfb65cdd4f4d7e12e7597484eaf1d728bdcf37aa7919d0fa2fd55d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652833178, "uuid": "c9c34707-d15d-49a9-af6e-d049823cdad5", "comment": "Malware payload (Loki)", "value": "33455bdda3a09c30bd708259c60145947ccd05bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652833178, "uuid": "2ebd14b6-cb17-4b44-beb5-2a8209309a9f", "comment": "Malware payload (Loki)", "value": "fe5260d93e781436daa6cca4ac3d400722382ab8211e3d9cf40b1cf25be5dcec711d85b168964b658232ab441a2c5696", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652833178, "uuid": "20e4a23f-fa24-4a12-b3a3-a664e96d6235", "value": "T1E0C3012875A0C4B7F5B21B720EB60727AEF6E62309B86B0B17804E5C3DB3651D51E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652833178, "uuid": "87749f90-890e-4ec5-ad82-91da35156b90", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652833178, "uuid": "fb63088a-2ab9-47a6-b5c3-1de5dffbe048", "value": "3072:VfY/TU9fE9PEtunbAKmtB+yLx0YiXgaJYP48rz9:ZYa6VAoYiwaJY/z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652833178, "uuid": "b2603cc9-de59-4980-9441-02e57720131a", "value": 126913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652833178, "uuid": "fd1e1b08-e5f0-4919-8f72-21622e679662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652833178, "uuid": "f8d36be5-dd4a-4cce-93b9-b65c49e70212", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cac7409-d6bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652887792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887792, "uuid": "cc4846ca-d202-4039-a550-a751ae2dcb07", "comment": "Malware payload (Heodo)", "value": "57acc6589d591a5aac3edfd8cb9c198e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887792, "uuid": "aa7e6b40-9b52-441e-961c-5f87670b3e34", "comment": "Malware payload (Heodo)", "value": "46b403902be04f31506ad157539b9d6df966813b30c58cef50cc6fa7e2e7f10e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887792, "uuid": "33c792aa-4bb0-4115-88a1-3b389e32bc19", "comment": "Malware payload (Heodo)", "value": "8ea02b15c77cd4123729fc9f3df67fef2502cadb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887792, "uuid": "f8d07ae4-2098-413f-bd50-0e247dbb73a2", "comment": "Malware payload (Heodo)", "value": "1d643925f5a03ecff04bb0db217c7182f4ea27b938d3e0d5c8b48b5ff83b30e1a936871e5766ab8a1d3f504fb3cfa8c7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887792, "uuid": "fa0d9f81-83b8-4d17-8bc1-3e0acc41c871", "value": "T11D54E007A2E940FBE9678278DC570B06D3B2B81257659B9F0371476A2F1B3A14D3EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887792, "uuid": "1397da80-4c32-485c-a2ca-2df51f072feb", "value": "8814d1a94d80f9b49a103ad2cb419460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887792, "uuid": "6a89192d-fd30-4f7e-845e-cb66b4169da8", "value": "6144:yRjSsk3AzLPQWjgbZJpDphv4MOTRqhTAK3yUil5FCsCfHG72:ojVhTQWkblv4RqFAKiNL4tm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652887792, "uuid": "529f6bac-2c54-4fba-8abd-774216dbdfd0", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652887792, "uuid": "58b27edd-c9e2-40b1-b676-d0b0a084e6e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887792, "uuid": "396f22af-3d76-4bf9-9444-2b2d03a24cbd", "value": "57acc6589d591a5aac3edfd8cb9c198e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22edf7d-d6b0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652881520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881520, "uuid": "eb61a521-d4d2-473c-a1c9-46e0f0bfc72f", "comment": "Malware payload", "value": "d75c635ae63b383b6ea342fea21f1cd9", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881520, "uuid": "efcc4611-2ec8-483c-828f-63418137e22c", "comment": "Malware payload", "value": "47c63408f8d32a7ffb87255b1a1cb5cbba3ab580bdce5e639f3d727b914ad322", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881520, "uuid": "e666f8ad-729a-4a73-b1df-b4f0d5a4398c", "comment": "Malware payload", "value": "fc1683e416623894658b95b8f77164663149c9f5", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881520, "uuid": "df089472-e04a-4445-b8af-effec3bbfae5", "comment": "Malware payload", "value": "d52862235593084ac728b9908d81e5992812d257dfaaa590a7e337521807506aa73baaf083a0699c3ef5e358411b7491", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881520, "uuid": "29b25bec-25e0-446d-9cf7-8b046351e73c", "value": "T12A2412D5F5F47A5FF3A825315FD0F86EC29AED297A43890D9DDAF010C839AB0261D248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881520, "uuid": "70e1f8f0-b43e-4719-9ee7-1414d1c74f05", "value": "6144:wy6jBR5J2Kx90FoyhlNHaFkmnEyR+zL2ViMa:F6j/xo6FLT+32Ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652881520, "uuid": "5172d241-8851-41ce-a2c2-e13d188e8d11", "value": 228904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652881520, "uuid": "7ee6bf46-401d-4574-ba1f-d137e7a42366", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881520, "uuid": "42b348bc-4e83-4a5f-b235-830040162afc", "value": "PO91372D140.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c393d2c6-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652858759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858759, "uuid": "ac3e4c35-75a8-44e2-8412-66e23bdfbff0", "comment": "Malware payload (Heodo)", "value": "c4e6562a93ace4e0db407f47cbf3408e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858759, "uuid": "9bca2e03-ea9b-441a-9cdb-86fba2e46c58", "comment": "Malware payload (Heodo)", "value": "47ebd562d1e255a4cfabcca51a077b0b9f87ca4d053dfc96eb9873e4aeafa0a1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858759, "uuid": "9f43a4a3-ae61-443f-8833-9d10ad48b5fc", "comment": "Malware payload (Heodo)", "value": "7a41bf77121fb53c5ff9a09ba62887592e409d47", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858759, "uuid": "173a1a17-bf3e-404d-98d6-63e2ab86bd03", "comment": "Malware payload (Heodo)", "value": "2105fb737f888e237a5a81922913d1465615c71d44edb10b18438c7ffc26f57ed7cfcacca7620d947bd0cb4afcb011fe", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858759, "uuid": "2ad81580-6e2b-40bd-8182-9bdf6a31b65e", "value": "T15994CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858759, "uuid": "d6274367-27f0-473a-9875-028f45e04934", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858759, "uuid": "e9ef9b92-c61f-4f6b-ab39-45a382b2db70", "value": "12288:43hV6Pw4aT23Guoqv91Wuwf07EIvH3+38+:sb6Pw4R3Gu3Wlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858759, "uuid": "73012c2e-54c2-4bb7-87cd-edebd782c0f6", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858759, "uuid": "a53d7a58-91d4-4924-9bd1-af4c2c8e4327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858759, "uuid": "1542651d-a076-418e-864d-ecd1a6dc564b", "value": "c4e6562a93ace4e0db407f47cbf3408e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0cf72c-d6dd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652900674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900674, "uuid": "e25c07c6-4c53-4af9-ba3f-7649b9f4b47b", "comment": "Malware payload (Mirai)", "value": "ea8ed2f3c7ca0d12851ae147afe6f13f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900674, "uuid": "c5a47623-56aa-422a-bed8-0ccfbf2f57d6", "comment": "Malware payload (Mirai)", "value": "4808023c31126a16cd3705d6ebefb034c3ac6bbc48deea3736796ffc9c0cb528", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900674, "uuid": "d75209a4-1b42-4a8b-995c-da1cf70531f3", "comment": "Malware payload (Mirai)", "value": "e28e958124de6f279a9f9e744d048d1a446d589a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900674, "uuid": "9d618547-0ca8-4b63-bb6e-78e9c5089c27", "comment": "Malware payload (Mirai)", "value": "0774de29349f252f45aa1ca969fd7f97161e34641a6bc9d4d6995f4ced0a3c3dcd4609a8be9399ec4b0873cdab5f2c2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900674, "uuid": "a4259839-9663-44b0-8a9b-e52317ff34ea", "value": "T15CE20981721D0947C4F32E70257B17D0D7AFAA9220A4E389360FAB4ED572E379947D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900674, "uuid": "ae70fc13-261a-4278-a9c4-832d00104cb3", "value": "384:4MaQ1fLQ/fUGo0rj/C40GbiZSIy5JO4s+N+Uj9BNsjsYQaHlz5LGB25TdZ47/lzN:lTNLQ3UZw/UX05JO4sa5BshH5T5Ta/1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652900674, "uuid": "ae77308d-bd8d-4666-b09a-23c1750a3ed8", "value": 34232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652900674, "uuid": "54f94803-7064-42b5-8c92-323d50408d9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900674, "uuid": "2415de6c-2418-47c0-94c8-1761dbb1a964", "value": "ea8ed2f3c7ca0d12851ae147afe6f13f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b49dc40-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652908862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908862, "uuid": "6366b953-9ac5-485d-85f4-aba45db5eb2e", "comment": "Malware payload (RedLineStealer)", "value": "a09991164ab5ffe88b12dcc6e4441594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908862, "uuid": "f63ac175-15ae-4716-85d9-11a070bae215", "comment": "Malware payload (RedLineStealer)", "value": "486f95c17f83dedb7bf0f28372329dc705483b3f58438b1b56b5d4cb5a73bfbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908862, "uuid": "e8c931a1-5be0-42b8-8bb6-0fb28a57c342", "comment": "Malware payload (RedLineStealer)", "value": "a7b4a93da39de95597d6c48fd10db9da2fde498b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908862, "uuid": "39cb58f5-0ffd-4b25-b964-58bac25b700f", "comment": "Malware payload (RedLineStealer)", "value": "a538db70c57ea1f2c617c2c447ca55cdee58b907251ee5df9eaaefa734eb66f9b21a0943edb8e2d057655f5d6fc77453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908862, "uuid": "a17bc95d-e4f4-4e78-bab6-f39e631be852", "value": "T13794F100FB90DCB4E4221E705874DBB25B3BB8326671950BEB905B7E1DB33A09A76357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908862, "uuid": "7166e506-da32-458b-889a-cb08f8fd2ff1", "value": "772437747c205badf1dd67f2dee75de8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908862, "uuid": "9c7f0a65-e649-4329-97d8-f7bd7a03cdb3", "value": "12288:gE8MjY828RlG06jDYxRBoFL5cK3EhEHP:kMiilG06jDY6T/3EmHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908862, "uuid": "e38b1f28-4f58-4d61-9619-5243b94300d4", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908862, "uuid": "91bded23-e49e-4127-ab48-109dcc5dcafb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908862, "uuid": "1cf0ea0e-f098-485d-b2fa-046c7bb03e00", "value": "a09991164ab5ffe88b12dcc6e4441594.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6574d87-d6da-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652899512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899512, "uuid": "1eea2781-969d-49c1-9649-a2ded81c90b3", "comment": "Malware payload", "value": "5e7b8bf3dbfc447d144ba6b315c1cb35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899512, "uuid": "4990fb1c-a024-4a02-aa26-765ac011defc", "comment": "Malware payload", "value": "48b86185618bb9f59c54001879e023bde84ce27bf29d2c3baed69f57f24e1acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899512, "uuid": "12a6a600-75e2-433e-a71b-c2ceb336cd07", "comment": "Malware payload", "value": "f028bba93adad76281ab0d9a959c229ea8fb28bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899512, "uuid": "be58f981-9795-4e6d-8900-3e9ee87b72a5", "comment": "Malware payload", "value": "1cf9de56b1822c35a809c3a474ddbea2c164f7272b2d7e4717f942fb691956d1e1fa0318ba060a5ce55a0b110a20106e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899512, "uuid": "60427eee-281a-4f6b-b51a-1e782a4a82f8", "value": "T11005273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899512, "uuid": "8756d952-68a4-4611-bd7c-c7422d4b4a91", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899512, "uuid": "81af9a1e-0dd7-49a2-9bf6-24406908a047", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7ohaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy79Ust", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652899512, "uuid": "56bed389-c8bf-4491-b794-1161247df945", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652899512, "uuid": "767291fd-edcd-4688-a9a1-bba448d917a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899512, "uuid": "b215c69d-b577-483c-a1b8-230bd3c1d8b9", "value": "5e7b8bf3dbfc447d144ba6b315c1cb35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6434a5f1-d695-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652869766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869766, "uuid": "158b69b4-fe64-4378-b967-001188f5c74c", "comment": "Malware payload", "value": "f85654ee4b39fabe99694550d8107f6b", "object_relation": "md5", "Tag": [ { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869766, "uuid": "28c71220-d9c9-460b-acf0-dc65396ea21e", "comment": "Malware payload", "value": "49a072c36dab1ffc8279081096c9f329eba162823f09abf3e0628d3a8d4c84f4", "object_relation": "sha256", "Tag": [ { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869766, "uuid": "adda211e-7e63-4e95-a356-f879f47023bf", "comment": "Malware payload", "value": "568066436d7df719fd0065061a1959d75672d596", "object_relation": "sha1", "Tag": [ { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869766, "uuid": "41f82857-bc7f-4592-ad67-1224edceafdf", "comment": "Malware payload", "value": "14732b6f87ed856f9670fd180fa2837243296054d9679b57abb8318f4621db259d25f016c68b11066474dadd4a110d78", "object_relation": "sha3-384", "Tag": [ { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869766, "uuid": "14eeb1b1-ad69-42b9-a961-4f114cde3005", "value": "T1647633FFA72B644C447634F46876D96BE4AC482448BEC03642EDEF425AECCDA295F1D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869766, "uuid": "4f76afcf-2a68-46fd-b26c-1c85a16d03ad", "value": "196608:0jkFEsPiHTeOJIVJJxA8vpWympfmDRQrVzwjgd81e+0qS:ZPgRqHxA92ur6jgdN+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652869766, "uuid": "f742bebd-d561-4607-a2cb-2e460d1a913a", "value": 7594672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652869766, "uuid": "c33c6c3b-383e-4fa4-8fbf-465101c0d55b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869766, "uuid": "257d6481-036c-47fb-bbba-2ab165567f87", "value": "Utube bmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4163116a-d68d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652866271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866271, "uuid": "4430bbfa-d629-40d0-abbb-d1f63bb4a995", "comment": "Malware payload (Formbook)", "value": "0d5c12ef90391b5bfc0dedeca59476b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866271, "uuid": "231c5feb-4ab2-45bd-a51c-7bf4aa1504de", "comment": "Malware payload (Formbook)", "value": "4a03cbfeb260c4c92a31e3c5e9d2ef539122ee9b7dc087a9d4db6073959de557", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866271, "uuid": "fd6962b2-73bd-4424-ac23-975de9231b0d", "comment": "Malware payload (Formbook)", "value": "a45a263471aeee7179dc4a581cd5bb59e662d0c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866271, "uuid": "0542efb8-c466-41eb-8b1d-81d24ea12810", "comment": "Malware payload (Formbook)", "value": "d8d7b3d882a7244145f8f833366591f8d460cf9edc352d0e863824a25aa64e3ef2bdb0a9b0e4a364266a20712d75a2f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866271, "uuid": "1c4cb38a-79a3-4c75-8af9-04fc8c80051f", "value": "T18D2412015FE0C46BEDF32B335C732723CDFFE5455090A26B57612E09AA7A592A92E307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866271, "uuid": "2cf2ce1d-4be4-40db-bf54-d3eddacd8f2e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866271, "uuid": "dba20718-622c-45f7-9f68-6a51dc420c1a", "value": "6144:LOtIOydsR5FNFhzLOftltWIFaL++X7tlP+5:LOLFXhzLOFxavhl25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652866271, "uuid": "4147ace0-f314-4651-84f9-c60153bdf0c6", "value": 215253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652866271, "uuid": "d1b6a65d-f321-44c9-9016-c3770843a4a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866271, "uuid": "448276f0-64b0-4475-9cba-70aaf7c7720a", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5042be-d6fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652913157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913157, "uuid": "9708f825-945e-4a17-9288-317d211d0935", "comment": "Malware payload (AgentTesla)", "value": "2c31a00a50a72c3366ee31a684c3868b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913157, "uuid": "d442c2bc-4262-4928-afc1-cb8a61a4ea15", "comment": "Malware payload (AgentTesla)", "value": "4a439eeff9ac89541417b65a07f9d3a9359dd72d23502f49a8d4e8945cfb7e78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913157, "uuid": "4566393e-2b50-411e-b153-9e9a42db5ae4", "comment": "Malware payload (AgentTesla)", "value": "4210dfead0f423bfe50df3bf64d901e25f41accf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913157, "uuid": "257d767f-a707-4f1c-b0cb-0b16d568f6eb", "comment": "Malware payload (AgentTesla)", "value": "6444cd0b9792b5b3af1638214185210599af6cba397d2dd2df78e44179ff35df113975ae7006134aac2c53cf1dc62469", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913157, "uuid": "07c9f6b7-751d-486c-b175-9836f996185d", "value": "T1B053E952BB048A55E93B1B78442ADB90053A6FBA7835E50D85B47C237B33EC70C99CDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913157, "uuid": "dc2145fb-fb75-43cb-be3a-3861a1c2838b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913157, "uuid": "da0f4b2d-d537-448a-be05-377398bef692", "value": "768:844Ghlpi/1uFIZMYIIIIIIXllllllWvfIIQIWR1gRkg8Zg0kNK2Rpg3tNp1tnZDh:8+lpCzHgeGUvDg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652913157, "uuid": "6a4d2b99-deda-44e8-a027-e0d6a752a6a8", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652913157, "uuid": "f75fca22-9493-456f-8297-a04b88624dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913157, "uuid": "7ad490d9-137d-4342-a098-055e609a9961", "value": "SecuriteInfo.com.W32.AIDetectNet.01.24332.5505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf31c94-d6c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652888492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888492, "uuid": "6d3d9c02-2642-4cce-84c8-5904090956a0", "comment": "Malware payload (AgentTesla)", "value": "9f8508a8d462fce66853aaf6d92aff85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888492, "uuid": "c22f8ce5-1e4a-45ab-aa43-7418ad4db898", "comment": "Malware payload (AgentTesla)", "value": "4ac70e6596359a19fddd3380edc192f01f7e789c9cf8dd3afa68fd5f9ef8bdb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888492, "uuid": "6d7fda26-c71d-4a00-832b-62a200176858", "comment": "Malware payload (AgentTesla)", "value": "66c0be89117db63d88665de9f7cf3d4ab24d0768", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888492, "uuid": "efd71a0f-3ec0-45f0-9ff6-bc143ff252af", "comment": "Malware payload (AgentTesla)", "value": "801f8e55f73703f4e26eb94b0420f8c8957ff79f5e6d2d8a72bd1e2b2ac7f95ab6379099d7661712195ab24fbe4fdeb9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888492, "uuid": "e7813854-48bb-4e2a-b597-ac6d481d1fa0", "value": "T1EF15BF5C3650F99FC557CD36C8641CA0A660AC678707E347A0573AADAE3E79BCE102B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888492, "uuid": "66c696a0-158a-4cca-85bd-67e97281bec8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888492, "uuid": "e0756670-e993-450c-a095-c25a5e87110e", "value": "24576:lmH+5doiRnyiuiJ/sFSETBi+lGj6G6A738:lmiZvJ0FSETBicA73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652888492, "uuid": "d772f396-6b36-4846-ae13-7db013a1c02b", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652888492, "uuid": "eb4ba08a-7051-445e-966b-6a110fbf6ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888492, "uuid": "ea05007c-d2df-4f7d-93ec-b01d6d0b4007", "value": "SecuriteInfo.com.W32.AIDetectNet.01.18208.30620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38670ad-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908983, "uuid": "e2d98f77-a0c3-4b62-9329-9b18f48c9e5f", "comment": "Malware payload", "value": "bb7c4a97f53432f35ab125114a5ec444", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908983, "uuid": "5721ee89-258f-414e-9686-11757a3bbc00", "comment": "Malware payload", "value": "4acf1bf9dbfbab35baa5cb266c0ff6ac5755458f42372ba3ab0ddc4087093432", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908983, "uuid": "21f4a041-db91-446d-bb21-1589c377a02a", "comment": "Malware payload", "value": "8d47895ec7d6298714b5893877d2a4b49efdc968", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908983, "uuid": "d3bfcf4e-b419-4783-953e-b5765ab3830b", "comment": "Malware payload", "value": "4de5384d96d42c67f96255527798f915e0e370794ef79f0588829712424470df9dc302091117df6e7dc68054f3128dc8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908983, "uuid": "bcfeed07-69a9-439f-946d-695bfe12b57b", "value": "T13AA1F850112C1AB07246697AD26FFB52B80ECC1B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908983, "uuid": "af1581f7-e1e9-47ed-9816-02c317b50e41", "value": "96:oRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:oRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908983, "uuid": "1ade7bf0-5f18-4e70-a3f2-3997973ae7fc", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908983, "uuid": "b9b84e86-6fff-4b64-b82a-49fbdf470412", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908983, "uuid": "7f3b5898-9d88-4e89-9fcd-073bc54cc476", "value": "4acf1bf9dbfbab35baa5cb266c0ff6ac5755458f42372ba3ab0ddc4087093432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d407eabc-d69d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652873389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873389, "uuid": "cebd568f-6312-47c7-98df-78578e55b89d", "comment": "Malware payload (Heodo)", "value": "4ef36b284c8c4d7cb02a412c3bcbb481", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873389, "uuid": "4ab74ee4-5866-4b0b-a59e-6758f9810bf6", "comment": "Malware payload (Heodo)", "value": "4b322d68bfb20ac43aa4c0ee7b828bbf3b069d7fd601e842b9eb50992ee133de", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873389, "uuid": "c3dc6167-477c-4092-bebd-867a1ad1c770", "comment": "Malware payload (Heodo)", "value": "0a9b59d824b4ee3c8ca30cc01034cffc19e9ec43", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873389, "uuid": "42bf2d9e-9046-4d3b-8587-0b590c921125", "comment": "Malware payload (Heodo)", "value": "357153e030d8ac0cfc6286bbd6c01857da3f49cd1f2f4df15f58cac1a9a71d25794c7f6db8332c38b46ccab882920309", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873389, "uuid": "4c001e03-e2e8-4e21-a5cc-dad844f02275", "value": "T13B94CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873389, "uuid": "e891cbfe-020e-46e6-9971-3efca307c3ca", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873389, "uuid": "8075378a-9130-41f3-ab53-82ec9d62dd3c", "value": "12288:43hV6Pw4aT23GuoQv91Wuwf07EIvH3+38+:sb6Pw4R3GuBWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652873389, "uuid": "22228bbb-5ff9-4f89-aa60-296136758875", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652873389, "uuid": "28b86bd7-58ee-4d2f-a77b-9627438a1539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873389, "uuid": "8ce75591-243d-4be9-8815-b5a444ee0688", "value": "4ef36b284c8c4d7cb02a412c3bcbb481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f20d25-d6c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1652890913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890913, "uuid": "85250614-0a26-4f2b-8a11-f59d266a1f76", "comment": "Malware payload (njrat)", "value": "46e26891b3aed0cb658d712de352d177", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890913, "uuid": "10da289a-0963-4ecd-b839-92828db33779", "comment": "Malware payload (njrat)", "value": "4bb5d76d38ac9775d3ab5ebe4e37e43bd9776faea78be75534cb8742240233a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890913, "uuid": "7a3c7ba2-dac1-4b77-98c8-4873e284c24f", "comment": "Malware payload (njrat)", "value": "6ace8312a07c6ebfb74bb049ede117f9aa675a2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652890913, "uuid": "b9684cb5-7076-4d73-a73d-7f20920d0965", "comment": "Malware payload (njrat)", "value": "2c519b14b3f01d77b481ad7d4a4ff44c2b1c86239785b6471d10f68be603f07a52f532f900468389bc20544388d8ef94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890913, "uuid": "b7a8cdf8-0303-4d39-a80f-5bad1eae39fa", "value": "T1D71733596F820D32C11205B09FB757F686FE9C01AA9097E797D74EFAF8346A0B2051E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890913, "uuid": "48095188-a92c-479f-8f5e-1b2126468468", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890913, "uuid": "2697c7c3-fca3-41f3-af2c-9ab395db4dff", "value": "393216:GolGnD5YH5TWkp+7fWKqWoZZ1wZ0ecI16mVChjQDKLgNNL3Bz9mt9r:GxD5YpWkp+7KZ03cIPshkD3Lxpir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652890913, "uuid": "a4a3802f-581d-4399-9459-9111a57fe0ed", "value": 18624134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652890913, "uuid": "d656015b-30da-45b3-854d-a9b1b20a6d38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652890913, "uuid": "c6cc2d8e-27c3-4787-bad1-7ba2b93e5d0a", "value": "Minecraft-2.69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1118ed-d67d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652859553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859553, "uuid": "4c2dfced-509e-44b8-a6f3-8f9dec12bff2", "comment": "Malware payload (Loki)", "value": "bc2a024528eaa47405d034e16bcfeedd", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859553, "uuid": "d96d2441-c2df-4311-a14e-928760975b30", "comment": "Malware payload (Loki)", "value": "4c2db00031a7f259facdec8a84270af1f1ebf6c68049c565732a2445cb1dee6a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859553, "uuid": "aa1d143c-2b3e-4d47-aba6-33b6f22d3f09", "comment": "Malware payload (Loki)", "value": "277b07f42c839b715a08b61d79eae76b7b8a325d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859553, "uuid": "e8c1fb31-d676-46da-911d-ed8c0a641536", "comment": "Malware payload (Loki)", "value": "4300ccd8be300a634dbb054845f059df17ff1070406d3587382811e195250a7d024451e17bebfa133e1ac4d400b39d9a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652859553, "uuid": "ba42e19b-114f-4091-8a83-6d1facddd495", "value": "T1FF2412FC237C299ADD2686391B1F6557DCB0FCA3D4006E153248378AB77FA172A2D221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652859553, "uuid": "29312eae-f792-43b6-b05b-82b38efea9fb", "value": "3072:wuU8xMQgzU+TQP22APVRVkP0Hl21RXvKjBL8XJA0BlDeuyuruCQ4+3/1CHAFYMm5:pU8fg4+Tu23GP0MR/AhnSl+7z/16AFDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652859553, "uuid": "9fd5d4ba-243d-4da7-b498-7869e878d7ef", "value": 229048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652859553, "uuid": "f3eca1e2-744f-4f4a-a997-9b7435b5a036", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652859553, "uuid": "e0d55ffb-d679-4791-9a29-b3f438ca9a22", "value": "PO No 009.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e148772-d656-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652842617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842617, "uuid": "007a6d71-967e-4557-a3f0-2cf88e811d30", "comment": "Malware payload (Heodo)", "value": "0455e0446e722531ee876fe5e245b449", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842617, "uuid": "b4fcb9b7-d520-480c-a87d-e505b0cb2d36", "comment": "Malware payload (Heodo)", "value": "4c33476adfb202a5ae9730427c5771a32464c11b3fc12a7ee341b217854ce51d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842617, "uuid": "07265d5e-4bb9-4378-b821-b8a0a90791b3", "comment": "Malware payload (Heodo)", "value": "669befa0554db038fe507673abe2f33ccc228f40", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842617, "uuid": "ffb03294-9d0f-4ebc-8022-7de734b536b1", "comment": "Malware payload (Heodo)", "value": "c94a02c160b30e60cc3d6f2d8fa2f96597d434f67ef3faf070c5224ff3f705264d51a7e96eb97e64fc58195725a9d8b1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842617, "uuid": "4fd1831d-9950-45a4-805e-a1251b52d29c", "value": "T1B4A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842617, "uuid": "7e9cac06-d792-453b-ad40-45e5793b7dae", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842617, "uuid": "37640591-f9aa-4b72-9dc3-f850d407fd8e", "value": "12288:uS4BnAed8BK2o0aaa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKBa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652842617, "uuid": "2c9c0056-096f-4d1a-a3be-4aba529d6673", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652842617, "uuid": "9028c6e2-eb93-47f8-8490-b7cb633a9432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842617, "uuid": "a1d73314-d5c4-4652-b769-f42922f7f29e", "value": "0455e0446e722531ee876fe5e245b449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7028e53-d66a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652851544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851544, "uuid": "ff152dff-fb39-432d-af97-db9a3646ade4", "comment": "Malware payload", "value": "0d5987b4eacac4ce0e90bea54043156f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851544, "uuid": "179c47a3-be1d-4f43-8e8c-c13589c64c46", "comment": "Malware payload", "value": "4e23fbc5154e1b07671e3187264ceccd07e64fd8e17e7565c0d28a2c73c51d9e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851544, "uuid": "968a4b0a-6572-48c9-a275-100b7c180d62", "comment": "Malware payload", "value": "e5e923f80e8d7ce82153704523f0a1b3c3c31e0c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851544, "uuid": "70c126b9-7e4b-4776-8a0a-5a9ef5f56c66", "comment": "Malware payload", "value": "daaf9f7cd3b42e95af47552dce2bb6c4ee5e58f60f69621b1e89edd8f86462eeb55bc854279858268565ebf918d47372", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851544, "uuid": "5f13401b-3d86-4c6e-ae74-b58d034d0e5d", "value": "T13094CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851544, "uuid": "c2488849-7b2c-41a1-a54c-d7f9a4413b8d", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851544, "uuid": "802b451a-eacf-4d04-bfe8-a44b4b8c3bf4", "value": "12288:M3hV6Pw4aT23s2o5d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ci3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652851544, "uuid": "964a5a51-8861-401b-abf5-6b9a3f5ebd2d", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652851544, "uuid": "f1c22ec6-1f6a-47d5-bdd7-eba54f5ffca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851544, "uuid": "9bf9b978-0277-441d-b834-853bd31ba7af", "value": "4E23FBC5154E1B07671E3187264CECCD07E64FD8E17E7565C0D28A2C73C51D9E.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a9e295-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908926, "uuid": "804d774a-3c67-40e7-9deb-cf3d9a8282e0", "comment": "Malware payload", "value": "21d8433e52f0b37c4cecb8a5b811f478", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908926, "uuid": "94d416b5-70aa-44de-b11e-672dc8a8dd6e", "comment": "Malware payload", "value": "4eaa9db9cbc3ec97f9bcff1220cda74a6c6aace9c2b2ab7a63817e703701f8cf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908926, "uuid": "030c8eac-f716-4ece-934b-abd22dec820c", "comment": "Malware payload", "value": "0e703a68b1d40e2854db9b9d086aa3dd934b7d4f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908926, "uuid": "14db6376-5caf-488f-a548-b045a2701ab4", "comment": "Malware payload", "value": "e77e9eb88cff0c64be0334da173cd716b923c59bb1ec9448190804ec3d5ecb747d081c08b64a60d84050f37ab123b4d5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908926, "uuid": "f6f039ff-764f-480c-9b6f-d702460f2b25", "value": "T1E0A1E650112C1AB07246697AD26FFA52B80EC81B0A7B7B358473A63C74F9DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908926, "uuid": "573f4601-795b-4f24-acb0-3cc05662b6c4", "value": "96:wRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:wRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908926, "uuid": "cddbf869-b638-41dc-a69a-23c7479004a9", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908926, "uuid": "b33f738e-7442-4a7b-a434-51a31dd47448", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908926, "uuid": "2a2c2077-c740-4b28-9dc0-0dd684b82f51", "value": "4eaa9db9cbc3ec97f9bcff1220cda74a6c6aace9c2b2ab7a63817e703701f8cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcbd70e-d69d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652873402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873402, "uuid": "aa33d2b7-1f70-4668-a466-356dcea6b8c5", "comment": "Malware payload (Heodo)", "value": "3e05e13589c9ae7b869a51ef64481760", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873402, "uuid": "2b86ccd2-864e-41fc-ad05-b64c65ce0901", "comment": "Malware payload (Heodo)", "value": "4eaec5bbc8d87faca9768e3e8c10f73ccd7982ef5278b91a6f0c7019f203ca1a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873402, "uuid": "8b32651c-730d-4373-8931-3e73b4d242e7", "comment": "Malware payload (Heodo)", "value": "6d676d73dd58d9bdd4411305e901cea432806e8a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873402, "uuid": "5676a5a4-8a1f-478c-bb0d-d230e881780f", "comment": "Malware payload (Heodo)", "value": "3da34e9de0becf869817c70ef43e07f987bc15df4205474fd65993b470e68616665ddbf3eb5f51c5bf5e7ce45053e119", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873402, "uuid": "ef1d3e9b-1cd5-43fc-82bd-0cd9b830db4d", "value": "T1E494CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873402, "uuid": "c11eaecf-5b17-4383-a866-698cb711b18f", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873402, "uuid": "a702bbef-cbf1-4184-98d8-6358c3a8512a", "value": "12288:43hV6Pw4aT23Guoqv91Wuwf07EIvH3+38+:sb6Pw4R3GubWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652873402, "uuid": "7be54ed7-41d1-48b9-9576-1595a5e83c77", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652873402, "uuid": "5a716cf9-7306-4682-a966-ae6ca7a848b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873402, "uuid": "cfa8f587-10db-4170-a169-3553b26f6a3f", "value": "3e05e13589c9ae7b869a51ef64481760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada3bb3e-d695-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652869889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869889, "uuid": "d592bbb3-3da3-4fcf-af5e-82315aac9ab8", "comment": "Malware payload (Heodo)", "value": "51be787ff3b38b4fd58ec5fb26515f3c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869889, "uuid": "fa50ac16-20d3-4d48-b0ad-37d24352f0ed", "comment": "Malware payload (Heodo)", "value": "4f41e7ff4bd1e37bf05f28307a2ce951c5f5ff8a58421be74edb2c0526d02402", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869889, "uuid": "47d9359d-08c0-4a0a-ae1f-15ff46b98c4e", "comment": "Malware payload (Heodo)", "value": "723169d1dbcd68acacbce206bc076e91ad1833d2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869889, "uuid": "98bedf1a-8e6a-4f23-8c96-56ab9e12901c", "comment": "Malware payload (Heodo)", "value": "8647b8b1cbeb47ebd86de7d86376c283558d496df4befb5700bec036c9f372b858d183fd4db4bc4ea648f1839fb8060b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869889, "uuid": "a2889122-a605-41f8-b5c8-8447e36c2913", "value": "T19594CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869889, "uuid": "b6914ced-8bdd-4300-a5e7-d725ddf67dbb", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869889, "uuid": "15c65820-6a47-4752-8e3c-e1e3011f3338", "value": "12288:M3hV6Pw4aT23s2oPd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Si3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652869889, "uuid": "63e6fc31-d167-4b6f-a84a-af3d605e82fb", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652869889, "uuid": "60ded634-4a65-434c-871a-f263c1e16f57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869889, "uuid": "251fa766-2a6b-4955-8c8e-f5d7edf18ce7", "value": "51be787ff3b38b4fd58ec5fb26515f3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae325d4-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908968, "uuid": "2cf227b8-e213-465b-ae67-3e8b9ec9da40", "comment": "Malware payload", "value": "417cb55b66043769834bc39e9628e9a2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908968, "uuid": "61049e52-1203-48e2-bf69-9a1a5051691e", "comment": "Malware payload", "value": "4f5ba2625f79dcfe5b4c63d9f7b1913ee58b06d4b6dc2055c3a46e83610f6760", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908968, "uuid": "3c98b55e-1ef3-4213-9f7c-084faceccada", "comment": "Malware payload", "value": "eb5f2bb9a0ac523b17c9c064605bc03ee215c5da", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908968, "uuid": "8baa44bc-30ff-4f95-a356-4733fe46ac04", "comment": "Malware payload", "value": "68f86e35414d67f0ff29d1b68ff4596df162129818de3511670d8bd6d2b9abfbfb23724d3271ac1f1ee0b6236db252ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908968, "uuid": "acc36387-0016-480c-8b82-1a3eccace4e4", "value": "T18CA1E850112C1AB17246597AD26FFB52B50EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908968, "uuid": "85654d0f-64ee-4582-bdb9-65fcc2c37bbc", "value": "96:jRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:jRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908968, "uuid": "4f331f91-08e3-4df6-b7a3-e5e3212a8453", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908968, "uuid": "58e36711-a6e3-48ba-af98-f95265796057", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908968, "uuid": "05877de3-d9bb-445f-ad2e-0e55f19a5bff", "value": "4f5ba2625f79dcfe5b4c63d9f7b1913ee58b06d4b6dc2055c3a46e83610f6760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d35a17-d6cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652893961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893961, "uuid": "008031d5-d202-4db0-b744-8b670dcbc25e", "comment": "Malware payload (Mirai)", "value": "29882b6d563b0e9612892aa2dd8535d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893961, "uuid": "9a0e73e4-f0c1-4eda-a3fe-c68eddacbf32", "comment": "Malware payload (Mirai)", "value": "4f9073dbaf1cc293960a5ff20823f7c32ae5066cabc3a144073d10c4f34cf3aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893961, "uuid": "402337f3-dfd5-4045-b07d-94be9a3907f3", "comment": "Malware payload (Mirai)", "value": "fa6e1181779556596a095ecda6f4fa0b79eaaacd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893961, "uuid": "1ad8ef77-ddd6-4660-af6f-400b270d7e1f", "comment": "Malware payload (Mirai)", "value": "2fdc8cd40626ae0860f46b8a04152589ce4c0f85045834a4c42394847e87ae1eb338bcd1f664e089c5afe41ad1c182dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893961, "uuid": "f93fa603-bf58-4a8c-a963-73d30cd749ab", "value": "T14093B409BFA50FFBEC9FCC3749A91B0224CD651621A93B75B934D818F65B24B19E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893961, "uuid": "81f259c9-05fa-407b-a9d5-b56f13955398", "value": "768:BnJDTFOU1Q05gELl6SR9KhE3jU1tnzDh5YUeYOezgeR9GAlNYwN36gT3OXilYraL:lPOU1Q0GU3EDhV1OygS9hNVhrka7gAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652893961, "uuid": "ae1e7dd8-07d1-4a2b-92fb-a39c38b78e7b", "value": 96656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652893961, "uuid": "416d89a9-e6f0-4437-8ca0-2b206452e271", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893961, "uuid": "7436d60c-449e-4866-b34f-737b331d80b6", "value": "29882b6d563b0e9612892aa2dd8535d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4eb3287-d6ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652906462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906462, "uuid": "54e51b7c-3a55-4967-bad6-c29757f5fcdd", "comment": "Malware payload", "value": "faf514c2e80b339e00c0576855c113b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906462, "uuid": "09cfb31f-5bd8-406b-bd58-cc1ff8812b06", "comment": "Malware payload", "value": "4fec5400f6123353f23459460c3329573f7b4f0a473082ed1e0dbb3ca3c36e80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906462, "uuid": "0f16b279-d911-475c-935d-c543b48dae7e", "comment": "Malware payload", "value": "2f705daa3f3716b4d8bcb95f277e1d14fa84bd9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906462, "uuid": "25139f33-19c2-4d25-abc6-d35fa22ebb66", "comment": "Malware payload", "value": "ff4b7530867adee9506e4feaa883b4b84bfd25df10735e382be7323fc495d30a86f0bc7a72c617d9fed67918b9ffe0f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906462, "uuid": "cde020eb-acfb-4a81-b7d9-9ad5b0226054", "value": "T1E2F49EE03A7A0B56F9288FFC0492717143F23172D66AC2991F93B1EB1961BC64EC495F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906462, "uuid": "9139f806-f335-4cd8-9ac5-6220c32c507c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906462, "uuid": "56af8874-9e2a-49a4-b2c4-e01de618800b", "value": "12288:0QvqYs2b463PXCJk17OgO9SmRlPdkJiLQchwIVN:0QS52kyyS17kllkJiy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652906462, "uuid": "c137961e-0b1a-458c-a964-a9b9712f1dca", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652906462, "uuid": "c521cc73-afbc-41ff-8176-f767e90bcd42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906462, "uuid": "3d7a27d2-0630-4d9b-9506-9a99b6c45e7d", "value": "SecuriteInfo.com.W32.AIDetectNet.01.20167.27853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e39f1fc-d6d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652896035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896035, "uuid": "7e693028-79cc-4919-8420-d0b132faeb7f", "comment": "Malware payload (Formbook)", "value": "66327cb157de8ff34bd61a710d30d814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896035, "uuid": "89d19813-b918-4c3a-878a-c3ae5361ebd1", "comment": "Malware payload (Formbook)", "value": "4ff209aea9caf232f64a0a1670504bc6f37d079fa66dbe303439a93e00c3cdc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896035, "uuid": "c2ab7f5b-8671-41e4-93f8-15a39dac8d81", "comment": "Malware payload (Formbook)", "value": "5affa0807d36dc064de6daf336ef9b074e6ef308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896035, "uuid": "75be4430-151e-4c3e-988d-1eb7482c4ce4", "comment": "Malware payload (Formbook)", "value": "832736fd502c69fb8eeed8d1b72c0a4bb801a1cb2e32e00f0d839ab95c282bb7090d8b4679af2159b7e2cab83a71be2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896035, "uuid": "572e9c4a-acb0-4693-a82e-cad9748d1561", "value": "T102D4705C37155E72FF1F883498420B24BBA6BF037640A9D367DB21CB8B9B0675E06DA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896035, "uuid": "8df79994-4041-48a2-9763-57f5be76b7fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896035, "uuid": "f3084a5a-8389-4399-a8be-94e282f6a8da", "value": "6144:ZBuEIjsUUzqysOGJKINKk4rlIEjtEgbnJ7uQgAzfUbTKj7Jc/LO5i00RyEc1fUTQ:ZiINzqI8KZtPwQIa7Jcq5i00RyESfeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896035, "uuid": "14f86f4c-77c5-4141-b982-921e48305b9f", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896035, "uuid": "4a4c2528-46e7-466b-8109-9957b7c235ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896035, "uuid": "2c538934-2300-43b0-9ed5-00cdb76baee7", "value": "SecuriteInfo.com.Variant.Strictor.47541.25845.4974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c5764e-d6d8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652898487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652898487, "uuid": "d02a2c99-5f89-4c14-8e20-3e7e76b9b23f", "comment": "Malware payload", "value": "c830302bc7facd8e459bb76832fb58b4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652898487, "uuid": "b581e4f2-a06b-46b2-b5ec-ae4ef7439c20", "comment": "Malware payload", "value": "503121aedc5e3962334e6405313d1ca0b27459f18cac79523e5f4b4a45ca72d1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652898487, "uuid": "68109a97-df4a-4d73-895c-ee3d43275f7d", "comment": "Malware payload", "value": "898b12e1a80374af932d99255ae37db8f0c77a43", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652898487, "uuid": "7bdc09be-0c10-47bf-a5fa-cd78e11135af", "comment": "Malware payload", "value": "754b325a928296c72cfdee862ae1884d8cffdb381fd763005dbae0e10e57444ce63e08ee6dcfa769f57d2526fc765ec7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652898487, "uuid": "0d71968d-5b32-4c03-87b5-d51a60102535", "value": "T122953397F88EDD10D11BDE77463956439A4F120AA9DBBC8FCA62C0954CB7E34E683D08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652898487, "uuid": "ddf14f5d-9788-4cb1-95a3-4df1d334f318", "value": "49152:bhvzoN6fhEwagFAwFPBon2ZjUv2xmqUwmmUMV4QXJiMb:bhMMzWuPBon2ZjaGOwDUEXFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652898487, "uuid": "b0fd07d7-c5bb-4bbf-848d-47b15e05847e", "value": 2016749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652898487, "uuid": "6e9219bd-c54b-47f4-93ba-f32e38dfd49e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652898487, "uuid": "5d727154-2db1-457b-9afb-322c4026f70e", "value": "sana.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e573e4b5-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909067, "uuid": "9482c397-43e6-41b5-b006-bdb8e68e0c22", "comment": "Malware payload", "value": "ca33c4267e1a3cbda1f1f24027cf321b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909067, "uuid": "9cae25da-588f-4027-be6e-bd4931210194", "comment": "Malware payload", "value": "50541d931a9873821955ba247f91fe16dfeb6489737e73ba268eb0481ebc5a6b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909067, "uuid": "983228a7-fa3c-42ac-beac-fffaa9946175", "comment": "Malware payload", "value": "4e1e47ef57424a7f2bdde6e5856337e508bbe653", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909067, "uuid": "eee1d5a7-b77d-4f9f-9d8a-cb0f4d33f33d", "comment": "Malware payload", "value": "72e5cef62e62b4600976e0a76a1d5f79eb609b4108943b2fc2f67e1679cf65e725bc3b4cac4d8e4132c759352543043a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909067, "uuid": "09811802-a01d-40ba-a1e9-d613b72c4b5a", "value": "T1A7A1F750112C1AB07246697AD26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909067, "uuid": "d78087ef-d0a5-4da1-a460-e7d92d9e90bc", "value": "96:lERYZxQOBpLyxIcymLKY8M991wuIaQPYPW:mRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909067, "uuid": "1065e89a-58e1-4b8e-808e-b4a6ad1dfb83", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909067, "uuid": "0a00a6f0-6ef7-4b58-a8c5-a268220e184d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909067, "uuid": "f82f2010-7462-48a0-846d-d5593fbaa303", "value": "50541d931a9873821955ba247f91fe16dfeb6489737e73ba268eb0481ebc5a6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2766ea76-d688-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652864080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864080, "uuid": "437b29f8-a41c-4966-81f9-209e4f11c4d7", "comment": "Malware payload", "value": "1d73dd096a09e35fb03daf8f8f03f85a", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864080, "uuid": "11b9edea-6742-43f6-8ecf-6beec00ba66c", "comment": "Malware payload", "value": "50547d2340a06e218f6b0808491a0351c2f6e2c4be2e3d360ec2924205b1e521", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864080, "uuid": "9f36c017-b9f4-4413-a5b1-297b1580f7c3", "comment": "Malware payload", "value": "903bdc8f9edc0aef684d75a94a12b574ae7791b8", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864080, "uuid": "e6cb1f90-14cb-4a4c-9fce-1d885f11e5f4", "comment": "Malware payload", "value": "48afacd90def9182c274c27bd2750700b145715cbfe64fa19fbed9084e743621bc31ebf1c3c710ff94fea0808fd2417f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864080, "uuid": "c8848e9d-b839-4a39-9ba1-c586b21ad329", "value": "T16124120CF5928A75F3B237B83D9E5213D9ACDD393F02D06BD4A6723A95B944C9813394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864080, "uuid": "5d65fd74-7e67-49e2-9ffb-9671967dc600", "value": "3072:ewdEfDVA2R9NE/+y0unLpFQdZApIqDcfUgALK+YUi1R0q8I+RckH1JJOEF57msF:lEfDGizE2y0MY+pIXlAjD+R0VHJOGmsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652864080, "uuid": "d428063c-6b93-4729-8ec5-58a9214a1cba", "value": 229096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652864080, "uuid": "cfb88f74-4e5b-446f-8b1f-7f83dd247396", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864080, "uuid": "6b79693a-27ac-4684-9b50-382bad5752b8", "value": "Copy of G22-0419 VELOUR Lebanon.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd088526-d660-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652847259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847259, "uuid": "c1d1bcfb-64ef-4687-a7a7-e887cd1bd745", "comment": "Malware payload (Mirai)", "value": "85df2d50aa717cc05e0505f025ea37cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847259, "uuid": "0d1020b4-a63e-4a39-be64-bd6baac5063d", "comment": "Malware payload (Mirai)", "value": "50761271ebfcc7ee7ef1ce5ac741ace5fca5eb8c8c04fba71025910d29fde088", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847259, "uuid": "b0fe9c44-b8be-4428-b066-37367f517d75", "comment": "Malware payload (Mirai)", "value": "5be3ae45e9a3478a3c2598f02b466d39918e1a07", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847259, "uuid": "bbab5e39-7232-4d03-bbd0-718878242196", "comment": "Malware payload (Mirai)", "value": "80374f50de8160be01a126d7d27cae4f24873c9c3b89aba84addd2053bdc63513cfbcd822dd88ee2cd44239e0cd1560d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847259, "uuid": "99ffac28-0392-45c7-b8a9-02d607d1caa9", "value": "T10BE34C46EA818A13C4D61775B6EF42493323E764D3DB33068928BFB43F867AE0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847259, "uuid": "adee267d-4b26-4d26-8487-44113055e06e", "value": "3072:BURsdPk5sw6eBaUaWBDc9fkikHPnRNb+ufSM/9sh:WRek5swzBaUaEDc98ii/b+uqM/9sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652847259, "uuid": "e7b90fb6-3588-4ee2-bd49-05c13574cb70", "value": 153560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652847259, "uuid": "58e4c47a-d9e5-47b6-84f1-6a213e8c210f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847259, "uuid": "0ee50e05-17e0-4eab-9cad-df250c34f822", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25aece9-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652858810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858810, "uuid": "503fb467-6a15-4e7d-9512-86a731a88f5d", "comment": "Malware payload (Heodo)", "value": "5b365f99c25bab737ed5fabc8814c63b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858810, "uuid": "6f41c1f2-8605-4b9d-a701-a3738a4bc287", "comment": "Malware payload (Heodo)", "value": "5084104b76d96daf96b54d4a2daae3fb4a25ec29a404fbb38cd378194b39d0c6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858810, "uuid": "1034e967-dad8-4e47-a0cd-21f3cce03a41", "comment": "Malware payload (Heodo)", "value": "360d73c122f549c1716b470406109c0142003055", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858810, "uuid": "28d1e302-95d0-4131-9049-fdb42cf48737", "comment": "Malware payload (Heodo)", "value": "ad6d1438c68a2dbd3c95e33fca074a7617945c003f490dfe718233d29ea0af215e46aa9eddf4fe7bff3fdc5e9ba3a273", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858810, "uuid": "4a86f328-a637-49e1-bfd1-cfbe4cef1fc0", "value": "T1B594CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858810, "uuid": "0e660954-6597-48cc-b034-db5f466a4f82", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858810, "uuid": "7d2bd0bb-e9bd-4871-8236-acef1b49c493", "value": "12288:M3hV6Pw4aT23s2ohd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2gi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858810, "uuid": "aceada86-79d4-476f-a60d-030bf8058273", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858810, "uuid": "18130638-aa4d-4c08-9a17-a382403a7cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858810, "uuid": "797ba958-54e1-4e5d-89f8-a57d1d46610c", "value": "5b365f99c25bab737ed5fabc8814c63b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1baade-d6b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652882124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882124, "uuid": "78991860-f008-4006-ac08-da3adcc56999", "comment": "Malware payload (Formbook)", "value": "c43e1fb14a30c0e7b3040c94d16a196c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882124, "uuid": "9a386bf0-4988-4e3a-85da-4e17a614a09e", "comment": "Malware payload (Formbook)", "value": "51ab17fdd212d1bae66a6ec70e44b220f02a33a7e0a2785c6e69f421d79d4cdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882124, "uuid": "c32d38d2-7b79-45ea-9fd3-b086d0fc7860", "comment": "Malware payload (Formbook)", "value": "e55975c8c7d7fd04f556967739135000f18b0bb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882124, "uuid": "cc441458-060d-4680-a0b4-931afb8afadc", "comment": "Malware payload (Formbook)", "value": "76ee8ccfe08372cde1b6b1dd653287b048a8f12462e79ab95fc5ffc0be8f2170a0e7b7ccd4bbd443ff446dd0133050cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652882124, "uuid": "20674a2f-8ba2-45b3-90c6-f4b23786e76b", "value": "T19B241201D651E137DDA31331AD31EFA18DBFA93214F0A1571740FFA6AE70A809B6E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652882124, "uuid": "1b322228-459b-4c3d-ada7-f0b7f0d2d237", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652882124, "uuid": "13b6f075-8f8b-4561-8c36-893adc9ee0d1", "value": "6144:LOtIOx7MRQlyQfODWoqrK/q9PtKEQ6cNcUg/BBV:LOLx7r1fOD/BqFtOcUgZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652882124, "uuid": "ba6098c3-b599-4d75-bc5e-4a9566d44a3b", "value": 230052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652882124, "uuid": "567e282a-5301-4b00-85a2-eee3bc34475b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652882124, "uuid": "eb3bf63f-81de-4f99-8393-ffcf85e35864", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec99360-d649-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652837383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837383, "uuid": "e6c81152-d9f6-4630-b9dd-a9f8c9eaad21", "comment": "Malware payload (Heodo)", "value": "92c58ae054a5bdeed6c832e7802e017c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837383, "uuid": "9f95ade5-a904-45d5-9d11-bed3c6bc8154", "comment": "Malware payload (Heodo)", "value": "52386a378166ecd4b2bec8e473341dc0865e8ed262be97e1ad619dd84789a4a8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837383, "uuid": "2f8a183e-6118-4402-a1aa-25566dccf29f", "comment": "Malware payload (Heodo)", "value": "15be4a5e1c6556601a1020b72b65cd3275bc9f07", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837383, "uuid": "7da0c09b-59c9-4823-97af-a68311780e49", "comment": "Malware payload (Heodo)", "value": "9496e0d1c3bf5c29e84aa84ce00b1eb143bd32f3e92bdfb8c942dbb7e545051a49294d28200e0ae030800bcc134d13b3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837383, "uuid": "f5d7f761-b887-4a86-b56d-e0cdb10a2517", "value": "T18794CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837383, "uuid": "d8193546-29e8-4d48-9261-04b3af5f91c3", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837383, "uuid": "36bf6eaf-7efd-428a-9ca2-96f43eaecf1d", "value": "12288:M3hV6Pw4aT23s2o5d9zi3BBoNIQ/hsA7:Yb6Pw4R3s24i3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837383, "uuid": "8a1b678d-9e78-4314-89de-7fe39fe9f89e", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837383, "uuid": "94fa9eef-f019-4358-a2e6-b787cd7add30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837383, "uuid": "9acab3d1-8611-4bd5-b87c-b177258f7175", "value": "92c58ae054a5bdeed6c832e7802e017c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93623a0f-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908929, "uuid": "613ffad9-c278-4bc0-8dfd-174b607161a4", "comment": "Malware payload", "value": "46de5bb65290b8774b79b14e3ebfdae6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908929, "uuid": "48199ce5-be8b-4992-99a6-d5b76c9b38b0", "comment": "Malware payload", "value": "52617c28ec21370a659de5e9e26888116090cb46454cdb0460f0f4bd21733ac6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908929, "uuid": "998c9226-fa20-4ee0-b607-4b26f446a10c", "comment": "Malware payload", "value": "44584bf52f9821e220f5946b722793c9e098c6b7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908929, "uuid": "1f9ae7aa-35cc-4aea-b958-edfecf31f6b7", "comment": "Malware payload", "value": "ab003de6586a60f3d362928732879845d3dfcc9461ce82a62b94bae3d7215d2f3f82f1811232a32f7174610844c9e32f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908929, "uuid": "dab95365-d49e-416a-b089-ac7bd8d072da", "value": "T10EA1E750112C1AB17246697ED26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908929, "uuid": "625abe97-bf26-4573-972e-c311d43dcb06", "value": "96:yRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:yRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908929, "uuid": "f5c3d2c5-70c0-4eee-8a8c-231177ffbfe9", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908929, "uuid": "a48f44e9-5699-4b6a-9a44-e9d15330acaa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908929, "uuid": "899010d1-3c14-4cc2-8308-228cd1533ad1", "value": "52617c28ec21370a659de5e9e26888116090cb46454cdb0460f0f4bd21733ac6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42535be-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909038, "uuid": "e7f0384b-624a-4cdb-a9e7-4266f78c2ed4", "comment": "Malware payload", "value": "d690df82dbd1383e2fc4f3870ebbe5ad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909038, "uuid": "8df77a4d-e0e7-4f43-a574-3b6cb84c4362", "comment": "Malware payload", "value": "52b7d5bdfbe8ee8df3905955afbc113b31abdd06ee6905598535c0075160b3c6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909038, "uuid": "c15615fc-8257-4034-a943-6a65c50ffabb", "comment": "Malware payload", "value": "cabb83e689383e8e6cb3420684e24a17cff979c1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909038, "uuid": "4d726334-e66c-4122-839c-5d7def8685cd", "comment": "Malware payload", "value": "295e5561127d9423ce7ead9372be7a754b95271c59d314238a1071d5fb9338105c3ea77ca3e6bb71ce74e54f99866b50", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909038, "uuid": "b416e292-a162-466b-9dac-44d64ebd993e", "value": "T197A1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909038, "uuid": "1b09b13f-6514-42b5-8983-45fb5e8d4677", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909038, "uuid": "f61eb429-6e79-45d3-aa24-360de8f3ba55", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909038, "uuid": "4ca98e5d-3820-4dd3-97c6-58ed617e46a4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909038, "uuid": "7320acc3-2da9-4ad8-ab60-1b53a96aa89f", "value": "52b7d5bdfbe8ee8df3905955afbc113b31abdd06ee6905598535c0075160b3c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edceda6-d64a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652837437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837437, "uuid": "1eb5b738-2cf4-46f4-b90c-9f0ff8760ec1", "comment": "Malware payload (Heodo)", "value": "407ec91b416e7289d5dff79033da6076", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837437, "uuid": "0749c0f1-655a-4a9b-aa38-236cb32499eb", "comment": "Malware payload (Heodo)", "value": "530fb4d1778b6de6e7d0990b435ab8778301980793dc49d1962c9d91b5025cd6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837437, "uuid": "03cf65c4-ba43-49ae-9c4a-d5dd65485e62", "comment": "Malware payload (Heodo)", "value": "9592705929308e7aa4b772110e437c7a3bba482a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837437, "uuid": "040fc6e8-9964-4831-8bfc-4c7e81796055", "comment": "Malware payload (Heodo)", "value": "c5e85fb14643d512ffcb4d8029ab9161192d0779197a4d5557e2a61bd3855805f5e3912083c4244487f7d97cb51bfea0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837437, "uuid": "46e06bef-940d-478d-8e4a-934b51552fc2", "value": "T1C0A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837437, "uuid": "50cfcce9-c4fc-40d8-ba0f-4bbc1c3d1c70", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837437, "uuid": "52c28f8d-4917-42d6-ab4a-290f51ea1f16", "value": "12288:uS4BnAed8BK2o0aDa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKia34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837437, "uuid": "64d41a81-382e-4c2e-b696-470b5a85e667", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837437, "uuid": "58730427-f949-4033-ab9b-bdf804aafeaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837437, "uuid": "2670321e-fdf0-4145-b526-d900e2c6e182", "value": "407ec91b416e7289d5dff79033da6076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31edff5a-d695-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652869681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869681, "uuid": "487d439e-0b0d-45df-9e65-c8e30617795b", "comment": "Malware payload (RedLineStealer)", "value": "8fb1f00dd66b180dbf004a7964808c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869681, "uuid": "6d718a15-10a6-47b5-ad70-ad04a4ba2c95", "comment": "Malware payload (RedLineStealer)", "value": "534eb8b43f3bec8e99eb7ae6f57ba7fe0ff8fdc3bfa11322cd4c875f50174cca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869681, "uuid": "086d8db1-ade4-4471-8118-19186fd85cf5", "comment": "Malware payload (RedLineStealer)", "value": "6b2ae28e7199e50772f502e3ebe54d420186be3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869681, "uuid": "28c2266e-c948-48f9-9aab-6b65613fa82c", "comment": "Malware payload (RedLineStealer)", "value": "420eea9afd250528cad8886931290619dec2b9f84f5b129faa6d93b47fd0c567d5eab980c44d8cee34d36a5478102621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869681, "uuid": "1535eb25-646d-4f26-bec9-58c8019079e8", "value": "T16D94F101FB80CC75E4622D3444B5DBB24B3BB8636570964BFBA49B6E1E733D04A7630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869681, "uuid": "051a48df-76f1-4ecd-92a8-c15648d6ab95", "value": "151adccff5e70213fb31de55ca880f7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869681, "uuid": "55b3517f-1f1e-4e60-80c9-dbcf5e7ca064", "value": "6144:46oy0GTNSVToJeUOI+2zrBEODMcwFwfiga3wVfN:doy0GwcOIzzrmeMTaa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652869681, "uuid": "4bc9993d-8bbb-45a7-8779-61847cc4225e", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652869681, "uuid": "8f06bb32-2a20-4847-8f26-4b526f1dcb46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869681, "uuid": "653fdf7a-f9d5-4bb2-9754-a6fc9e6450e3", "value": "SetupMEXX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1594629-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909033, "uuid": "2d924c4e-000d-4fde-a328-0411f12a42b7", "comment": "Malware payload", "value": "cf652e44ae53598c66fcd2ac5a3c3533", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909033, "uuid": "3be243cf-3ed3-4c82-8086-fe47ab4fe0b2", "comment": "Malware payload", "value": "53ae60cdd899e69b0183cfae1ce2b6a79c99720d35e52284380e3c747141fbc0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909033, "uuid": "8aa6cc4b-99ab-4059-9a3c-95cbbe7a0a06", "comment": "Malware payload", "value": "8e1f6509789501734d261adb97f0ae9b6fb91cf4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909033, "uuid": "311b0086-2ac3-47a4-9540-be3aa3d84597", "comment": "Malware payload", "value": "6a13e3875c0000f0f6424c931bbf7e16dd7ce8c6e00f1990ebdcc62157ae65e733809ad13716c69bad9d59b0e3d2387b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909033, "uuid": "3207d0b3-c509-4629-ab4d-ea23d4c63292", "value": "T1DDA1E850112C1AB17246597AD26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909033, "uuid": "998ef779-9e96-48e5-83c8-b83b349391c3", "value": "96:7RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:7RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909033, "uuid": "be323420-4fca-4e4d-b173-aef0f740b0c8", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909033, "uuid": "8ddfbb6e-5403-4de1-bf3e-dbe5792839a3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909033, "uuid": "197bdbd6-fe47-44fe-9ca0-ef173fbba108", "value": "53ae60cdd899e69b0183cfae1ce2b6a79c99720d35e52284380e3c747141fbc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a7ceae-d6a7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652877658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877658, "uuid": "554234e3-9166-4302-9da8-256d9466cb9f", "comment": "Malware payload", "value": "081d24ce4761d4ab6efeec144a4e8610", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877658, "uuid": "b88a208f-166a-44c1-a66c-ac491729d245", "comment": "Malware payload", "value": "53cf77d9ed5176fd5ddc2c7b70be086dc566cbb0e8dda338f5113582a55df618", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877658, "uuid": "b9c89adc-82fb-49cf-a89b-2a74e7967c8e", "comment": "Malware payload", "value": "a60615632a025000cbbe6e503217881d9e2de61c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877658, "uuid": "b282612b-1b04-458e-ae2d-0ef75023e196", "comment": "Malware payload", "value": "d09f77ee19947e39708a1b57a6f3258fb888641e67c21ee422f6bdf00c4ce16357efca89de72ea1ec2e9ed3af1a45914", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877658, "uuid": "51f3d73c-899a-445c-8426-74578b0259f5", "value": "T13D2412E7F919ADF2DC870B76DB548A368F69FC0A88D68DB21096F29309B2341C194771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877658, "uuid": "2f291532-86e5-431a-9adc-d5fc4de8e4f3", "value": "6144:nAwNTJowhh/DI3uEZP1k9L/9qD38Fz2qt9jpvUvD:nAwBJowT/c3NZP1kd/0IDtUvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652877658, "uuid": "3cf3a9dd-bad5-4420-b7ec-7071a1e0e952", "value": 229272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652877658, "uuid": "9ea59d64-e6de-452e-81a6-c9ad491eed67", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877658, "uuid": "091231c6-c15c-476a-bb2e-afd80f834d70", "value": "PurchaseXOrderX#004.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5df7ed-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909080, "uuid": "ce6988c9-cb73-49d5-9e6c-22df86a792e4", "comment": "Malware payload", "value": "eba7eadca7f397d3a1a9406db266da3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909080, "uuid": "916c3b5c-19ad-4979-bd7b-db902aa9a5a3", "comment": "Malware payload", "value": "53dc6e400f8fe0b554975eb02954cc419d984480e6f9ee183dcbaf4693d4e6d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909080, "uuid": "fa35865f-dc9a-47be-a8e3-c8ba4dc00030", "comment": "Malware payload", "value": "763c3ca9eac3862cdf1d9cefd95d248a4bbc8c2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909080, "uuid": "e6637853-8d84-457a-9d3b-eb6155eb9440", "comment": "Malware payload", "value": "b0b782ddf0cebe58107120d033c9f1863a9216ca8c9d248e7951f0421b6af545b43c9ccd3483d818493cfde2755c07f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909080, "uuid": "19731d6a-d537-49e0-8615-a6549c956637", "value": "T1152121A292E9FC32CB6110F6628AAF861725DDA5681BFF0F8E514412ED3D2C1D132235", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909080, "uuid": "c44d1970-2275-4960-ac74-c755133773f7", "value": "24:FlMMH6FHxgxk2ZO4l2ZWVRkwvMNfdGu92/4AoruQ7bNfB:fMF5wOewWVRkwkZdh2/4JHfNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909080, "uuid": "ec81a200-2901-4ca8-a514-fd503ab2a43c", "value": 1168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909080, "uuid": "f53ff897-e273-44d8-bc4f-4c3d67d97bf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909080, "uuid": "1fcadd7f-c0d7-44d1-a57c-c2f853429f71", "value": "53dc6e400f8fe0b554975eb02954cc419d984480e6f9ee183dcbaf4693d4e6d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f036d7-d69c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652872939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872939, "uuid": "36fe52cf-ee6f-4760-bb28-57bd2b292288", "comment": "Malware payload (Loki)", "value": "cac1bb04d3c5c4a848426e1a4b90b449", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872939, "uuid": "a4c7e2c0-c7c5-4881-a6b8-e36058fc1732", "comment": "Malware payload (Loki)", "value": "53ec240d4f029f8e212e2ed828ca11e1daa1093f1081f125810d3a13149a02a6", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872939, "uuid": "2a3620e6-c307-4ce1-ae47-39c45ff9040d", "comment": "Malware payload (Loki)", "value": "f021749072aa2e9470c617409e89b1c9ef641e58", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872939, "uuid": "bbabdf31-a489-4ef1-8225-862773d4c0bb", "comment": "Malware payload (Loki)", "value": "7882ba483059ff0631a51fb5fc9feb8f6efeac5eb2c27ae50eac6bddf672128dcb94d80aca77ffac1fd9241ef408dff0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872939, "uuid": "68186a3c-1942-4fde-8d77-d898026df6f4", "value": "T158241250F4BFE55BFF62FDB64392CB5A14514E284E8E1A09A38837EE59B7730D488843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872939, "uuid": "2aac1602-5f8a-4846-a337-7d00284059a5", "value": "6144:NKfR8bStKhkY8dUhXDHqBm+pGCOq4xdQ4iFWxU:NKfRrtVNUDHqUq4xd9iSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652872939, "uuid": "4437ebff-a158-449b-850e-1975fa2ca923", "value": 229048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652872939, "uuid": "8e95bf58-f57c-4823-bb78-4e4311e13e5c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872939, "uuid": "76d04690-bf1e-41c1-9edc-425d588a2bd8", "value": "PAKKUMISTAOTLUS 17.05.2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae8eda2-d689-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652864542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864542, "uuid": "f26aa835-c884-46af-879e-d1c963afa7c8", "comment": "Malware payload (Heodo)", "value": "512a11f30e844a3f9e9361b5b28380da", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864542, "uuid": "c23607a1-b243-4222-bfd8-7b21ed25724f", "comment": "Malware payload (Heodo)", "value": "54374053b9b75e39fab763473ac75c362746bf0b969c9e549433e0bf64a14352", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864542, "uuid": "747c5e90-2f60-453c-b84d-44e25b8dcc98", "comment": "Malware payload (Heodo)", "value": "f9ac0a3051f3014bbc2652e3232029be6675fb55", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864542, "uuid": "136b71c8-b67f-493a-9405-a07637897dc9", "comment": "Malware payload (Heodo)", "value": "9687ed9c61a5d79c7ee0c6f81f990defa92d62a7cff35bcf7ca2be1a19687dd522fb5a37fb6ebee3d10c1d086f832058", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864542, "uuid": "0d3d8a27-1492-4d30-ac36-ce9546375148", "value": "T13394CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864542, "uuid": "bb4dccf9-3bfd-42ab-b7ea-f7d4051f42a4", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864542, "uuid": "b858fca6-5305-42e0-ab07-decfd5077e52", "value": "12288:M3hV6Pw4aT23s2ord9zi3BBoNIQ/hsA7:Yb6Pw4R3s2qi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652864542, "uuid": "231e803b-823d-4862-8aa8-3e35c17861d8", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652864542, "uuid": "e6d4afbe-b2dd-420b-92cc-f010dedfcf3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864542, "uuid": "6c11f8fe-4626-4594-ae72-284c56d23b17", "value": "512a11f30e844a3f9e9361b5b28380da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffefacb2-d702-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652916842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916842, "uuid": "41dcb8e7-b5a3-41ac-bc44-fc2508955c72", "comment": "Malware payload (Mirai)", "value": "9e3c8dcc9290d9beaa1841a6a3b45586", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916842, "uuid": "59673a83-e7b9-44a0-9674-0d027d61e0ee", "comment": "Malware payload (Mirai)", "value": "5484f5bef73e3151969a0b3b3c5bd6c75d92041f9ff23c166da4f2c61fb38a03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916842, "uuid": "b1561651-8c2d-4724-b324-38c4dbb40a25", "comment": "Malware payload (Mirai)", "value": "438f6fd3ba186fa70e1403fe58d5c13eb0c0b093", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916842, "uuid": "609fa179-4737-415a-88b8-5555ed243cf8", "comment": "Malware payload (Mirai)", "value": "caf4f513d9325f1cd089bbe2a82491bb0a22662f0962bff8fe7e398463601320576e8707f98248e82f9e15e0cb8f2d81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916842, "uuid": "a850dafe-8ca4-41b1-a22a-e3498ffdce20", "value": "T174534B9AF4018E3CFA4BA67E54160D0AB971B39152934F2772A7FDC3ACF30697A02D51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916842, "uuid": "56aeca69-b1c4-4ab3-a334-60eb20a0df91", "value": "1536:LE2dKd40y5tgc28qwPgN8l8MsINprfm7uCciPY:I27qYg6um+iLiPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652916842, "uuid": "6b19cc07-ba1c-481a-8677-ae5eb42e0517", "value": 61216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652916842, "uuid": "24cd834d-3605-4826-9cab-8fa5ea372934", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916842, "uuid": "a0f13340-e35c-4142-ad99-6ce66342ee66", "value": "9e3c8dcc9290d9beaa1841a6a3b45586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a163ba1-d6af-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652880942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880942, "uuid": "cf2f15fd-7b1d-4f4c-9be1-2ace781f557a", "comment": "Malware payload", "value": "ad667f0b295987d6feecc3b6fb92ffb4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880942, "uuid": "1f048b8b-8061-4bd5-b6da-eec48bcf798a", "comment": "Malware payload", "value": "54d517960c9fc484f94f00db5befcb33042f5fedb56fee2c2155f92de583ec5f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880942, "uuid": "b6335c8c-8f32-4539-9854-cd3d9ab1200c", "comment": "Malware payload", "value": "93993988a6b27eeab84f5a80f57b9488e0f62ad3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880942, "uuid": "fd4bf939-47d7-4fb7-a4b5-ba757ba98682", "comment": "Malware payload", "value": "9f1dce745066339f9e84f540c9ab7e208d51b135b05298488b0593c238884a5bab608bb5941caba7d00add7ec22c61ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880942, "uuid": "98ddf1bb-f5a0-4e59-ade0-ac45ef8e985f", "value": "T13DE423B57AEF4EBBC1CB14B4A82DBB44E0ADDF78034DD103A4B6B152693DFA58050B25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880942, "uuid": "05e551c5-8ffa-4656-a626-60b0424bb1d6", "value": "12288:7Dhidm3J98O8HzRFQMXEPZkWSaTkZ6tzFu9gpKFMVopQfqKIyja3N:7DY05GOGF70ZkWJTNuqpK+fhIy29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652880942, "uuid": "b233160c-6448-4da4-8e56-d5c8fa489510", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652880942, "uuid": "8bb9e68c-e843-4e54-b740-b4375de529e1", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880942, "uuid": "8594efd4-3729-47c7-9fd2-41802c7b9a14", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.23601.16785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf62ecfc-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909003, "uuid": "72e0053f-aeda-4ea9-892c-2b9dee1cf2d9", "comment": "Malware payload", "value": "67cef2cdee35adcdc558cd1fac391c63", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909003, "uuid": "c2500107-6282-41e6-bba0-8dda6a203735", "comment": "Malware payload", "value": "552bbdb856651d0a8926827b43776eee20ae6b9c3b34d47da751d8313a79d562", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909003, "uuid": "75865b6d-4089-4d50-b1b2-53d2a3ce8329", "comment": "Malware payload", "value": "528109d1de26e8832a26d91c24989d132259fdb8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909003, "uuid": "10b9a52f-c0e4-4ac2-8b69-8b38b5bac984", "comment": "Malware payload", "value": "6e85e77761e8aecd4598037132952a4d0cc1c2a613a1864f231dce3184671d278ef166453527e6c1db279459370c41b9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909003, "uuid": "3c7368aa-5e1c-4d32-a668-a73c706e1d34", "value": "T1733178CB63A247706CE1F96B3269880470D4E6C725C99F6CBCDC38E541CDD187004B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909003, "uuid": "877b9121-f95e-4d7e-803e-b844f68397eb", "value": "24:vy4+y3yCc4ky7asy/ylUsyw+y1EsynyNJy3yg:vuiq4kCb6G/+CiMJKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909003, "uuid": "18d94027-237b-4b0b-bc13-43272ab277e2", "value": 1504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909003, "uuid": "f2834743-16a6-4c4a-b8bc-24b73231a3f3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909003, "uuid": "429a563c-3db0-42d6-a310-b6e2a74d460d", "value": "552bbdb856651d0a8926827b43776eee20ae6b9c3b34d47da751d8313a79d562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61eca91-d6e9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652905981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905981, "uuid": "2792ffb8-790d-41ce-8671-419bdc400ff6", "comment": "Malware payload", "value": "5222173f75157dbd2add4bb32452f2a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905981, "uuid": "6fbe9345-65d7-46e5-9085-5aba45e0c013", "comment": "Malware payload", "value": "55491982bdbf2dd2d8426dc2abcee64ba21d32c5467ba1b301b526c9984038f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905981, "uuid": "e420a14d-0978-4417-836b-240154d3bc9d", "comment": "Malware payload", "value": "abbc423615dc678ecd2736e49dd9a88413869a00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905981, "uuid": "1205ae0c-531f-4e89-967d-5574dffa77d0", "comment": "Malware payload", "value": "0df69845ea7cb92bbc5560f0e949319c0ebe23691d6bbbc1015087b2c9e9db8db8f253051c47e4ecab19eea1d6e24df6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905981, "uuid": "3f9b7909-2ae0-4ecb-96b5-dc7211dac644", "value": "T13C05283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905981, "uuid": "c9668ea7-29ea-42dd-87c0-45d6b74e63a9", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905981, "uuid": "7677deea-9407-4f54-9229-c91cc87f914a", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy77mpE3:BTg9UXRD2SeqfZZiXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652905981, "uuid": "99eb0905-7c25-4068-9c02-0cb988e396a5", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652905981, "uuid": "99565860-552d-4ae8-816c-464b73fc8c19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905981, "uuid": "efef4147-c4e0-4d48-87d3-f55ade12923d", "value": "5222173f75157dbd2add4bb32452f2a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adbc0fef-d67a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652858293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858293, "uuid": "020765b2-1246-4f0b-b7ce-85c3a05ec438", "comment": "Malware payload (Formbook)", "value": "7a56c8d4961383064e448e4ea13e9d52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858293, "uuid": "fc71eff9-384d-4455-ae18-9804186f49f1", "comment": "Malware payload (Formbook)", "value": "55670ced624d107373aabbaefc9f1bf4d7d19a7276dadf40b2d4c9dbb0801266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858293, "uuid": "102d657d-3fa7-4171-921a-d817254d4b83", "comment": "Malware payload (Formbook)", "value": "e5facdbae4a1487f20c74781644b2a320fbaf4d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858293, "uuid": "7c6738a0-4063-4486-a5f1-5b736cca85df", "comment": "Malware payload (Formbook)", "value": "c1fdf5f1bbd3acc8001c5041fbb1a6ba65dfc32630c35e5dbad2cf2fede784fbc9aca517c9b3e20d9fd9c27738e4b2a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858293, "uuid": "0b92a865-121b-4663-ab8f-78b380602604", "value": "T125946C1239D4C087EC5AFBF2980BC57019922DD43594C30E2BD3ABEE5FA2395259F786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858293, "uuid": "d504de9f-5ab2-4fcf-a915-ba715e95face", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858293, "uuid": "3c07eb8d-9cdb-4eba-8444-13b0d96cebd3", "value": "6144:2Ya6vrsoKB+A/ONBKE/1wDQ/Wgp1dF/ozb6G3l8G0X788:2YhxNB7NwDQeWX8b60qG0Q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858293, "uuid": "f2e9aaa1-fe2a-423e-90a9-e70b2e1c34ce", "value": 438343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858293, "uuid": "1170a09a-b668-4253-a0dd-2a1bc4324468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858293, "uuid": "cddfcead-005f-4a0e-b8f5-6c706c2eb6c1", "value": "0067765457890000087658.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e8f437-d658-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652843735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843735, "uuid": "55ed5c13-5d8d-45b8-9406-d90b1c049251", "comment": "Malware payload (Heodo)", "value": "77b86499bd21cb6782d3f46a540502f7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843735, "uuid": "b13f58eb-e98b-422f-933e-381383842caa", "comment": "Malware payload (Heodo)", "value": "556c62aabd675099edf90ee503920d40719a7c2294774540760466d76313510c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843735, "uuid": "87f17819-8137-4ddc-86f4-6e18895e1374", "comment": "Malware payload (Heodo)", "value": "ca90c43eef4d85ac1aa3a524e685a14796a509e4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843735, "uuid": "b6c65546-763a-4309-bf4f-6b90ca4ef6b9", "comment": "Malware payload (Heodo)", "value": "0e29f4bafc024c79fd7c3137a188ad570eeeddccac39ffd939a37f4649428ae43e3ee10f14e36f479384046477fddee6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843735, "uuid": "f3174b9f-b999-4ab5-bb29-0cafee124714", "value": "T147A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843735, "uuid": "9c5ce8e3-2a29-4757-b7d0-7857a94d8ee8", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843735, "uuid": "88e38992-24e1-4508-b3d4-35bf33cf3492", "value": "12288:uS4BnAed8BK2o0aja5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKua34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652843735, "uuid": "01bf5003-399a-4ad6-8e4d-0812998f66e6", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652843735, "uuid": "30b66900-6565-42fd-9b18-1acbef224dda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843735, "uuid": "51de9b6b-bfe1-4911-ba03-74e55c8e0cd8", "value": "77b86499bd21cb6782d3f46a540502f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731c5ba2-d6a0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652874515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652874515, "uuid": "bc780bc1-b6c1-422e-8fd5-c13a31a40ec6", "comment": "Malware payload", "value": "74af6c000cef5a8330013de62fdbd554", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652874515, "uuid": "92a493e9-87cd-471f-98db-947b995ef835", "comment": "Malware payload", "value": "55b3a110213967fd1a241360daaab15bdcbe8002bf1f5e75bb6e63a860e59c24", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652874515, "uuid": "da277ae7-d4fb-47e8-be5d-1e666de9df9d", "comment": "Malware payload", "value": "c3522ce97387c33b5a5d640b2350fcc467634bf4", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652874515, "uuid": "ee986a47-81e7-489f-8234-54cbf0934bc5", "comment": "Malware payload", "value": "cabef2bc7e21be9fc24c3748dc150fab90d8121dfad099ffa0f0347d41767a114d20c76141762a600d3c74564f2525c7", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652874515, "uuid": "59f4ddbb-ad3a-4b8f-8177-d0c7fe6b6437", "value": "T107B3281488D8CCEDD063D7C12B3BF19667EEF36325C866A6966D4E47019BE58DCC7402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652874515, "uuid": "a7be3e1b-efd4-44cc-8120-83b0ae69aa2f", "value": "3072:E1xXIQQsysuZNvqj5TcM4c5eaU6iVrEj1/0a:CxXIqy+5cM4Iej6iVs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652874515, "uuid": "f06fcc7c-31e9-4fbb-a866-f37c11181a81", "value": 108923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652874515, "uuid": "7a657a77-c8d5-45ed-970d-3b434ca9566f", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652874515, "uuid": "355e565a-2eff-4995-8c67-f7ab9f9dc84e", "value": "Vivo.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe148ab-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652858618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858618, "uuid": "fdaba316-9b0f-42ed-922c-93d3713621ea", "comment": "Malware payload (AgentTesla)", "value": "2bbd2bf04a6bf7ec2715d128c6a6dcae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858618, "uuid": "93611c2f-64c7-4380-a046-c74ad625aa67", "comment": "Malware payload (AgentTesla)", "value": "55c82f009062044f6d89e82b9b4a6c889b3b3379114ebc38e14d4c5904b99779", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858618, "uuid": "869afb09-fca7-4c91-8833-68fece35af81", "comment": "Malware payload (AgentTesla)", "value": "6f8fede1ba71eed100a45008e7f39cdee20c61fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858618, "uuid": "a36b49f8-d682-423f-a7ec-8a1241c259f3", "comment": "Malware payload (AgentTesla)", "value": "35bac34e9cb858ffa9d24e84b34fd5be9d7bb9d421bf222fa5c29a286d3fbe851b63d113e41db8d8ec21aeb4f341f6ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858618, "uuid": "7253e3c2-270c-407e-8af3-295cc602bed4", "value": "T1C7E4F12863A8DE90E96D83BAD06111F413756E17D912F78BCDA17CDE3D373C0860AA5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858618, "uuid": "ed371d5e-8d89-41f6-93c4-b83bcb696321", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858618, "uuid": "db76da3a-5f98-42d4-a7ba-f73b5a1b1e46", "value": "12288:2KQHezSXIU8Gt/PUMaofprWtdR7C45M+WwHbENzItDbiHEQB+Nx+sS:lEeOj8Gt0M/If+M/WwKzItD8z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858618, "uuid": "402e831c-0341-45c3-a040-8224af4f0d9b", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858618, "uuid": "02e0d932-bd9b-4dd5-987d-9c3a13a809f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858618, "uuid": "48f36f0f-058f-46fc-8870-821d72e4aff6", "value": "PO_WITH COMPANY DRAWING SHIT A and B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cca8ab-d67e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652859722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859722, "uuid": "f361f808-ebf3-47fa-9412-2770ecf8a69e", "comment": "Malware payload (Loki)", "value": "4c64cf8753a33ad06b5ffa18baaf4f7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859722, "uuid": "ee31f2ee-eedd-41e4-9c94-1cd03878b9c9", "comment": "Malware payload (Loki)", "value": "565511aeb0a6cbc266682081f79d492cd0be8063f7fd7147f5a0e4a33ff1898b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859722, "uuid": "30108d85-aeba-48ce-82a3-bf0005510876", "comment": "Malware payload (Loki)", "value": "960463ed6090aa5487f077c49d27ea8e3e922f8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859722, "uuid": "e052b131-c374-4ad4-82ee-feedce78e105", "comment": "Malware payload (Loki)", "value": "d134d02b1eaee808917b26124135f8df6fb157e41d1906394f86e376221d77579edb13247fbd2bf02d23fbe5bf0e1bc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652859722, "uuid": "fd8b9ab7-de8b-479e-9227-5eac866fba36", "value": "T1CCD4F22DBBE6DF12C25807B6E1D3811403B291471372D74A3ECA12D60E077A9EECA797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652859722, "uuid": "0ad6b738-0d9d-455b-9343-f87258972791", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652859722, "uuid": "a414d1c6-4241-4af8-985a-5d23e99187a0", "value": "12288:KVePYV+ErJ/U0iY3d1Bws5cyPBt1RfC0gbSUbZ:oAYVzlU83359Bt1tnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652859722, "uuid": "e09397f8-e82d-446d-adf8-efa6c3f286b9", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652859722, "uuid": "549e2104-56fc-4b43-b929-316234222610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652859722, "uuid": "2ccb67aa-b4ca-4a88-a160-3ae5223e2986", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aec69fc-d64b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652837914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837914, "uuid": "3e261826-a8ea-4388-94c4-a7bca3ca872e", "comment": "Malware payload (Heodo)", "value": "b0ef6770fdee7d0c34cb638ff1392c55", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837914, "uuid": "3d7cbd94-79e8-4a80-8e3a-12976ba275d5", "comment": "Malware payload (Heodo)", "value": "5672758b116306ded537023e63a3a9aa2894ae37b3b397d956abf55b4c10b855", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837914, "uuid": "aae9ec0b-39cf-4699-af01-4367482e9de1", "comment": "Malware payload (Heodo)", "value": "2d63e70d8dda1fdcd2d96867b886d17244c06b20", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837914, "uuid": "a1b0d9dd-32a6-4dff-b0b1-b534e7121fd0", "comment": "Malware payload (Heodo)", "value": "83cddfbc6b20565c61b8f88f5f8a682f5af4e021bb4c0b9e30ec8d64448d90050f670d01410e8f189be732b620a4c820", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837914, "uuid": "1b68b198-5fdc-4b52-b133-46064a09e853", "value": "T1D594CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837914, "uuid": "5761022f-0922-4b9e-b819-d49df642dd08", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837914, "uuid": "13432ee9-e38a-407c-bb17-38deaaa702f8", "value": "12288:M3hV6Pw4aT23s2o+d9zi3BBoNIQ/hsA7:Yb6Pw4R3s25i3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837914, "uuid": "6bed5c7c-a6b0-47e2-8b18-f499e8ec5bfa", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837914, "uuid": "8315c12c-7466-4084-a91e-741b4fce0575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837914, "uuid": "20568a6a-7233-4fcb-b056-5835ac115ecd", "value": "b0ef6770fdee7d0c34cb638ff1392c55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880c3793-d648-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836755, "uuid": "e2d8056c-62cc-4219-9216-3e0bd00cf34b", "comment": "Malware payload (Heodo)", "value": "e6f8961a3e2549e1d2b6c8ada331cbf3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836755, "uuid": "c306051a-fa68-46c6-a0a3-d62c70293182", "comment": "Malware payload (Heodo)", "value": "5689cb0e7a796ecf647beab18660133125a989f33ce98c83bde3fa90d64121c3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836755, "uuid": "cf5e0aa1-4498-4905-b255-a4a0c302eaf1", "comment": "Malware payload (Heodo)", "value": "c16c455a71afdf03e9cd0bf72d0db58b9478a02f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836755, "uuid": "1d636cd6-0f0e-4a4b-af67-1d4a91ac789f", "comment": "Malware payload (Heodo)", "value": "27bac9fbfe968efc8de32da1acfede7e2be7e437d28818f4946ff99793a6efd956204e7f3190724085e4044a4e8573fe", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836755, "uuid": "800b3052-3a7e-4b73-9d82-c6a8bf15163f", "value": "T126A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836755, "uuid": "1db7d4be-acfa-41fc-a48b-275391021239", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836755, "uuid": "aa3e2b86-2e6d-4758-bb91-6636d8687db5", "value": "12288:uS4BnAed8BK2o0aTa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKia34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836755, "uuid": "e47f87de-f481-404f-9dc0-9946299ee089", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836755, "uuid": "96e00e1f-58af-412d-aa60-bb463ae74e8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836755, "uuid": "57cc90a8-a42f-445f-bb31-8057c70cbb2c", "value": "e6f8961a3e2549e1d2b6c8ada331cbf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4b2479-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908996, "uuid": "8937da83-5e21-422a-bca8-8ca61fe638cd", "comment": "Malware payload", "value": "e415e8be17b100f21647c5f925eb5140", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908996, "uuid": "c93a09a7-8a94-4abe-9b20-0c8a7c3c691e", "comment": "Malware payload", "value": "56a97e8e4f1684ef7373038128b59c368e4a4bdfc0eb4874565d2b4916fb14e9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908996, "uuid": "362abc12-4776-4cc3-8fd3-f2950b2e62ea", "comment": "Malware payload", "value": "53dc168164bdc2a3f73b65b93df8eadd10430ac8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908996, "uuid": "9743b183-a22e-4dbf-aa41-d56c7875f0c2", "comment": "Malware payload", "value": "ad465ef127529f43ca006032fcd7a85905aff02dce678267c2e89d6e6e92633c68b63a37f0c49d541e67fb55e12f1e15", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908996, "uuid": "4ea94da3-cb80-4081-9edb-5357ebbb8d76", "value": "T114A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908996, "uuid": "fb5ed92b-620e-4424-afd5-1745bcb89075", "value": "96:mRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:mRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908996, "uuid": "fd244104-897b-456e-a8ba-e28eb7d7c4fe", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908996, "uuid": "dd82cb5c-765a-4c17-b731-af5b14d8dd8c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908996, "uuid": "d2864b32-5d2a-4923-b4b9-4d181f0589c5", "value": "56a97e8e4f1684ef7373038128b59c368e4a4bdfc0eb4874565d2b4916fb14e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a282385b-d648-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836799, "uuid": "48615381-f556-4b2f-b6c4-a3093a3c79ec", "comment": "Malware payload (Heodo)", "value": "26ce89ba7e20bec95f6da7bf150eecb6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836799, "uuid": "75aea862-4c91-4308-903c-4502367283bd", "comment": "Malware payload (Heodo)", "value": "56e378ab1c1af16f7ae1bbc54f9b9961f6c02f5c7da0d88415c919535904a8c5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836799, "uuid": "d14c811d-9ac5-4d17-9039-522cd7b956b0", "comment": "Malware payload (Heodo)", "value": "859a751d2dbb4910954a8553cce26c016dd41fd2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836799, "uuid": "2700033f-ab66-4d89-b9ef-f12e759dbc5c", "comment": "Malware payload (Heodo)", "value": "d4ee8a15c452341a844b2c6e62589e10533518da1a5d240ccb3a9d275ffeb2502557b538f0efee128d478ab731206d2e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836799, "uuid": "5f79f818-1c8c-4034-b446-9f38f9b377dd", "value": "T132A48B4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836799, "uuid": "9ffcd65b-9ba8-4640-9782-a451baba2878", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836799, "uuid": "00ab23d6-2420-4fc9-b036-b24d3dcc7959", "value": "12288:uS4BnAed8BK2o0aDa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKWa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836799, "uuid": "360c882f-0f71-4704-a1b7-8689ca0151c1", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836799, "uuid": "4d382cdc-5a3a-4adb-ab3b-37260bd89abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836799, "uuid": "56597778-b996-4f7a-a5e4-dfb801198f39", "value": "26ce89ba7e20bec95f6da7bf150eecb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12585273-d690-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652867481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867481, "uuid": "23991e72-5467-409f-b8b6-6e33038c5d31", "comment": "Malware payload (Heodo)", "value": "1dc07797053606a346152a6346476dbb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867481, "uuid": "e7e32bbe-86f7-4da6-9b2a-3dd20ed75056", "comment": "Malware payload (Heodo)", "value": "574677795fcf836f5ed1e3086cd52e29f6d37858f6be73e355d508054de7af32", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867481, "uuid": "986aa9d5-2dae-42ae-aa7c-9fea9adf1be7", "comment": "Malware payload (Heodo)", "value": "d3b1f08e38b7f93e7e4134b3f10ff92e48ee3226", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867481, "uuid": "36b7eec8-990a-403e-be8c-5f302dc8f031", "comment": "Malware payload (Heodo)", "value": "a01f00a99016f4fe571b7e9e81dab9e60e0953aefbc1936e93f62fc7ef4f3c1aba6531366207f8769d4b300311fa6a5e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867481, "uuid": "e3b8d5df-14e3-49f9-b6c6-61da2fcc922e", "value": "T19894CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867481, "uuid": "430d29ad-6bd3-4436-8a7a-bc545e92347b", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867481, "uuid": "574d4c03-99d7-443d-be26-234ec4f58618", "value": "12288:43hV6Pw4aT23Guomv91Wuwf07EIvH3+38+:sb6Pw4R3GujWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652867481, "uuid": "d0c2125e-cf58-4a8b-b8ea-d375201bcfe0", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652867481, "uuid": "1ae25660-167c-4947-8bab-4300e8d437f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867481, "uuid": "cdd7da48-3643-42b1-a8c8-010a5be4a6e0", "value": "1dc07797053606a346152a6346476dbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba38acc8-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908994, "uuid": "7ebd52a4-2978-4dc2-897b-a7185a60c3a0", "comment": "Malware payload", "value": "b1e976eb7c862d0441b493dc2cd38efc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908994, "uuid": "506624a5-7ca6-49e2-bcba-11a429c6a055", "comment": "Malware payload", "value": "574e95619d70a0c45050998c1e9d11b61ec675262f18baa5f456f38f05ef147e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908994, "uuid": "685d1f97-5d61-4198-b3b3-62d2b8f08905", "comment": "Malware payload", "value": "7e83fdfc50939387ebc9bf898636bffe04aa0197", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908994, "uuid": "fe04578b-31d1-467f-949d-ee3c5bcaecf8", "comment": "Malware payload", "value": "4201d7eb8dfc80590e748a54e2296d08809e6746ac1aebbf1f7a96af06e756ea219fe06558a1c90f283d206090e7f401", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908994, "uuid": "26c0fafa-0efe-4e87-8e43-3bc29fe1a481", "value": "T1BA318FCA120282372C62EDB775BA0915F280F8A671DD6A1DE9D83CED858DE1470F4F4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908994, "uuid": "cd2a9f58-cb50-4244-b54f-8f1b32e2721b", "value": "12:q0Fo52bVFkX0FoQ2Kof50FoIi2bDEzKDD0Fo92pBrRB6X0FowL2MBrIBfaO0FolJ:v2scyjTiK8ZNR5DAaL1ZcwksrZtLTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908994, "uuid": "1180d43f-53d8-4279-8ffc-d01e97fe799e", "value": 1700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908994, "uuid": "d36a6ab2-85c8-4315-ac24-1a444a05c926", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908994, "uuid": "16cc5592-3bfa-4b6f-94de-e16566d1cad2", "value": "574e95619d70a0c45050998c1e9d11b61ec675262f18baa5f456f38f05ef147e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80e52c2-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908991, "uuid": "d2e1faa4-de0a-4b12-a6fd-79e4c9fad7e2", "comment": "Malware payload", "value": "52a6588c4c2752ed7907973a41ead71e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908991, "uuid": "2b3ba0d7-07ee-484e-aab5-d16ce1677a33", "comment": "Malware payload", "value": "586384591f71e7cb73b112d7689507fef0e12feec19c82afa71c465edfacade1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908991, "uuid": "947d3a5e-58b9-4b8b-95ae-68b60b2ae238", "comment": "Malware payload", "value": "342e2d583e9ae7c846fe046b5ac531fa9dfdaab8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908991, "uuid": "f0676f3f-a754-4de9-90d3-d978b68f8f55", "comment": "Malware payload", "value": "f9887650d9462dfc37d3c8291ed963b363b33c347d12f67a4cfe6ca38cc32776403b473ebefc5ae08f40238e46529e29", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908991, "uuid": "6b271cc6-6387-4fb5-b45a-18541b7a0b74", "value": "T1E7A1E850112C1AB17246697AD26FFA52B90EC81B09777B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908991, "uuid": "452f9ad6-d21d-437f-8edf-239f1c338f8c", "value": "96:DRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:DRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908991, "uuid": "c6da931c-683c-4051-921f-774ebf889548", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908991, "uuid": "eb4de466-3d4a-4a4a-8014-d7395c52f19f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908991, "uuid": "2fa998fd-77ec-4443-9dcb-3bdee12756f2", "value": "586384591f71e7cb73b112d7689507fef0e12feec19c82afa71c465edfacade1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7442a1da-d6f6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652911454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911454, "uuid": "c2b7f051-5668-442e-a19a-edde1d2963a2", "comment": "Malware payload", "value": "08333acd9ebd2c3604997888313a9fe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911454, "uuid": "678d9b61-f706-43c7-bb9b-46fd01c8d8e4", "comment": "Malware payload", "value": "58a073a50153c1074a4920ff052fa896f1a5679262f9ac54738200d8ff309a2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911454, "uuid": "5d093d4a-59b3-4309-8c52-d8d5c218b19f", "comment": "Malware payload", "value": "1e8c2a770d7b22f234493d788eb2ea30885953a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911454, "uuid": "553e9603-f301-4d8f-875a-59b251356cfa", "comment": "Malware payload", "value": "87bad3c6b15700dbdc20985c093abd38a5420103f8c5fd83e0747293a7efdd02fbc1e275e6f530ef6ee0f8e8a79631eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911454, "uuid": "fce61925-62fb-4d98-b012-92fdde3b9d36", "value": "T1EC05273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911454, "uuid": "89af74a8-9aee-48c6-8858-d275f77d027b", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911454, "uuid": "84803fd6-1458-4a54-af0c-b15ba7d8218a", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oeaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy70Ust", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652911454, "uuid": "cb303462-6bf2-4354-abcc-31da9a0e8fa3", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652911454, "uuid": "acde438d-bcb3-4c36-b496-037fde7c596c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911454, "uuid": "a3ed150c-1912-4b77-9c68-7bcfc4ea79a9", "value": "08333acd9ebd2c3604997888313a9fe3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab5c92e-d69d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652873374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873374, "uuid": "0141e90a-adb9-4ae1-9c62-6a5a3649bd08", "comment": "Malware payload (Heodo)", "value": "800dddae97ff32b1b62a72b9271f2696", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873374, "uuid": "7644e3f1-0cf4-4b13-a91f-e1eecd41d44a", "comment": "Malware payload (Heodo)", "value": "58bb27a7b5b453d16d62c9f8abd9f623fc7553e8fd3d31a6abd96920ba795b02", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873374, "uuid": "8cc2238e-57ea-4302-9c84-955ab47d4282", "comment": "Malware payload (Heodo)", "value": "8b3ef18f75f00d7d0bb6c646a3001f40049657fe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873374, "uuid": "2f3d1c34-51b8-4c28-8865-882b8bfc038a", "comment": "Malware payload (Heodo)", "value": "f548ebd394050cb9fd83d21b8717947087e578cb5d14322e538e4d9c555bc00740b381625da3e4c81ea275c9e2495d12", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873374, "uuid": "71455f15-95b4-406a-9b12-1eab0f5d245b", "value": "T17294CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873374, "uuid": "2f12b585-8e6f-4bc1-8baa-a23bcbb50897", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873374, "uuid": "b984fbcc-1c85-4491-8bcd-3c98cd26e289", "value": "12288:43hV6Pw4aT23GuoYv91Wuwf07EIvH3+38+:sb6Pw4R3Gu1Wlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652873374, "uuid": "5437e8c4-fbbd-4729-898e-a95529feb940", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652873374, "uuid": "4f47f4e9-b7a4-4c80-9b3e-d91c93ebb13e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873374, "uuid": "4188c53c-599e-4f06-a9e8-65ec8bf2b2fc", "value": "800dddae97ff32b1b62a72b9271f2696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc9d945-d6cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652893998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893998, "uuid": "6fc9d307-367f-4659-86e0-b9c75bdc9e8a", "comment": "Malware payload (Formbook)", "value": "dd6738b8bd7f1450c7c21f6bd71b6fa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893998, "uuid": "5a3be618-0625-4b53-b9fc-1e273ca686eb", "comment": "Malware payload (Formbook)", "value": "58dc8fe3046450ddf0e00d1076440c4357f46a6829c41b85f8aa0345d51887c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893998, "uuid": "159eda8c-f138-4590-88e6-0b806d9f4043", "comment": "Malware payload (Formbook)", "value": "db37f6e58a8f940986fee6e2d9b5f3d2fff68a77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893998, "uuid": "98a9e9a5-70af-4949-acfb-d075e2be5c93", "comment": "Malware payload (Formbook)", "value": "fcc000e8a67e42ea1764958aa55b21f8a1968f4a1ef957871e537be66a58502bf29a877eb9bb8521317f1edcc7934635", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893998, "uuid": "dc2c0b24-55df-45ec-984d-1d11c1375c14", "value": "T1882412987FA8C0B7D0C1473269FAA2353BF7D6132494B38B17B05A587E26611AC2F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893998, "uuid": "c73a7dd7-123d-4012-bd6b-b9f1b16061f1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893998, "uuid": "30ba8d88-0673-4b4e-8812-eb38503f7bbd", "value": "3072:VfY/TU9fE9PEtunb8z/nbBaC3oGfkmR5ooWj/+nswgLPoHp/kkUhfL0h3smO/v1g:ZYa6V8z/nNIGfkGoo8zNPKp0lQ5sF187", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652893998, "uuid": "cac5e468-c7c3-4c8f-84a4-b4225b8f37b8", "value": 219324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652893998, "uuid": "9aa56ed9-03ab-4292-91d4-31d898ee15c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893998, "uuid": "57722de0-c10d-4b37-9757-1648c0d14a2c", "value": "dj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad604ba-d649-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652837377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837377, "uuid": "dffe3059-58e2-4607-a74a-abeeddabe166", "comment": "Malware payload (Heodo)", "value": "26f43598d020b9b09fdb3bfe0182d2f8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837377, "uuid": "a735268c-c8d8-4a6b-9df7-3e58ea6835f8", "comment": "Malware payload (Heodo)", "value": "590e43f0dbcc76e043bca0610f76a335779dd7a648006b453ca30e13348725c5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837377, "uuid": "6becfb04-360c-4303-8fea-8dc8851529cc", "comment": "Malware payload (Heodo)", "value": "20c96f8cd626c0cee8a994a4678a8c6c0cc7b7ce", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837377, "uuid": "3efb9d68-b7aa-413c-98f0-67f32298e07b", "comment": "Malware payload (Heodo)", "value": "22cb122d1db41c7e6ece0893a22642440d39be085151f1740ef96f87fff4c92268fecfbae70e081cfa5807b6ffd9c4ed", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837377, "uuid": "6dd4534b-0a46-49e4-8dc7-6caa26e36f82", "value": "T12094CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837377, "uuid": "29a9b700-135e-46d6-8f4b-8975bb627515", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837377, "uuid": "1fbe6916-4891-49dc-8b85-5098079966ef", "value": "12288:M3hV6Pw4aT23s2oNd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ai3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837377, "uuid": "0671b007-fcc2-4285-8cce-ad08423981f3", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837377, "uuid": "fb69df18-772f-4bc7-bac4-2ff19f888f0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837377, "uuid": "e88edcab-be30-42c0-b927-14821e67102a", "value": "26f43598d020b9b09fdb3bfe0182d2f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa10631-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652858448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858448, "uuid": "210611fa-6fcc-42c4-b9f8-4b82a342d141", "comment": "Malware payload (Formbook)", "value": "365e035efad143367e8b7dee7bf5f828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858448, "uuid": "3da106aa-2378-4c2f-90f6-5d89c7416843", "comment": "Malware payload (Formbook)", "value": "599fdd54ded9239527033a4d51f408f92dcb23ced86c8885b47e1f74949397a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858448, "uuid": "54f657e5-5732-4ea5-9930-93de114f8032", "comment": "Malware payload (Formbook)", "value": "a333f1abb7cc8c33cd1fd0b1390688deef7e00b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858448, "uuid": "93868e94-2389-4526-a9b3-01c1be84829b", "comment": "Malware payload (Formbook)", "value": "1b3accee43026263d55ea9536aee340667189059122bb8f2f5177e3767d956d26bf044e0719a99f7e03905a8d6c9eb53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858448, "uuid": "984fcc46-cc3f-460e-ae1f-c09cb04d1163", "value": "T1A034F1107891D96BC8E17FF429B552A766B9AC510434C287ABB83F1DB932213DCCD36E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858448, "uuid": "322149cf-6f04-400f-9b97-9d01f763076b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858448, "uuid": "a6d89bf4-d228-418e-8360-f80524bc76d3", "value": "6144:KYa6VEVDNbZGRwrC1+17jB4e232CtkI3wayK5eYeR4WYSih:KYrYVvrC1+B6e232Cepf4eYeRY3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858448, "uuid": "6503cd25-5b61-456e-9405-e3ee18b20d9c", "value": 235241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858448, "uuid": "76d8a78c-a994-4ce2-a6c2-dcbed859e650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858448, "uuid": "7ad0f2a3-d6a7-4f83-afb7-bb1814bb16ef", "value": "SOA 58097213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9107bc-d646-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652835875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835875, "uuid": "93bcfcf9-358c-4e99-80fa-404a71420033", "comment": "Malware payload (Heodo)", "value": "bf84852cb6bed7e1d9a3cff7435ca503", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835875, "uuid": "3af6a434-9076-4599-9746-62d6adadaeaf", "comment": "Malware payload (Heodo)", "value": "59c904c6dc1c17725a6f2deec4c349799f8e7664be64ea2cd459244e00b5f0a3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835875, "uuid": "bd27061b-353f-4be3-8600-b4bd19abd36f", "comment": "Malware payload (Heodo)", "value": "05e3af30307e6ae19bf427a75b6ed8e590382a10", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835875, "uuid": "860bb1b7-2ed0-4283-8d27-1e58730af372", "comment": "Malware payload (Heodo)", "value": "9d1676f412d2e7c347ccc875f298d294f604a59a321751b3aec1d11c620630b96c33c8709c20b7cca05cda5ea5c8fa19", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835875, "uuid": "3828380e-8852-44bd-a8fc-f0d6d0101da6", "value": "T11794CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835875, "uuid": "f1a851e7-bd46-4e6d-8628-b7c9167c4de5", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835875, "uuid": "65933723-5b9b-4ece-a674-538efa5c9ec3", "value": "12288:M3hV6Pw4aT23s2oPd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ii3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652835875, "uuid": "579634ca-21b1-4909-802b-7ba8c7483098", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652835875, "uuid": "04248ce6-9499-4e7b-82cb-6c6a3090fc3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835875, "uuid": "5969be00-e63b-4b03-97f6-9027af162a7d", "value": "bf84852cb6bed7e1d9a3cff7435ca503", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ab7848-d6f6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652911401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911401, "uuid": "1562914e-0df4-48b4-af8e-c9d6b8fc6dc7", "comment": "Malware payload", "value": "e5434736ce8a5dd403d69a9425578b40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911401, "uuid": "6e242cd8-2c3c-45f1-b366-2639ceac2808", "comment": "Malware payload", "value": "5a11532ad0d5f4c4ee0218e38b2a979279193e83510552af824ee08b49aad196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911401, "uuid": "5c31df57-607e-4b41-b075-281b1f7298c3", "comment": "Malware payload", "value": "f43f17cdb23b13eb6c3dad4e6022d34bc4da9ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911401, "uuid": "efdb19b6-4039-44d8-9b55-e3591c6c3bf4", "comment": "Malware payload", "value": "78887de178bb04b5f1003886866f18a61083ed4af0d70eabf0ab7c7d34eedd7f20942af6f48eb7d4badc0378d2f8ee4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911401, "uuid": "d6738834-d9db-411c-b92b-8865285e7608", "value": "T1E605273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911401, "uuid": "b8892a8a-07ea-4d5c-bd67-2b315f142f4a", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911401, "uuid": "b25cda56-2dbb-4350-8214-8755577c0d1c", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7ovaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7/Ust", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652911401, "uuid": "8ed822ed-56bb-4406-889e-8291baecd524", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652911401, "uuid": "74858784-de0d-4c42-880c-88e175836db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911401, "uuid": "d74cba49-4a17-4256-92c3-5f61e6fa6a25", "value": "e5434736ce8a5dd403d69a9425578b40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3411468-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909063, "uuid": "88797839-2b04-4966-885c-1814dcda1418", "comment": "Malware payload", "value": "caaacd2931b1a6bfa84bd4074df30e8a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909063, "uuid": "6ab13df0-e255-4297-9cd7-4142bbb2ddb6", "comment": "Malware payload", "value": "5a303519987c51b820cc624fa8e4d7b43665b2ccb0fc60defebbc5f7ade76286", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909063, "uuid": "4b63c68b-a9c3-4e8f-9dc2-5e023b2f8c2e", "comment": "Malware payload", "value": "a61f0e02b06c66202fc5d3223a709c4c1f777cb7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909063, "uuid": "c8523af3-beea-4463-9738-fbb751ff9a71", "comment": "Malware payload", "value": "4a1e014e103fbc626a5c1993d5e505009c9ef89a11879f652c940fc33adc5bcafb5cc419c2f5d4bcecf6031501c8cf1f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909063, "uuid": "47595cc3-3a50-425e-b208-4d92118d5136", "value": "T196A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909063, "uuid": "8ed74366-b9d4-4097-9949-986d1eabc7eb", "value": "96:FRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:FRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909063, "uuid": "65ba7fce-8ab2-4dc7-836e-f3923bbcac2d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909063, "uuid": "d2b8112b-71e5-4278-bf8a-95b8303149ad", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909063, "uuid": "b09d220f-aa9a-44a5-b380-c1bf21219104", "value": "5a303519987c51b820cc624fa8e4d7b43665b2ccb0fc60defebbc5f7ade76286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae430fbd-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908974, "uuid": "d38f58f6-d045-4c9a-9e26-6188e935d821", "comment": "Malware payload", "value": "c446f49cb7dc04c1f53133b8f4895bb0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908974, "uuid": "71ab8f54-05a9-4a8f-b12c-3867de2beadb", "comment": "Malware payload", "value": "5a34eb953aef3a278a45c4feb9315b417fd9fc80de07a7e76fcf8b989131ce2a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908974, "uuid": "20617804-afcf-4034-9d23-d07b6ef4e870", "comment": "Malware payload", "value": "8b72f1f356de5d01867633c4cdedead7f34f8829", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908974, "uuid": "39971832-34b4-4633-9d24-db1bf5e2b796", "comment": "Malware payload", "value": "b94851c14e8cf235871181bc7f6aac7051da0bf1ee44ab2829fe6c521e6616db7bb0cd4c5c9bde446a0fdbeb285593c1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908974, "uuid": "176c132f-697d-461e-8a5c-51433ff6a564", "value": "T146A1E750112C1AB17246697AD26FFB52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908974, "uuid": "bda767cd-91a8-4857-b2e2-76493546ac5a", "value": "96:ORYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ORJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908974, "uuid": "178ff6cf-0523-4ca4-a2fd-efea68bc9c17", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908974, "uuid": "f2a66074-1562-4727-a91e-70ad85dbc31c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908974, "uuid": "26d25a51-bd75-49e8-81b1-43f39ebe78ff", "value": "5a34eb953aef3a278a45c4feb9315b417fd9fc80de07a7e76fcf8b989131ce2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539a9bf4-d6dd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652900662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900662, "uuid": "c87dc70e-382c-4b19-9df0-9eeb76ec44c6", "comment": "Malware payload", "value": "c01db36454f33280d614e66bc9307e31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900662, "uuid": "3dc7ac84-e271-48b0-8bfb-406bcf5c74d5", "comment": "Malware payload", "value": "5a48ecb63fad676c8bae6899c7b8d65428cfbba863f7e8189bb2d3668b975190", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900662, "uuid": "6ff8aaf1-de6a-4291-8ccb-ed3f81f47da8", "comment": "Malware payload", "value": "a0647bdf0d39fabb5a101bbb63b9f1807c203fef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900662, "uuid": "d30573a4-1382-4841-90ba-7245218615a3", "comment": "Malware payload", "value": "ef2cf8383eda0c6d7ad5871cd9058f03d37804bd07cbbe1a12d87458b462023d77b5d3ef4c5c668b7e8fa4495a11920e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900662, "uuid": "c3562a6d-437a-425f-ab96-00ad20057d40", "value": "T10605273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900662, "uuid": "c710c56a-3bdb-4285-9f4b-d7a7beb87e9b", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900662, "uuid": "7585dc1a-e792-4005-8d16-14b781c385ec", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7o8aIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7yUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652900662, "uuid": "3704a528-0442-4fda-9265-c9621ebb8af8", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652900662, "uuid": "0835b9e0-0d9d-4140-81c4-2fb35afbd407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900662, "uuid": "4e2f5aaf-646a-4898-8448-6843ae713402", "value": "c01db36454f33280d614e66bc9307e31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30993e7-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908982, "uuid": "9dd941f7-5ff6-426a-a173-e038efde3982", "comment": "Malware payload", "value": "eacde16463b4008497bbf5462e1aff4f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908982, "uuid": "cbe287ea-238c-4c09-bc5b-022d30a48ea4", "comment": "Malware payload", "value": "5a5d1fcd7ed8927ef9bd8a92746e90be50d93f5b196fac8b900aff1daa6c5c6c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908982, "uuid": "1198b7d9-b5ac-4c7a-93b0-ef77b8bfdc43", "comment": "Malware payload", "value": "1d4d47b365a6bf0863d6e6b905774f5a06d037e4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908982, "uuid": "487d7d90-9fcc-4b96-b832-4aadcbbf2005", "comment": "Malware payload", "value": "f50104351860fda299daa53ad38b3d60d561aa875bec9ea3715028f460e5b4f92ba4081bb4d0441ed90bcf6061072dbb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908982, "uuid": "b47e6783-74ca-4938-80ba-ded08d75ad3d", "value": "T17FA1F850112C1AB07246697AD26FFA52B80EC81B09777B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908982, "uuid": "cc410617-0aa4-4612-915a-48c205406be5", "value": "96:0RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:0RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908982, "uuid": "f05d1a67-d1f3-42c1-9b0e-5b15fe2e69bc", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908982, "uuid": "c4c3f535-6284-4da1-8c56-9ec49e373d02", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908982, "uuid": "7d3eec7a-84e2-4b05-8b35-a354bd4c198a", "value": "5a5d1fcd7ed8927ef9bd8a92746e90be50d93f5b196fac8b900aff1daa6c5c6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b755a933-d6c3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652889662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889662, "uuid": "a9fcdb0f-a2bf-4c64-813a-1824999e3091", "comment": "Malware payload", "value": "3981e6208f171ad2f8cac3fb540c212b", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889662, "uuid": "4f4ea28c-4252-401e-9dd8-d6874171bde4", "comment": "Malware payload", "value": "5a7ceb14a223a09ae5d242f318f29c6a3e768060f60fe97935e7359dc5f576e5", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889662, "uuid": "8e3e481a-1557-44c7-bc4a-2d70556e4820", "comment": "Malware payload", "value": "6be22c222941fc90abd54d084272a4655a3a476a", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889662, "uuid": "78d7969f-946b-49ad-ba83-6ad8b77a4d6d", "comment": "Malware payload", "value": "5080a7c5ec5e7e3068e667807c892600f58dcc7cd175f73f851cfb50c70977bb6c6fcc8f3743259e4cd8744841b2d537", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889662, "uuid": "497c2daa-5f9f-493d-90a6-ab7bf0c8dff5", "value": "T1EB8533401FC93E74D64AB1B8EFE029B01C4AA4FDF696C7C613A97DE5C1B1D9421C4AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889662, "uuid": "393cf109-1cad-41f3-82a6-52db08058944", "value": "49152:sSP8cVtbZoblmKGJVMpjwhS3iFRWS1uDaxL+:sfufKvuSS1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652889662, "uuid": "bd9aac08-897b-4fad-ab51-6f245263888b", "value": 1861232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652889662, "uuid": "05aaa185-1b33-4525-a694-04403a837d74", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889662, "uuid": "6b6e7c76-decd-422e-a6b3-d52147c364de", "value": "93847363_ETRANSFER_RECEIPT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c48f53-d6c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652888888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888888, "uuid": "823f60fd-57f6-44c2-b144-3e9652627547", "comment": "Malware payload (Loki)", "value": "26d2ac07ca4a8631e67460d75b202039", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888888, "uuid": "6bb6deb6-abb4-4c76-a39c-2c09ea53d694", "comment": "Malware payload (Loki)", "value": "5adff0202f9a9cc943e3c140f96769904f2948ac19f50207c5ff37d5ce21b514", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888888, "uuid": "a3b500df-7d1a-4475-bd9f-f0274faa9d4d", "comment": "Malware payload (Loki)", "value": "f749cb5fa7b3766ec8d57a55736b6178cb385be1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888888, "uuid": "e92187e9-6dd8-4ef1-a25f-d4c0c80dab79", "comment": "Malware payload (Loki)", "value": "20caaf4769801944658ff561f834694b05ba5d20b8d240857cc546e6d385365e0ff562b101c481fbbfceca968d46d02a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888888, "uuid": "129dda2b-f5d7-4fe0-a153-0a1dc1d4c3b8", "value": "T179F31332313ED21E8C654C81444FF84671495AAAB5F6D31F9BDF6888AA1FFB13786381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888888, "uuid": "ca8a15a6-2c39-4df3-9ff2-3dd07b204f1f", "value": "3072:5Njlxj1Tv4WayU7rqSRilTt13+LySiUpKelE9703rQ2QSiYR85i5arUF1RTsWcyV:L9Tv4Wq7rclB1OLySae1QL7U85iwIJKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652888888, "uuid": "cc2da18b-96d6-452a-9a5c-973f2c752b0b", "value": 171065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652888888, "uuid": "384df27c-1ea1-4a86-9f61-799f08db36cb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888888, "uuid": "49fe7365-e505-4eff-be72-c21b4b1295d6", "value": "DHL_PaymentCopy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674d5d45-d69b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652872348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872348, "uuid": "0be0af05-3390-42e7-8cd6-f3bae4e30b90", "comment": "Malware payload (Loki)", "value": "996e533fafb2e76b54ecf127d6430795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872348, "uuid": "3a75c884-bba3-451e-b899-c713cd2ded71", "comment": "Malware payload (Loki)", "value": "5b6f216bb55b895874ce5a6df3681a44b402cef780dc38eb569aea1cd5528a5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872348, "uuid": "e6457494-8d24-4674-9abc-4bbfed991931", "comment": "Malware payload (Loki)", "value": "314c64d9893e0bf41357b797d1c886aa2966b6da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872348, "uuid": "046c06df-b7ae-446f-a8b4-913006f1431e", "comment": "Malware payload (Loki)", "value": "161c1359c2157308372b84a2e7ec0258658dad63a764da02aa91d4e0a4c705a029b07381c5f2559cbea3deee98d1caa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872348, "uuid": "da52f1f7-d551-4260-ada5-33d066e2b46e", "value": "T17464CF01F7A0C471E0921E304465E7B15B7BB9625730A947F7909B6F1EF33A09AB2B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872348, "uuid": "fa8765ab-e54d-470f-969c-4437dcd9686a", "value": "0d686c4364bc2c7f3a384024716d37bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872348, "uuid": "fe4d2a06-982c-48bb-bbb3-a0bec0734c09", "value": "3072:o4q9wLUtGL6u0sH8PFIcz+qq6seXxRIHz5n6fYsxkgaBChUpZa9uD6Vdyhk+:d4tGL6uHcPe+Fq1eXgZ6fFiga3wVf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652872348, "uuid": "d5a4ae6a-ce7d-4582-8128-3b1c471377b5", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652872348, "uuid": "223e0449-ec95-4eb9-b776-338036a3c6bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872348, "uuid": "726e5adf-5101-4ea3-a18e-b2a6e2e0cca4", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f475db93-d6ee-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908233, "uuid": "6c2e8c14-6795-4641-847c-6bd992b4744b", "comment": "Malware payload", "value": "69c63d8f39dd1d021a5ca0614d2c9f6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908233, "uuid": "7d0c80e4-29e0-497e-8fbf-0f03ada38c04", "comment": "Malware payload", "value": "5c6254634c7bb56df8880d7a486feacac6b218a1a61dc715d1b7ceecc42fef3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908233, "uuid": "40d4f986-812c-44a0-b12a-6bc87889e6cc", "comment": "Malware payload", "value": "623b4aba68e3b1cb5a95548cb3d03030285c1ddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908233, "uuid": "ef864503-610a-4fce-ae07-6e6a6a58e9a4", "comment": "Malware payload", "value": "f1c55f20bb6036f65cee49091d1537588112498b75643fe7071c01d42ac3955304aad4eba2dace143989a9059bc90ac8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908233, "uuid": "fa9be8c8-57fd-4f94-86c6-7aca1933cba3", "value": "T1BC05273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908233, "uuid": "22a6519f-bcfc-4844-87db-2fcc3f275d2b", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908233, "uuid": "54954247-8936-4146-a15e-0c61680ed057", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oKaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7kUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908233, "uuid": "173ae514-402b-43da-bf05-6287e3ef3898", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908233, "uuid": "cba0991c-2ee2-4884-84e8-fcc7a389928f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908233, "uuid": "2a62ea04-432f-4eb5-b8ae-1115dd26cad4", "value": "69c63d8f39dd1d021a5ca0614d2c9f6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6649d4-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652858800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858800, "uuid": "d637f748-0eab-4fb9-897f-29a165fc8036", "comment": "Malware payload (Heodo)", "value": "83e9d65ed1e02e9b784a5dd5aad7371b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858800, "uuid": "14cb79b1-07cd-4cf1-a6af-fe73334ab741", "comment": "Malware payload (Heodo)", "value": "5cae61dc5b8d758f920509200486cdecbf46d6f1608dd8ae78aa49f9d707753c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858800, "uuid": "4e2e7d33-0c86-4412-bb00-2428594b28d0", "comment": "Malware payload (Heodo)", "value": "6db02fbf412360eb7f1b07915177c43a0ee28e7e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858800, "uuid": "e63f0fbd-0212-45f9-81e9-578a128e7384", "comment": "Malware payload (Heodo)", "value": "dc1bb6231c85815b84e68766643e6f9c7a9b421998d7873c3bcf645b8302882cd0ebf8a6e140f2a2d69ebdd56874f0c9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858800, "uuid": "8af02210-c9d6-4087-b0ce-28a6a3132595", "value": "T1A194CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2B7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858800, "uuid": "0c179e8b-f6cc-4196-a86f-a8ef2d027ba0", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858800, "uuid": "6a36146d-a7f7-4d39-abcd-40ff38cc0a75", "value": "12288:M3hV6Pw4aT23s2oOd9zi3BBoNIQ/hsA7:Yb6Pw4R3s25i3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858800, "uuid": "b1be775d-1a9b-478f-9f2a-16a0d84959d7", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858800, "uuid": "317ab9bb-484a-4ea7-b709-4f0440fd2d26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858800, "uuid": "48478ed7-0032-4c89-ba0e-c5d8ec5ca466", "value": "83e9d65ed1e02e9b784a5dd5aad7371b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ca9349-d697-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652870574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870574, "uuid": "2e592000-67ae-463a-aa20-16f191c17cd8", "comment": "Malware payload (Heodo)", "value": "3d43aab2207a7eeeeb4741fed3df2c23", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870574, "uuid": "82fec6b5-8080-4038-8b3d-d4aa6a3061e0", "comment": "Malware payload (Heodo)", "value": "5cc9a5999c2727fa992e1f900a36cc43347941777880dc2c5b15c65c49ea8e6d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870574, "uuid": "9f13b87b-6e26-4622-8cc3-ea3f55616157", "comment": "Malware payload (Heodo)", "value": "1fc5ab366925e3333be98badb2203a4377be8058", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870574, "uuid": "fdbace06-19e6-44bc-a054-c5486fa60f69", "comment": "Malware payload (Heodo)", "value": "d5aa8cdb84b1e98ccc22bd398ff23f8259632f1aaa2f6c46f7654f1b699eae562636dd85c603ebf0480185f9fc0aaa1a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870574, "uuid": "cca78c8c-0f76-436e-9299-d495676cfac1", "value": "T1F394CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870574, "uuid": "df1e9cd8-7099-4295-bb63-b77f56091b54", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870574, "uuid": "6dfb05be-9fea-4923-beca-a2b806a612d8", "value": "12288:43hV6Pw4aT23GuoFv91Wuwf07EIvH3+38+:sb6Pw4R3Gu+Wlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652870574, "uuid": "25557b3e-8196-4314-b0f1-7c26b28f7446", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652870574, "uuid": "189e5591-e6cc-4e5b-aa90-818c62b74097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870574, "uuid": "bde8f29d-6b56-408a-b9aa-28850fa35bef", "value": "3d43aab2207a7eeeeb4741fed3df2c23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b00239-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909018, "uuid": "adc3d5e1-3293-4acd-bd9d-de6739c99cec", "comment": "Malware payload", "value": "ab446bfdaf3d63507f998ae72f7a17d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909018, "uuid": "06a2b4c4-5a55-4bf3-847b-b96ebb14c784", "comment": "Malware payload", "value": "5d0a67af4af627bb548fc79074832441f14a315821388d8eae5599b3cc50ce77", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909018, "uuid": "4923e3bb-6f90-4ebb-9a18-f8aeb0de297b", "comment": "Malware payload", "value": "31724e0e3f4827f28ac4fdc14822506b549db7a3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909018, "uuid": "55d41c80-ed46-4020-bc09-6dee1f7b9e55", "comment": "Malware payload", "value": "64122af094620f49b986ff69fa311c0a06a919a613e750d6e217e080ddd8c85e2a74dcf45b2ff17ea497fae8ef0f1b9e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909018, "uuid": "0fe6630a-61d5-4952-a504-ea384cba0781", "value": "T17AA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909018, "uuid": "611afa7c-0776-408d-ace4-d85ad92e25cc", "value": "96:tRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:tRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909018, "uuid": "aaa42123-2ef0-4eb2-b429-52e54e0f6285", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909018, "uuid": "696ea994-7980-484f-a4a9-e9a186a1be83", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909018, "uuid": "5374fdeb-05e8-4e41-b99f-4d73caab48db", "value": "5d0a67af4af627bb548fc79074832441f14a315821388d8eae5599b3cc50ce77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c3d1e6-d6d2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652896025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896025, "uuid": "20e99688-bcbc-4c2b-a72f-ee83cf4c148d", "comment": "Malware payload", "value": "f699aabbc3cb7e60c9d4438c23ee1fad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896025, "uuid": "7c5c8ffe-d29b-4bbe-8682-63f0db7c2e77", "comment": "Malware payload", "value": "5d49dfb5e3ee04074a1e7972bb57e1edc37b4783c5b6c356036a36442dac2a48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896025, "uuid": "29ee49d7-ea9b-4f6c-9192-56f39e9a5cb1", "comment": "Malware payload", "value": "d92016e303ec615360082e1b7e8c300608abf774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896025, "uuid": "0abfc90a-d3e8-44c9-ba59-2e64fbcf6741", "comment": "Malware payload", "value": "c29e2af05607148fffacf81672ba105b7b3ac65ddfdc5104f637c6bbeb11a06919dd97f7c9921b30b06ba493a2e427bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896025, "uuid": "2870a34c-0737-42e6-9e1e-d6b642beb30b", "value": "T12EE4F12562B8DE54D9AD43BEC06201F407646E17DA42F34BCEA47CDE3D363C1861BA6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896025, "uuid": "c4afeec9-7431-410b-afd6-26d5a8400a48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896025, "uuid": "cf2fae98-f3e7-4fa5-8c62-d67eb5927a6d", "value": "12288:uh6XfQuXvO2l3G4u6v3UbWe5Ca5JMstDD11Zs3+NOJPd2WVcLLLdCSNefh:WWfr/jlWZ6vCfEuJMwDbZNN4d2RLdCSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896025, "uuid": "fbef9724-40b6-48a6-819a-a5dd946603b6", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896025, "uuid": "879530cb-564e-4236-8b93-0768b0dc5776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896025, "uuid": "917da3f0-9ad0-4258-a4be-3aafefec60b0", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.21240.13643.28626", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf44b08d-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652858751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858751, "uuid": "2cdc6288-0642-42cd-a48a-5fd86d9256ac", "comment": "Malware payload (Formbook)", "value": "545818a2b2de1cbbde16b930d4e66294", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858751, "uuid": "662f9859-bf34-4fd9-8b99-37ba5e4b3119", "comment": "Malware payload (Formbook)", "value": "5d51037f4b904bb96dc6ea7eb61f2f1790049a9e5c2270c81f7b6e147478bd2d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858751, "uuid": "9efa6e37-3e9e-4ec9-9398-2de287771db7", "comment": "Malware payload (Formbook)", "value": "2679b23da8736a9402032c168bc98b9b3f5798e2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858751, "uuid": "732e61a0-23a4-4a5c-aabd-ae67061e4580", "comment": "Malware payload (Formbook)", "value": "c920a9369ffdf0593ae6edc4e88f9f48aeaf09340f71b32e9c92a1ddc39bbe784da7dbc3b1541d99527fa3ff5c93f96b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858751, "uuid": "666398d7-570a-4cac-a866-f94b7092e8cf", "value": "T1FE55D04092C0C56BD4864E74CB32D7F12B76ED222195461B33EC7E2F7B36A609D0E79A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858751, "uuid": "29e8ccaa-34e9-4534-aafd-9b0e9f2af0ba", "value": "6144:cYa6P1t8RTn9Bcq8hzQMHZ+mx2Jt9qZ8U8m:cYGRhB28MH3x2J+Z8bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858751, "uuid": "17a602e2-5d01-48f7-b893-b832cceeb0e1", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858751, "uuid": "0f564995-d660-4e33-b473-2ba75fe947e4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858751, "uuid": "791dac04-04f2-4d9d-9064-36120d8c0df9", "value": "Purchase Order 33454.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec35e5b2-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909078, "uuid": "70b00b51-9bc3-4850-b559-2759c68b055a", "comment": "Malware payload", "value": "bd368659a60626f60ef095e30b805957", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909078, "uuid": "b252e35e-73f5-444a-a296-d63733fd12a7", "comment": "Malware payload", "value": "5d60677b32160e7b93a746774b12c0a37b1f5c77e3bb71c21b9ad53038f8c59e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909078, "uuid": "963c0c71-3360-45e1-830f-7b28c8b17ec3", "comment": "Malware payload", "value": "af70c1d7ab27fd248bd8aa57b1b40379e54dfd25", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909078, "uuid": "2a9a6bab-ff6e-4bc6-b1b7-b671a27044a7", "comment": "Malware payload", "value": "9027080e28a5956cb4d2112fd0c1f38cc4a25cfda27807790721c162935aba567fee4fa75ad41fd2bf138abbb40a5a83", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909078, "uuid": "9eb2c6ec-d0ea-496c-81f7-35184e7b5eea", "value": "T118A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909078, "uuid": "168cf61e-6f0b-45a3-8c8a-226f6efa2c10", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909078, "uuid": "76184777-27d2-47b3-bd54-c3fefabf378f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909078, "uuid": "6846db49-e5f8-4456-b392-72828c855985", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909078, "uuid": "c0a00c6b-aa09-4219-ba5d-c28d938fb31c", "value": "5d60677b32160e7b93a746774b12c0a37b1f5c77e3bb71c21b9ad53038f8c59e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101107aa-d6d4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652896683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896683, "uuid": "1d2448b5-f436-408b-969f-1aff24434123", "comment": "Malware payload", "value": "9f6218ae9722b215daee6941f43980c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896683, "uuid": "d5eb4f26-a681-4cd7-917a-a21be356351e", "comment": "Malware payload", "value": "5e2cd0c6d8c39d62ce0311031c9cb39b000db1fee3335e49bde8437b4d4ed420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896683, "uuid": "6960fcce-ed75-4f01-98db-15be686e7359", "comment": "Malware payload", "value": "69ecd70f0dca841d4314250075b2a60b131702bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896683, "uuid": "dcc0bbe0-4a6c-439c-8383-3d51143b9331", "comment": "Malware payload", "value": "371b8491a85243734b0c6192980311359acb34dfb7c89ed4c37dd62a4a83192414af7f23f2038c2fb037eec4aed655ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896683, "uuid": "0cd8c197-f65d-4837-b005-4b1e4be2b648", "value": "T11205283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896683, "uuid": "adb3f513-c0dc-4602-acec-e49498d3fe8c", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896683, "uuid": "aee17d03-5877-4f6b-ac20-5d6340b0b179", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy74mpE3:BTg9UXRD2SeqfZZi0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896683, "uuid": "65387f4f-9f4b-4d8e-a534-2e00243bb3fd", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896683, "uuid": "37f62bc8-6ccc-4b88-8710-7a721982df65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896683, "uuid": "0c8ab300-211c-4714-99ef-2afcb914ebfc", "value": "9f6218ae9722b215daee6941f43980c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9124a414-d6a5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652876713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876713, "uuid": "91bdc72d-6b2d-44b8-993e-43d252e4214d", "comment": "Malware payload", "value": "bd1504d3bf787a16932ea47245174b9d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876713, "uuid": "03fd419e-d09b-4c3e-af85-f2827fe92e84", "comment": "Malware payload", "value": "5ed4ef55bbbd6f335c609d3992e77e733d10cca92aa37dde38d41e4b97b4105c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876713, "uuid": "06acc494-1fff-48ff-b30d-52ef03ee82d7", "comment": "Malware payload", "value": "3a57c41ccbb6e93e6541d4e4df6bf54fd08a1fee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876713, "uuid": "a51e947b-567e-4460-a0bf-b066f3412393", "comment": "Malware payload", "value": "86f32c07661632d8b6874fa65c2560eb7b0c05d81ad1f86d58564bffd783a6b017410dc7deee22e760ec2e9ab4752b4b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876713, "uuid": "071882d0-2d86-44d8-ae8d-20d2e824b3eb", "value": "T11022AF74598A8C65DF8FC6F5100BBE4946333C7ED6D3B442B75CBB580B686E88A25A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876713, "uuid": "58b2ea3a-993b-4b9c-8ec5-32cf62f89342", "value": "192:LjgUXkQNkf1tp0C+9b+aLCLjZuu9KUE5ZcmuZ9EQVgG:LcvcITp0dMo2R9a5Lu3EpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652876713, "uuid": "9ab44fba-c3d5-4e90-988e-7fe208c704d7", "value": 10899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652876713, "uuid": "4feb8f1d-ca2b-4bb2-a9cf-9d78d4dc937c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876713, "uuid": "c4458777-9610-42ad-9365-69135a7c15aa", "value": "SWIFT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c96e08-d64b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652837903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837903, "uuid": "9906d6d9-37fa-484d-9757-20e6325edf74", "comment": "Malware payload (Heodo)", "value": "bdb18ce2b92d7f121f59d4c0699ea9f4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837903, "uuid": "d025b55f-4430-4b06-8994-c922f256f6cf", "comment": "Malware payload (Heodo)", "value": "5f1dc365ea005d252692afec1caa36cfe6ba3102ac7c4af57aefaa779be4a34e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837903, "uuid": "0d9c18b3-52b9-4e02-a3ab-c1ed071decb6", "comment": "Malware payload (Heodo)", "value": "8be1ba0fdf1dda0ad9e29fbb7e4aa743107a5127", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837903, "uuid": "2ed441cb-e6f7-4e80-b66f-9be629f7ad0b", "comment": "Malware payload (Heodo)", "value": "560ec358599be766e555eff57b3484448a78a7235e9c51b6a69f1a2d23a5c22843164250066f3c91623461085d5e4404", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837903, "uuid": "f0be34c6-f4d6-4aaa-b209-520202ccb068", "value": "T1FEA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837903, "uuid": "b8ef7477-1881-4c41-85aa-343d1213db13", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837903, "uuid": "660d7c32-2fd1-43e5-a291-a61aa9cab033", "value": "12288:uS4BnAed8BK2o0aaa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANK9a34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837903, "uuid": "73032e6a-814d-447d-bc9c-e929db9563d9", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837903, "uuid": "e41ef352-713f-4e38-9c33-e80997edf132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837903, "uuid": "e9c66da1-1ac6-423a-9f61-97610bf410c8", "value": "bdb18ce2b92d7f121f59d4c0699ea9f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a853a3fd-d681-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652861290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861290, "uuid": "8dc48905-e39a-4f04-b07d-4bc2b386c1ff", "comment": "Malware payload (Heodo)", "value": "83290580a03725e2df9e568407d6d5cb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861290, "uuid": "280d5125-0c92-4406-b045-dd4fb0b17c5d", "comment": "Malware payload (Heodo)", "value": "5f226be42d2fb3a788de2ed9321327b014c237983d125a8d7543dc37aba86104", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861290, "uuid": "8c37f298-474c-4fdc-b8b2-b3f8f9aee311", "comment": "Malware payload (Heodo)", "value": "3499c829bf1296b0b1bd3fed24b054fc8a29e60d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861290, "uuid": "882db366-5d24-4262-a6c2-a05a07f43bd9", "comment": "Malware payload (Heodo)", "value": "ebf152f1f01ea1997b0cab65087717f231220609648eff9a3310002590d1677be52558c50543e048f86b05d80bb1b343", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861290, "uuid": "eb306642-6a6e-4b0b-a96e-2c931899c2be", "value": "T17F94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861290, "uuid": "7fe5911d-de0d-4b06-b7f3-65acd964e673", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861290, "uuid": "6d1a575d-2000-42f3-819c-30e0edceae29", "value": "12288:M3hV6Pw4aT23s2oKd9zi3BBoNIQ/hsA7:Yb6Pw4R3s25i3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652861290, "uuid": "84c07f7f-a412-4e2e-839b-dca78f108628", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652861290, "uuid": "aa382bc6-ee35-4014-aa8c-0a63f2d8a29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861290, "uuid": "394f0e44-402f-4016-9df5-7a7dceeec799", "value": "83290580a03725e2df9e568407d6d5cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bc519d-d6e8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652905279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905279, "uuid": "eab26192-ac44-487c-a9ab-cdbb42a60a92", "comment": "Malware payload", "value": "c87811f46953fe6ff1a196d5ff628dfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905279, "uuid": "0e366b3c-a6dc-4afd-b7e6-a6c1bca25451", "comment": "Malware payload", "value": "5f75130f3e4cf1a9d614c3ed6e5d3ab1800b103dd313fee68e9abb4e5a98d33d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905279, "uuid": "d2eea487-4047-4093-82c9-f95b59d9d466", "comment": "Malware payload", "value": "296c3c3269c9ed9932fcad897180dac8d7e38e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905279, "uuid": "9352c3fa-efec-4d21-abc5-9284422709c1", "comment": "Malware payload", "value": "311dbf1062a66e20c594b85d9a73abeb5a5cf6c1d451bc0022322efbb080b069da49d940311f7a4a16ad4329fa70f4d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905279, "uuid": "ffd0c2ec-8d77-4687-b9ab-e4d2e961ca46", "value": "T1A805283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905279, "uuid": "b8448c25-1a46-45e8-b62c-065639b70a0f", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905279, "uuid": "d632fe59-0995-4578-9611-01624f6c624c", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy79mpE3:BTg9UXRD2SeqfZZihm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652905279, "uuid": "c8cc2fa2-d31a-45ab-af5f-1addf8ac4418", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652905279, "uuid": "78af6d50-9393-4277-a015-c939b10a96b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905279, "uuid": "42b9be42-d134-496f-87d8-33de0da61c15", "value": "c87811f46953fe6ff1a196d5ff628dfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0356fd1-d6db-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652899931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899931, "uuid": "c041e24e-97d8-402a-aa13-1309aeeca019", "comment": "Malware payload", "value": "51994e5753a8a43cd6fa7478def8eb76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899931, "uuid": "2046301a-5c85-4b16-96e7-436ffe2a7a2b", "comment": "Malware payload", "value": "5fc9ad4d8ffeabbeda27f8b826d686f5213809ec66ddd89d8ccd19a93163a39a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899931, "uuid": "8971b80e-0e90-4340-87e2-37d387051755", "comment": "Malware payload", "value": "a17e5820c327e008d1a067adcd08d76a5648e32d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899931, "uuid": "8486b308-dc57-4e98-87a5-7192ea0df003", "comment": "Malware payload", "value": "9d225d3e682e337d6f052c46a0aa77f53ec9e56e1768a3ae2273b470ded0d462809e94eeaa906955014fdf7b93ad31f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899931, "uuid": "262d85d4-5f8c-4372-853e-c7b7d0c2281c", "value": "T11205283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899931, "uuid": "bd34185b-d1e7-4550-ab02-f92a35ebef80", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899931, "uuid": "416cbd18-a144-422c-8448-06f625c8b46a", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7KmpE3:BTg9UXRD2SeqfZZiWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652899931, "uuid": "e5b87bf2-cbbc-41d9-a058-9eef81704336", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652899931, "uuid": "2a237570-531d-4775-9d3f-0fe4db864138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899931, "uuid": "7c4c1fea-0ed7-4e2c-baf6-c851bd718e83", "value": "51994e5753a8a43cd6fa7478def8eb76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5e303c-d703-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652916994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916994, "uuid": "3b1df81c-05e8-4325-9b36-0359a135f1e2", "comment": "Malware payload (RedLineStealer)", "value": "699ef93dc7beb1bf9803ea6806ea18c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916994, "uuid": "9d7892a9-d260-4aca-a61a-f1bb05b11f33", "comment": "Malware payload (RedLineStealer)", "value": "60468756e379532a057c8987688cced489842957117fad8c215e4d8ed9aa4bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916994, "uuid": "5f7dc523-4f21-4b89-b035-ff15212f1f9e", "comment": "Malware payload (RedLineStealer)", "value": "4a4fdca27e24125a0cc049a84e728db884794015", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916994, "uuid": "e4fb8c15-e552-4e47-ac96-b0385db82944", "comment": "Malware payload (RedLineStealer)", "value": "dc1884bad29f9bb461cccabe5a61a724dbef28b3b0bb4dbc4a09dce53d53eeeee2d8e266c4a6347cf5865d00bdacbfa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916994, "uuid": "dba37304-37e9-43eb-b21d-e3eae5542d07", "value": "T1463633E2F7FD2106D66CEC720C15487AD4A2EE9ADB4F0D84B38CB60B9A737C4194166D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916994, "uuid": "0ba290b9-4678-4fc1-95c1-d28fcba771a2", "value": "96836079f7b4b5fcd504ae2a7ff0a3ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916994, "uuid": "1b417a50-bb4f-4f13-9325-a3e64d89f79a", "value": "98304:8ZM1kOMuHVBsPoUB82wIRbwPjoGQR9jYpQ3FSBUp6Z3ePH7W:ISSLB8Ou9MEUQKH7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652916994, "uuid": "cf99e144-95d1-4c8b-9b3c-5eb53a6fe49e", "value": 5232000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652916994, "uuid": "0e4806af-abc1-4908-b94a-88afb493cc76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916994, "uuid": "3e352c3f-242f-4e10-9659-a06c1456b542", "value": "60468756E379532A057C8987688CCED489842957117FA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00cb3cf-d654-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841949, "uuid": "58928910-121f-4e63-b4b7-028554bd53ee", "comment": "Malware payload (Heodo)", "value": "7d0663f39478ddeb1e8cdcbbf5801027", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841949, "uuid": "3ace750b-ba9d-462c-bc85-9c60fb9550c6", "comment": "Malware payload (Heodo)", "value": "6097b4d68c3b574c8e0fa7df097ade876eded2a6b25df8206dbe187ddcc8348b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841949, "uuid": "35346d2f-afd9-4c6f-9f1f-9f5aa693bf69", "comment": "Malware payload (Heodo)", "value": "4022b18ca3fb15a5e355be4b3604d7e15c3163ca", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841949, "uuid": "13b0406c-b529-4f04-8143-76b0ffc2e68e", "comment": "Malware payload (Heodo)", "value": "cf3e835f01d8d12c6f16830ca7d3fde130feb43f41ad7ec29cd836a5c135c297fea207a0f45bb4a2a11440612852dfd4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841949, "uuid": "a5c3eda2-e92b-49e4-89e8-1e131c3b4835", "value": "T16DA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841949, "uuid": "8c61aef9-e85f-49c2-a359-dc16590b5790", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841949, "uuid": "198576bf-166a-4e6f-9665-dd2ed3260321", "value": "12288:uS4BnAed8BK2o0aaa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKta34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841949, "uuid": "d57549c2-a99e-4722-9de1-f4e22b016528", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841949, "uuid": "db6c2ca4-11f8-44b5-917a-c09119d23284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841949, "uuid": "c4afc33b-c495-4518-ba10-b90fb3992cdc", "value": "7d0663f39478ddeb1e8cdcbbf5801027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ea01e4-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908989, "uuid": "094bcaca-e865-413d-b9db-b250efa4c1ae", "comment": "Malware payload", "value": "7ea96fb736ca3d4289732f5e31642438", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908989, "uuid": "bbc4bb25-0bc4-4b25-b56c-91e2db94c9bc", "comment": "Malware payload", "value": "60cee67e4796c3a4d433b47436de6a4cca6202fb3e874a824b490c5ee690479b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908989, "uuid": "df5d2ea8-2aeb-4bcd-8313-683d4c41fd02", "comment": "Malware payload", "value": "622387697073c81c60229e9ff7a627d857359508", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908989, "uuid": "3edb96e0-c73e-415f-86d2-73c0fbb2fd19", "comment": "Malware payload", "value": "df18c5224b6fec5f1e3c89f23f1a7d04d4c7195c37b38167c4653d2aaeb1dd79f37f5dffc0c1d19d9164957b62b441f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908989, "uuid": "6cbf0fe1-0a1f-4fef-b72f-da9753d1ec25", "value": "T1FC21E27BFBBBC617C490903A0EA313147660D8880019962A7B517A9DDC526517F962F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908989, "uuid": "d359b6da-fdda-41b0-ba9b-37838f3c81e6", "value": "24:3L3Dq3N0yTK+59kL6aN8MA/OlhCrjSkvyeJ9lpaNTawq98:3WVT3GRN8MmDvJ9WNu38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908989, "uuid": "f8d4bf5c-ff0b-4872-93e9-685c4a511bec", "value": 1264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908989, "uuid": "3894cb30-4827-42a5-9033-0aeefed914c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908989, "uuid": "bec86bd5-af3f-4b3b-9920-0e5cdafd740d", "value": "60cee67e4796c3a4d433b47436de6a4cca6202fb3e874a824b490c5ee690479b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd409f80-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909053, "uuid": "078ba7e5-41a4-464a-81bf-593cb9fde3bf", "comment": "Malware payload", "value": "6507c34e89ebe301d33553f8a4dabed4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909053, "uuid": "eed63975-1484-4960-bd1e-8cac388127d5", "comment": "Malware payload", "value": "60f720d2faea7ee35ff0696ca0968618ca0d200260215036e48a12b9ec47da50", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909053, "uuid": "712a5db2-2a98-4d51-890a-697df623848e", "comment": "Malware payload", "value": "4d3cfefe307d9627ff8b44698892d1964d08f4f7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909053, "uuid": "85c22e0d-5457-47bc-bd96-7b7a3bd3ce32", "comment": "Malware payload", "value": "e71119442a5950248607513c572779d5c3e92b98fd71b4a1f3d64a2ac082ee49aa5f3fd35642eba67087d025d210cf46", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909053, "uuid": "4e8d449c-155c-4384-948d-8f297e18af3d", "value": "T117A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909053, "uuid": "4cc0ea53-6834-46bb-8d84-01eefa672f40", "value": "96:fLRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:zRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909053, "uuid": "a7555473-3844-4bc0-ad90-d77fc5800eb0", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909053, "uuid": "f770a2fb-20a5-48cb-8385-df9998d1e756", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909053, "uuid": "a5aa168d-c870-47a8-a4a4-2b0089d79354", "value": "60f720d2faea7ee35ff0696ca0968618ca0d200260215036e48a12b9ec47da50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8c7ad2-d6d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652896038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896038, "uuid": "df27844d-a495-47c3-8c42-7610a7e9aec8", "comment": "Malware payload (Loki)", "value": "45eb7b4ef35da0d16a5536cdaa9c7799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896038, "uuid": "781544ce-1e01-46c6-8542-ec857bbe6a6d", "comment": "Malware payload (Loki)", "value": "610a3b3d5908f770afc5198c6c9aece8b28afedabd492fa90d602df8e1915aa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896038, "uuid": "5220c047-9aa3-4fe0-bf83-40cfe8420030", "comment": "Malware payload (Loki)", "value": "0a874599297d2aa5ae66643fd2fcc2cc3a533a12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896038, "uuid": "06c47529-f688-46f8-b8e9-f556c6eaedef", "comment": "Malware payload (Loki)", "value": "aa849cf6b7883a3a9d0df8933cbcf2d040cf68fd51c6720151d6185b33f28ebc6ee2191d7d6879789cdcd4bec7e3d2dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896038, "uuid": "3a4fdeac-38fb-4975-a9b4-f06216e2c66a", "value": "T19754BE627610C1DBECB946314E6BC1A12EA17C396CD0021F75C8FB9EB5B26129A1FB5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896038, "uuid": "fd57262a-b517-4886-a054-76ea952f823f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896038, "uuid": "138d903b-1365-45b5-b2aa-3a345443ac0c", "value": "6144:iYa6kHjO8CdbmPXkyfWMQbJODWO+/9T6mMWnZTJ0:iYaHjO8C09QM+0mNZ10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896038, "uuid": "064eb2f9-3d56-4761-8ee8-99a9e6206358", "value": 288008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896038, "uuid": "18a1d518-5454-4f6f-9507-9550c8331a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896038, "uuid": "11337e82-416b-4ec9-a43f-8e862d179838", "value": "SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.11102.14335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65dbb047-d6af-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652880935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880935, "uuid": "569b0fc3-e8a2-47f0-9147-6454ed0c4a8c", "comment": "Malware payload (SilentBuilder)", "value": "d8f46c46975e458f2019c27e8406911c", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880935, "uuid": "ab86103c-452d-433f-953b-182e3e27ef41", "comment": "Malware payload (SilentBuilder)", "value": "61e7a5bc6dda4cdf7d6c21edbabc61b22a616014d8648a8d43a83d03f5d75d61", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880935, "uuid": "76aff127-a977-4190-888d-4f84435cf9f5", "comment": "Malware payload (SilentBuilder)", "value": "a88aa9a6b6ad91bd37d78d9341f49ad632b31ef0", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880935, "uuid": "9d960629-79da-498d-a1bd-da10bb90ca7d", "comment": "Malware payload (SilentBuilder)", "value": "a22fc5296a69d351ccc1271c8926f0a0d71d9283f7967f38d42776e32f9251fd76353f78008e9760e560e87bd5d08c2e", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880935, "uuid": "c31fa96e-c9a6-4339-9a1f-cd302ceaf08c", "value": "T1CE735A4AB599D95CE5238739499783A9B313FC110FAB03873549F3A13FF49E05A0751B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880935, "uuid": "f42ed897-3d43-448a-ab7b-f0803131885f", "value": "1536:DMXKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgxBAezwrMCtvJecvRtbM5v:KKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652880935, "uuid": "9950f31b-970c-4415-a10c-c123e5d686ba", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652880935, "uuid": "ec67bcbe-f807-49a9-bea6-76247c3db365", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880935, "uuid": "c7c0f2db-7c9b-40be-831c-18f0045e0dce", "value": "SecuriteInfo.com.XLM.Trojan.Abracadabra.42.Gen.23949.1434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f2f393-d672-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652854862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652854862, "uuid": "30255274-7ced-4b62-b8da-cb2f58fdf197", "comment": "Malware payload (RedLineStealer)", "value": "76c4795dd3f010d4c0602ce5f18adc7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652854862, "uuid": "efb353a8-f3ec-42a6-9f69-2c097eaf3dcf", "comment": "Malware payload (RedLineStealer)", "value": "621e4dc979e2e7cc9458edf0c7ac6f8eee0bdff066d9b14979ad4930ca9dc604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652854862, "uuid": "1a0539bc-c9b8-4b0a-a0c3-e185dc23dcce", "comment": "Malware payload (RedLineStealer)", "value": "89916eacb49a25bae686167a3eff384340279c02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652854862, "uuid": "99fe7993-9bdd-437b-9bf6-a120652b33d4", "comment": "Malware payload (RedLineStealer)", "value": "c2806e5ab0b37b154706880d24fb1140264f5d6494f2325ca1004c9799446b2d8af65c1fca2aa1958c1a30aca86b0a8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652854862, "uuid": "00163d6d-ac76-4013-afa2-8c5e59aac62d", "value": "T170A4F110F390C835E4A52E7058A5D7B6173FB4626570A90BF7946B6F1EB3340DEB232A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652854862, "uuid": "5a7b4d04-2929-4c5e-8246-3aaed5d52aa6", "value": "0d686c4364bc2c7f3a384024716d37bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652854862, "uuid": "5b64976a-2442-45ae-9bc2-358a27ad152e", "value": "6144:t2jMRIYktcXvHzEx+vF+Kb0OPNR0E07sL2cejfhCYTpZIIEksazyiga3wVf+:MMRIYktEGKfP0GyfhdHIIEpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652854862, "uuid": "83837211-0f59-49bf-8f73-9cde45594ccf", "value": 453120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652854862, "uuid": "01046413-86f9-443e-bb38-25a6d7204821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652854862, "uuid": "47e9ee21-6987-42a9-b676-da3c499a33a0", "value": "76c4795dd3f010d4c0602ce5f18adc7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1b3257-d6d6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652897666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897666, "uuid": "23a1bd89-c727-482f-80e2-8a6641304a42", "comment": "Malware payload", "value": "f09c574d47617319ec0a826217a22a70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897666, "uuid": "9dcb1318-465e-4ef7-bed4-d86128b71f94", "comment": "Malware payload", "value": "62dfbde9c630c2de686534eccbc9ef292733b1781d867bdf9a0be9db3072eac3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897666, "uuid": "668c266f-925f-4fbd-96d9-ec0ac35489d7", "comment": "Malware payload", "value": "0ea6b7db099644820d4d84f497595a7c3feb54a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897666, "uuid": "c5c65a1e-a128-47b4-893c-36634415d141", "comment": "Malware payload", "value": "a598a16409d0a37e2cbb1d19ddbd237c1b68f868c5cc2f5af7f75616b92b80b85fe192323643985ffcac8bfa550dcc63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897666, "uuid": "307bd0a2-0e4f-4d43-8103-90d389889d45", "value": "T107E49D9D765079EFC817CD36CA981C64EB20647B531BD283906316ECAA0CAA7EF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897666, "uuid": "29690452-a158-435c-8766-9790fec6725c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897666, "uuid": "d995d13e-099a-4af2-b50f-d0b34e2e03ee", "value": "12288:dVcSRzq1ESvNfpnM+NEO6DUX/kMsRTeymIGkaDGcBXJWvryzjyItHuAVdf68ry8o:dV7G199TQWkVkpD1BXJgUjyaHNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652897666, "uuid": "111c15ec-ab54-4da5-bb18-f30771acf2f5", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652897666, "uuid": "45b571bc-dac8-405f-aee1-087c27f60ca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897666, "uuid": "6a13adca-c3fc-434c-878a-91f0733cf7b9", "value": "f09c574d47617319ec0a826217a22a70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cc5e44-d652-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652840960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840960, "uuid": "7410645e-c289-44b7-ad37-7c2fd12d4b72", "comment": "Malware payload (Heodo)", "value": "e1415655114968c4c46296349b033282", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840960, "uuid": "3235844f-850c-4a69-a931-569bed69ed62", "comment": "Malware payload (Heodo)", "value": "6329ce32bee03dacecacb4fc11b4dc221c95dac2b44ed1656000dd494f29ffcf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840960, "uuid": "895691ed-c671-46bc-aa74-f9dcaad92aa7", "comment": "Malware payload (Heodo)", "value": "df72f333421857ed2acd224186471e0abfe15053", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840960, "uuid": "d999d54b-cdf4-4bf4-b16b-1279a37363c5", "comment": "Malware payload (Heodo)", "value": "5bede22e635b92169b5e1a8acdaa3c41f4dc5c59607075dd19b35006fb6bf2747d5cde818de6b7253a19a982d0768fbc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840960, "uuid": "941614e5-21e5-4a11-a463-c8f204c5606e", "value": "T16E94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840960, "uuid": "60911140-e753-4f0e-8cbc-570de57a8849", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840960, "uuid": "eb1acb00-fa38-4c29-b474-aa1238f6679e", "value": "12288:M3hV6Pw4aT23s2oKd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ni3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652840960, "uuid": "8087fc3a-8b12-41d3-8f78-b89fe53c4bd0", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652840960, "uuid": "fef176c0-b26c-4efe-b040-816bf094aef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840960, "uuid": "7adf09be-a34d-45e9-aa51-e9966c74b323", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0e604f-d653-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841299, "uuid": "d934a480-b495-489a-918f-ee4795da300b", "comment": "Malware payload (Heodo)", "value": "d6aa59a4dea37b39389e724422aab94f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841299, "uuid": "5bde7e91-2e41-4bf2-8883-9f225446c85d", "comment": "Malware payload (Heodo)", "value": "639b1ce18d3ebabad15248ae0ae4b97aceffe25cf8e116537020cf9764950922", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841299, "uuid": "351a05e8-c60e-4bb0-a0f5-1162c450343c", "comment": "Malware payload (Heodo)", "value": "1473ed553cad5ff757b5a4bf94301d76dc1924cc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841299, "uuid": "9fd9b677-d800-450f-a95a-59c7efde3ae9", "comment": "Malware payload (Heodo)", "value": "59e6ccb3a53c73fbd15b0e93575493ff4a67ceb2951c729fc276752a25955e7d4a61d70ea66a0344060246d4a7d65af8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841299, "uuid": "81db5fd1-4403-4a02-9b75-6fc507a0b812", "value": "T144A48B4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841299, "uuid": "86e64171-cf4d-4af3-8bf9-6198fa7c53a1", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841299, "uuid": "dd138ee5-7786-4dcf-805c-3724e62570bd", "value": "12288:uS4BnAed8BK2o0agVa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKta34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841299, "uuid": "c9e921d2-26af-435c-b081-4bac9b5078c4", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841299, "uuid": "556120c3-6458-4225-afb6-d6916a5d8f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841299, "uuid": "db3e1992-f14b-4159-9fec-d525d59eba4d", "value": "d6aa59a4dea37b39389e724422aab94f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab353bc-d6af-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652880943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880943, "uuid": "6e389f12-f8e4-4f08-bd85-2b29fedeadf9", "comment": "Malware payload", "value": "d1037c3c5b2396f786786ef98df9b354", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880943, "uuid": "d073adaf-5a83-44fc-a4bb-abffc2da91c8", "comment": "Malware payload", "value": "64275f77aead35978b0ae377fd943da8dc50879347e4b2e41ad6d9cb0fac9ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880943, "uuid": "efea3219-7bcb-4131-91f7-27bca7494a7c", "comment": "Malware payload", "value": "6dc543b9db3dd46a949bd63bb614e8fa3a695b54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880943, "uuid": "238997df-0848-46e8-97c2-f9d54b7154c3", "comment": "Malware payload", "value": "58bc830ba9e527447337211380d3c017210b5eaf72ddfe0733e4d7d22ad0a75137506eef6306c6ca324e250c1d6e3c19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880943, "uuid": "14c60153-7787-4bb8-bb6a-ea4217982694", "value": "T114D4121A36AE9777D5BC37F820221181937AD11F38A1E7288FD4F0DE6E69F414986E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880943, "uuid": "6219cefe-25cd-49d0-af42-15cdea6bbacb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880943, "uuid": "206dc67a-f0a4-4331-bbba-e6c09e31d086", "value": "12288:RsC1vNmNAujByDoptexy+qnWc+lNSIlGvPVnSQNRiE/MuFIYswjUadViLLjGmwlQ:RsCRaByD4td7YlEZSO4DQyadYLfGmhJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652880943, "uuid": "e6c7ad36-597e-4c2b-a06a-50df8bceea35", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652880943, "uuid": "3e1d9d53-7f6d-48fb-be13-a3c9c307754f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880943, "uuid": "e234e8cb-318a-4740-a551-7ac02ebc7425", "value": "SecuriteInfo.com.Trojan.Siggen17.52320.29669.19631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f584cc89-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909094, "uuid": "6c32d5d1-84c5-4efb-a448-378836b8c87c", "comment": "Malware payload", "value": "17f3aa571d3a8dd17750c887e0fef471", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909094, "uuid": "665c6d8d-c7c7-4be0-be2c-e1bf91159ab5", "comment": "Malware payload", "value": "646ce27bae899abfcdd01fc6b4197839f52602d068e7512f6d411fd299a64005", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909094, "uuid": "7b9875a9-0107-4319-abe3-d167c7c7bc8c", "comment": "Malware payload", "value": "1ce26080b10ad63c15f6c2372d0767673345799e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909094, "uuid": "78b90669-c7d0-4d8d-8f64-d936dc6a5dfd", "comment": "Malware payload", "value": "a5be91e8c4d6faed079baac2bd7b6b4ed10ba348e94622a1f488c573e356eda732bacb6b49c9623ed4a8905507c2f7ae", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909094, "uuid": "a4a713d0-44ef-4d90-aaf1-fe1674dc36d8", "value": "T1BCA1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909094, "uuid": "1950de61-cfeb-4f26-a42d-b9ef320c2d15", "value": "96:oRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:oRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909094, "uuid": "0b2fc5f4-8f29-4a77-86b6-2266851a8dd2", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909094, "uuid": "1dd9a07e-8e98-4dcc-a448-59480351b9ee", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909094, "uuid": "836687bb-f2be-4366-8964-2623371e5a4e", "value": "646ce27bae899abfcdd01fc6b4197839f52602d068e7512f6d411fd299a64005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85e2154-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909045, "uuid": "4abac6cd-495d-4137-b005-e701a691f5bf", "comment": "Malware payload", "value": "dd23f84742eb40c744fa3adc4921fdc7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909045, "uuid": "8c83747d-3bce-4376-840e-9701c585a4a6", "comment": "Malware payload", "value": "64d12c0ab620d25fba35570e09dcecfbcc2fa122bd9b0647174dd5de2a2ea724", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909045, "uuid": "4a95f4d7-1cdb-4771-9e6f-db2b1c800db5", "comment": "Malware payload", "value": "211f44113b63ff102c4bfe17c6a71075cad9e7e0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909045, "uuid": "5ce85ae3-86a2-4eb3-8c75-91115fd87241", "comment": "Malware payload", "value": "acefeae035e63cebb1341f8107fa42105bac25f11b74f0625623398d71f8fb5bddb254df95f00f9feff9a6c6e0090f59", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909045, "uuid": "7ed06fb8-e626-4551-900a-666e6eb34295", "value": "T1C6A1E650112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909045, "uuid": "3008c601-5312-4613-87e3-4bd40e293204", "value": "96:IRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:IRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909045, "uuid": "1c181edf-eec0-4696-9cb7-36f9dbba8a62", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909045, "uuid": "4c0e6e10-d956-465d-af87-eec01a56dbf5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909045, "uuid": "4da4ae03-4dd2-40c0-8687-671bc65f1364", "value": "64d12c0ab620d25fba35570e09dcecfbcc2fa122bd9b0647174dd5de2a2ea724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1444b093-d703-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652916876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916876, "uuid": "f3f86367-44cc-4e87-9e3b-0b1a79093d8f", "comment": "Malware payload (Mirai)", "value": "d524697acb81c81108b13dbd1a8deb31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916876, "uuid": "221ee73a-84f5-4e4e-8299-1c36f834dbc3", "comment": "Malware payload (Mirai)", "value": "6502b7b1436a6e5ce196079560e4164594242a2530d8d19e0058793d891f75ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916876, "uuid": "5cb0d8ca-fe7d-4a04-be4e-fc88d8743b35", "comment": "Malware payload (Mirai)", "value": "ba819e8d63c917fe3bc6822929d7a90da5337ba2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916876, "uuid": "1564693b-e4be-4868-8546-53d81c91d741", "comment": "Malware payload (Mirai)", "value": "adc51c59ca9868b002e2e94a4583c04032b290a261911c49bd6932d8bc2c7ef36e0f669a1d5b7742d9665013cd62a49e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916876, "uuid": "ba3302bb-6f92-4ec0-acd2-dabfc85da734", "value": "T19D63F746F8828B26C5C613BEF92D118D372353E8E3DEB2239E106B6077C646B0F66D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916876, "uuid": "0122fbfd-8740-4a4c-b2b5-17eacca4a7fa", "value": "1536:H0nDSvcYkZbUNS6Q8fKb1duErtX+RZqZk9v0zAIyi+wcauE:TvBkGNxQ6Kb/jJmmkZwcauE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652916876, "uuid": "52a2a06a-5e1f-42e9-97c4-4578aeffc826", "value": 71108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652916876, "uuid": "b1de4e8a-b8a5-41b3-8f19-fc28cd5dc4ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916876, "uuid": "52e34c10-5543-4613-ab55-9ece60f7c9f6", "value": "d524697acb81c81108b13dbd1a8deb31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a86c43-d6a1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652875023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875023, "uuid": "49c58224-6b0b-4717-8231-dcc8d96c9197", "comment": "Malware payload", "value": "587e64be1914fed4a38ff9aad38e71ef", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875023, "uuid": "ee8f7471-06ce-46d8-8967-2bbdfb601791", "comment": "Malware payload", "value": "6551acccf2b95c6ce276b5fe828b6bef8fe32a5d7db0d9468e88781861f1031c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875023, "uuid": "32176bc6-29da-4d75-a839-bcafb1f670c6", "comment": "Malware payload", "value": "c0b1194e0aa4eae2b143d9c5d244d7c024f8aa7c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875023, "uuid": "79dc9c42-2de4-4ecb-9f1e-0c8ef89e17e0", "comment": "Malware payload", "value": "bd244be039bcebbb17cd9c2c1504c0656525603f92497bc1fb51c680d5b925365746f78b2d07dee95634694cd6ab6e42", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875023, "uuid": "3c0c5872-d13f-45fb-a2d4-200b0388e537", "value": "T1B394CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875023, "uuid": "c716ab44-d4eb-41ae-9336-279d3fd20cac", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875023, "uuid": "c6da8639-4bfe-4933-a5db-89625b2e43bf", "value": "12288:M3hV6Pw4aT23s2oKd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2li3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652875023, "uuid": "6087cd30-fb8e-4dfe-98f4-b9ff65b94554", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652875023, "uuid": "24e91586-138c-4db3-b0a8-7c0d67b0a96a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875023, "uuid": "c106f918-9954-4ff9-bcd9-b5fbd5139081", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fd045f-d69b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652872396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872396, "uuid": "e8b4786f-f125-4129-8761-39ee29824aae", "comment": "Malware payload (Quakbot)", "value": "99caf318c76db0b3d18dc7c8ad7eea60", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872396, "uuid": "155f0088-4c38-4765-be39-352e65f8d2a6", "comment": "Malware payload (Quakbot)", "value": "656cbbf5c06e2fdc9c1dbed574568a4e1502ea08733081c8aa89e752c53dfd0f", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872396, "uuid": "44e2a7db-9f6e-4282-8255-49ffeb9ae797", "comment": "Malware payload (Quakbot)", "value": "ad47e514d65a8732a46c542a8e111ca851f7940e", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872396, "uuid": "f990a478-757b-440c-8fb6-91822f171a54", "comment": "Malware payload (Quakbot)", "value": "f0d28a92f2cbeca828e1853973b335aaa63625401aedad80d7479a447986296ffe9c6dadcbd9a2162450d7f035231839", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872396, "uuid": "92ed52b1-0edf-4ba5-811b-08b8cd7c1e0f", "value": "T17BD4AF22E3F04833D1631A7D8D6B676C982ABE513D389DC66BF41E4C5F392813626397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872396, "uuid": "4e4d2043-53e1-4cd5-8fab-b31e9b6bb240", "value": "ff450e39c2143a90380d4f56a4259383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872396, "uuid": "78292715-105b-426e-81e3-f0540bbf3f16", "value": "12288:cHppWamOEUPrsLSyyGq5FXllT1/BI8VwSi9N58msifQu8E:CsdeQLSAi1qMi9DOiJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652872396, "uuid": "d2977f26-ca29-4711-ab13-3d56ae263812", "value": 631347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652872396, "uuid": "39fbf271-8dc2-4feb-ae56-0994e0875c83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872396, "uuid": "a9b46dcc-416e-404a-9007-cf7505d68d5b", "value": "656cbbf5c06e2fdc9c1dbed574568a4e1502ea08733081c8aa89e752c53dfd0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f94cd7-d6bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652887802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887802, "uuid": "0e61151d-65b7-4145-bb71-bd19e8aedc73", "comment": "Malware payload (Heodo)", "value": "a3ffa639d4200ac9ae4cf5bdc628850b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887802, "uuid": "591c0f16-246d-47ee-aaa8-3211ef1247f4", "comment": "Malware payload (Heodo)", "value": "65b09428329e3a288442e7755df2c90f0e4fe889f327ce3c826e0e2e5bf6597a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887802, "uuid": "e883f4d3-3157-4c80-8d66-ff4ef717dc3b", "comment": "Malware payload (Heodo)", "value": "558e2603eccac149643b34629fda9eadb9a6995d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887802, "uuid": "34f5b109-8cd6-48ce-80a9-03385100b973", "comment": "Malware payload (Heodo)", "value": "e4a4e36972587ff7ff90573e40729c267f11425efd92a207ad2b9c2f203b513ed6de50d345bd6da27a801b9240b5cbf3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887802, "uuid": "841cb210-97ae-4d71-a856-069abe136342", "value": "T14554E007A2E940BBE9678278DC570B06D3B2B81257659B9F037147662F1B3A14D3EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887802, "uuid": "b176556e-c111-4afc-8763-f1cff148af74", "value": "8814d1a94d80f9b49a103ad2cb419460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887802, "uuid": "ad18aa30-b6e5-4b28-9c6a-a0ff58fddd56", "value": "6144:yRjSsk3AzLPQW7gbZJpDphv4MOTRqhTAK3yUil5FCsCfHG72:ojVhTQWsblv4RqFAKiNL4tm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652887802, "uuid": "93957385-b707-448e-b74d-91a1c71a6e73", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652887802, "uuid": "cda0a153-4b14-42ab-b4bf-1a89a42d4d7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887802, "uuid": "271e43a2-876f-4a21-a3cb-02c7fe8c0313", "value": "a3ffa639d4200ac9ae4cf5bdc628850b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e00c57c-d65c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652845167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845167, "uuid": "27971385-8418-4c79-946c-31ce3595c7b4", "comment": "Malware payload (Heodo)", "value": "22fdc89a9fbc7c72961cf727a7a68a9c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845167, "uuid": "fcea90ed-56e0-45ba-b148-dc538acaa7a7", "comment": "Malware payload (Heodo)", "value": "65dfb5966dbc0836ccbc59140d806308b8cd93b0298b63a48b85eedc135aa3eb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845167, "uuid": "8c3516a6-6eec-44fa-916f-69e3bedda5a5", "comment": "Malware payload (Heodo)", "value": "738d00696cc309cf7e9e2258ed37d434c1031900", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845167, "uuid": "e647f085-8f95-422b-94f1-c71703aaad8e", "comment": "Malware payload (Heodo)", "value": "4d2826d38669d9a70fc36553026d3606c6ca547a527171706e06e55d40fd78dfda528fdea2e9156f80cd203727bad890", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845167, "uuid": "e8faa213-0ca7-4e2c-adc1-a4f1f75d4bb1", "value": "T11F94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845167, "uuid": "0190b087-8e5a-480a-8e81-c1d163a30923", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845167, "uuid": "b15633ff-04b1-4e4f-afb4-189070ebf9ff", "value": "12288:M3hV6Pw4aT23s2ond9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Gi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652845167, "uuid": "709fd30a-4a10-4884-ba98-dc96c84be17f", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652845167, "uuid": "452a3cf8-ccc5-4433-aca1-25b79d6602c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845167, "uuid": "c22fee56-05c5-4185-b2eb-2b6bc950eeea", "value": "22fdc89a9fbc7c72961cf727a7a68a9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0ba1f8-d68f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652867440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867440, "uuid": "1ddfd003-1270-43e4-9279-e17d5ebc73e1", "comment": "Malware payload (Heodo)", "value": "21b7d53fdbdbcdd3b733162e025683e4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867440, "uuid": "74f58701-706b-44f3-ac12-40d58c69ad2f", "comment": "Malware payload (Heodo)", "value": "665a00d0d06e58fbe155e0efa730e8b87279d58005b14b6d684b39db0d8ae1f8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867440, "uuid": "dca5803c-a9a0-41fe-8f0f-904b3ad3f2df", "comment": "Malware payload (Heodo)", "value": "85ade55fb4b6124346c48e0c3583517ae20e7314", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867440, "uuid": "58038ce0-4c45-4df4-916b-c8f8a6de97a3", "comment": "Malware payload (Heodo)", "value": "83634ec7a379493e6f3ec39b042b01c5c4368f05ed079044e3b09bf03f062378da140d3f63ada6c2d44302bdd13d6df5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867440, "uuid": "1cb05d7d-a241-4ba4-b31a-047baf8626f2", "value": "T12294CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867440, "uuid": "0fd2371d-42a4-42cc-8517-e53dc25e52e0", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867440, "uuid": "f26026c5-0447-4e5b-86d5-d3d1eb33f0ab", "value": "12288:43hV6Pw4aT23Guobv91Wuwf07EIvH3+38+:sb6Pw4R3GuEWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652867440, "uuid": "37d71388-bad7-4e43-9d84-87e37476d3ca", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652867440, "uuid": "26a6705f-ca57-4399-a773-31b8a9b7ae53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867440, "uuid": "fa986e16-1604-4260-acb0-f494d82a4487", "value": "21b7d53fdbdbcdd3b733162e025683e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c4264a-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908967, "uuid": "76a3e9e3-fd92-40e4-9ef4-de125b786081", "comment": "Malware payload", "value": "177e3ac17e2727a9777efa2c07c3eabd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908967, "uuid": "c3006470-23bf-44d9-9706-9aaac4b2de55", "comment": "Malware payload", "value": "668928b8e7f2abaef5b382b450904ef6417621b98bf834834f489da5494d1f38", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908967, "uuid": "d23922ad-9097-4778-afd4-0dbd02297857", "comment": "Malware payload", "value": "c5cbfe3c8b56484480fd661a765735898d3aa160", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908967, "uuid": "98950f69-c44a-4e96-99f2-0ae9c844270e", "comment": "Malware payload", "value": "37bdb51b57c6f5c04f44b43d5d210b9a3f77095b6c09ff3bdb1db850b280ab0f23d8074f3b8d9d6b23672af494952757", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908967, "uuid": "3b504cfd-39a4-46d7-b881-9f8936e0cd3d", "value": "T181A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908967, "uuid": "448f9845-8ff1-4e12-bfab-677346ac0dc8", "value": "96:pRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:pRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908967, "uuid": "b0f8d45f-af33-4f39-9988-5794693696fa", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908967, "uuid": "66614f82-8d4e-4273-99f1-11c25cc6cda5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908967, "uuid": "3372e76e-8c3d-4f55-b983-aaf6cc9009d6", "value": "668928b8e7f2abaef5b382b450904ef6417621b98bf834834f489da5494d1f38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3d8589-d652-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841243, "uuid": "466e5594-ae99-462f-80e9-8ae0c0696f22", "comment": "Malware payload (Heodo)", "value": "d9d2f2626ec82da4e6940a00c1590798", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841243, "uuid": "05177fa3-d2c9-4177-ad51-cb306255feae", "comment": "Malware payload (Heodo)", "value": "66cf59d567cf337b09b0badb92fb92eecd87ecf7d95f17c0ecb62826bf1ba3d0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841243, "uuid": "1d67771a-c205-48ec-81da-4fe01e062fea", "comment": "Malware payload (Heodo)", "value": "a86e30a68b0cdbfa33b6d04b8180b8bb70487582", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841243, "uuid": "b7be32e5-e2e6-4605-89d7-08475d1e5800", "comment": "Malware payload (Heodo)", "value": "adc7ef8103f55f2a544789444921023bb8335ad4e3c0472796a086848eba7dea1bfaf9464467c8ba6d9182847883f64d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841243, "uuid": "bb12d127-1ca7-405e-a918-44faf013d7b9", "value": "T1B194CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841243, "uuid": "81dd5a61-f5c8-4165-8459-c5dbf8d2f47e", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841243, "uuid": "3a111833-b04e-46c2-8710-3a833d00c5ac", "value": "12288:M3hV6Pw4aT23s2ovd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Oi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841243, "uuid": "72e1b386-6b04-48e7-8b1d-85f27ee2e45d", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841243, "uuid": "a826a373-a4d7-4a11-8389-6238022b7132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841243, "uuid": "ffc69afd-6454-4244-afaf-1ed892d1447e", "value": "d9d2f2626ec82da4e6940a00c1590798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97b7d38-d6c9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652892296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892296, "uuid": "02bf585f-be51-42b9-8cdd-c97353672076", "comment": "Malware payload", "value": "7edecb00a993debf96f81618efeef04b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892296, "uuid": "e6998b45-549f-474b-87dd-b3b4ff999737", "comment": "Malware payload", "value": "66e9712df9d7cb50cce3e2e197c49c009058fc126faebcbcfcc1ea87710974ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892296, "uuid": "83975661-6d8f-4229-8987-344d961467f2", "comment": "Malware payload", "value": "a61dc9d96013b78118b7fd8c549cdbe841a6ca11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892296, "uuid": "cc0c522c-a103-4b66-b1aa-e75a9eadfe4d", "comment": "Malware payload", "value": "bed917f84172c4cf7006d6e4ebca2e1771ec206e932ad6ea886996ea38821f1c3237094d3076a8f6955ab60eca25b280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892296, "uuid": "cf86d6a8-8632-44b9-b321-124c440feb4b", "value": "T18A713A23593008A6C84FD2FE3A17244C037150821722A0F75CAA1CCD9EFAFCE36B968C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892296, "uuid": "2f616b96-0706-49cc-9c26-baf32325d814", "value": "332789b16b3cbf52d664f292b88ab62e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892296, "uuid": "0cfad0cb-4622-411d-84a1-68329acd8650", "value": "48:vpgKThwC8yffyTiDh+Y+h+YydbvG2fq3h5baJf8XSfG/7q:BZ3fyMR+RabpCzWkSf4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652892296, "uuid": "28efc895-9aac-461f-861c-aa6b9288c2e6", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652892296, "uuid": "52c9b2ed-3e6d-4e57-859e-bc5001e0d7d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892296, "uuid": "ebebb7bc-31e2-4fae-8273-c9c4e451c799", "value": "SecuriteInfo.com.Trojan.GenericKD.49034362.32322.9416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a9988c-d650-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652840210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840210, "uuid": "793b4bef-53bf-46e5-b442-d6f737f5738a", "comment": "Malware payload (Heodo)", "value": "c323937d82532fbed3978be51cbd2262", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840210, "uuid": "3aeaa309-efcb-4f9a-b104-c411c075cd0b", "comment": "Malware payload (Heodo)", "value": "6712b3161e590a08c401236f919a824befcafb1758cd46c31206f3a5a9e73573", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840210, "uuid": "884cd278-9b8d-4131-8f49-eff1ea7c2414", "comment": "Malware payload (Heodo)", "value": "9e056765bf5b01c0a14b2594aec8765de55b9547", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840210, "uuid": "224ed40f-62df-402a-9600-d80150532dbf", "comment": "Malware payload (Heodo)", "value": "9aeda7ccfaa441d7c4f724674d3a3499cd3d8683ae1e1742428885b8e8c6d9e8bc231f6ca3e78cbe3956e2f71d8f7523", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840210, "uuid": "2ec17d14-7f13-4266-baa6-6f0fe5b34f6b", "value": "T16094CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840210, "uuid": "b026918a-7e2c-4d0d-bc3d-0029ab71958f", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840210, "uuid": "bdce03b1-b12e-42d2-8359-f4d7e7d237af", "value": "12288:M3hV6Pw4aT23s2oXd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ii3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652840210, "uuid": "6231e41a-46d7-42f2-83c0-258d8d99aa87", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652840210, "uuid": "9b9b97d1-03e7-4a6a-ac47-8212dbe48336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840210, "uuid": "e1cc5d26-35bb-48c0-b4b9-fdb1903a3005", "value": "c323937d82532fbed3978be51cbd2262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf80baa-d64a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652837405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837405, "uuid": "a07f89d5-350d-4021-b106-f72bdda4615e", "comment": "Malware payload (Heodo)", "value": "3f73be755fbfda05afe0de8e9387be1c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837405, "uuid": "3a1446c2-0d68-4ae5-af66-aaa687610e34", "comment": "Malware payload (Heodo)", "value": "671e03c3ba45cf3baa91f4534b60658ac05ec3d466adaff7bbec7e3fc2eb6fc3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837405, "uuid": "98ce3937-5813-4753-beae-7eb860fa3a82", "comment": "Malware payload (Heodo)", "value": "f2b3b06f9c8f16ff33970aacb12d2ac3916f45a8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837405, "uuid": "a0f0cd24-6ed6-4865-902c-a6d33ea97200", "comment": "Malware payload (Heodo)", "value": "d19d3db03e30273a0d8f0598ed7d2f6a066104eb288b5087124810e022111adf4b32e4d138123d0692d6475c0601c2f9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837405, "uuid": "836182b7-832a-4510-926e-8e47dae858e7", "value": "T1A6A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837405, "uuid": "6b2ac330-86c2-45f1-9ed9-5c084fd67ee4", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837405, "uuid": "322b378e-6665-4151-9fd0-300072f8b1d3", "value": "12288:uS4BnAed8BK2o0aZa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKoa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837405, "uuid": "96d5235f-1ac3-4d8e-a1a3-d17d20b43753", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837405, "uuid": "4870db20-97a8-477a-bd4c-f1a52fc5dc06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837405, "uuid": "642faf2d-84ac-48ff-9ef2-74ea3a4c8c89", "value": "3f73be755fbfda05afe0de8e9387be1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd5426c-d690-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652867524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867524, "uuid": "aec1a37e-5c97-44ab-8f3b-3ab03aac8fc4", "comment": "Malware payload (Heodo)", "value": "1edde99f9567fe338eea0c8d1e0160c9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867524, "uuid": "ca6980cb-2a0e-4442-95a7-03976ac1b2f2", "comment": "Malware payload (Heodo)", "value": "672d51c3fead224969ee71b85fee2246cdb1f81749e05849607bfd526a89baf5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867524, "uuid": "460869e6-7741-4342-bafb-542f6abc7278", "comment": "Malware payload (Heodo)", "value": "072cf0fcc05d1bbecb83cbedf75d18e57aa9a22e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867524, "uuid": "4a5e05a9-78ab-4619-8772-a2552a9eb653", "comment": "Malware payload (Heodo)", "value": "8dd33c27511e08c2c38d93d4a2d34fd169db760264f38d46d7ec40e531836a229add4a780f79e3c348768be43d6ccd6b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867524, "uuid": "f6dddd3a-3a39-48c1-bf86-114da307706c", "value": "T14294CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867524, "uuid": "11c4655a-fa1f-476f-8d2d-a73614cd3f53", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867524, "uuid": "24f018d5-3922-452f-9bcf-c183c8ae95f9", "value": "12288:43hV6Pw4aT23Guoiv91Wuwf07EIvH3+38+:sb6Pw4R3GujWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652867524, "uuid": "c1550c0a-ff89-4a2a-bf9b-56c33e94734f", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652867524, "uuid": "9838e524-413e-4aae-9b8c-282a315d0fdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867524, "uuid": "68019dd2-1d80-41a4-adf1-3d922b553eb4", "value": "1edde99f9567fe338eea0c8d1e0160c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c306ce96-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909009, "uuid": "50a1172a-5f6d-4595-a0ad-8895bf14df74", "comment": "Malware payload", "value": "34f96a0aa637221c88cd5fba1bacb8ec", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909009, "uuid": "53024e1a-525e-4203-8c7e-07720c45342f", "comment": "Malware payload", "value": "675565516ed862d322b474d92f47ac765230b2fa2e08bf238c47c16a347608a2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909009, "uuid": "a9330971-2f13-4097-acfd-286379fdf92a", "comment": "Malware payload", "value": "c479d65c17d228811f0d2df7008aab5fe3b3cf9a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909009, "uuid": "abed57f9-aeea-4b12-aceb-8ad5c5f62d1b", "comment": "Malware payload", "value": "906c7522b8aa223ab609223659ede62779f1a4af86f945252883a2a8ce1c0a3ed4d6d823dca6bbac8b028b3823c5af41", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909009, "uuid": "de39e291-d855-46a3-9651-03ecc07e4278", "value": "T1973172D92001E57E2FE2A91376F50A15F3859C6679EC3E25D8EE3BE5548CEC43188A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909009, "uuid": "30d385d1-4105-4169-9426-e7d7b93b7b38", "value": "24:vgUQiUJDiKWUrNRAU/tUnJcbUjbUrUoUpxn:vgU/UJWKWUrXAUlUGUvUrUoUnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909009, "uuid": "705d3e3a-3c16-4898-982a-ad69245aa2aa", "value": 1753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909009, "uuid": "a6134dfe-4185-49b0-96fb-29aaf5bb6726", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909009, "uuid": "90d5abda-2d9f-4c86-8c30-67bdf451db50", "value": "675565516ed862d322b474d92f47ac765230b2fa2e08bf238c47c16a347608a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c50ffef-d6dd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652900757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900757, "uuid": "8ec6411d-b558-4780-b4ee-3f6401eaab2d", "comment": "Malware payload (Mirai)", "value": "941ae17649ba11fa46889d7d5df33ead", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900757, "uuid": "150274fe-c1cf-404d-b1bd-c44b619849aa", "comment": "Malware payload (Mirai)", "value": "67ca3587b93671ade8e75a0454e9e89cdb9e5a0e161e6cfe35583824ab7424b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900757, "uuid": "d0d27adc-fb3f-45dc-b94f-7ce83d6f870b", "comment": "Malware payload (Mirai)", "value": "d2c8b19bdecdb0206883030bd94ca30465218268", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900757, "uuid": "b0cecff1-b55d-4ee6-9670-e4df32ae0f73", "comment": "Malware payload (Mirai)", "value": "ee4cd8013798aea58d6b3cc876e96df13ba8ca923a4e3f699b3d0a02769c2dda4c99dae346226e4b5dcd852651f2ce46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900757, "uuid": "c7c8173b-4884-49ea-adcc-0f5cdf7233d9", "value": "T1BAF23BE2B802ED3CFC4FF77E80064A09F932725959821A3657A3FC675C362985E67E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900757, "uuid": "8823d07b-4909-4ed0-b9ba-5eba1255a50a", "value": "768:6Sq8qox2Fj3RiNocEFf5beoOrMHJP8LIN5T8ZTNv7Jc2:jq8f0Fjh2HE7gMHJP8LIb8ZTt7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652900757, "uuid": "9b3d7a73-c049-4c3f-9b43-62aa4433bae7", "value": 35496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652900757, "uuid": "7791caa1-d234-4d63-b0d7-3c0273a985c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900757, "uuid": "b07b120c-153b-461f-9a0b-391788caa907", "value": "941ae17649ba11fa46889d7d5df33ead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eecb3db-d646-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652835853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835853, "uuid": "c8939711-9d03-40ca-8730-b23a51135d62", "comment": "Malware payload (Heodo)", "value": "5fb71ce3d7f2c9c3d755c1141958d88f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835853, "uuid": "25493c33-bb59-4294-9237-baf8efbd4967", "comment": "Malware payload (Heodo)", "value": "6802708f441bea32e2575c308f82e504a39b4283446cb070e2fe0d59cbfe2602", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835853, "uuid": "b64c9cb8-f46d-461f-9470-ac22c046f9e8", "comment": "Malware payload (Heodo)", "value": "98c0a8daecad60eee7dfe835e5c7dc519776022e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835853, "uuid": "a7ff393a-14f0-47c9-809d-01c46cdc2365", "comment": "Malware payload (Heodo)", "value": "e139541651efc39c84c7593e8ebf4f44fe86172f6c6d96755c410244b96d8ab0d32d7c641c904d9db8c81ae05f5ebdde", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835853, "uuid": "a912af27-11ad-409d-9f4f-f023d967e163", "value": "T16F94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835853, "uuid": "37dc6263-16da-4a4a-8372-97879ddf4ea8", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835853, "uuid": "c71633d6-d41a-4245-b34c-6301b811ff12", "value": "12288:M3hV6Pw4aT23s2o4d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2fi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652835853, "uuid": "71624c44-9a8d-4d1f-9647-20a9d42ccc22", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652835853, "uuid": "531dce82-02c4-465a-9d23-032eb74b07c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835853, "uuid": "d15698ab-3e3b-49ac-a18f-401d71f1bfd7", "value": "5fb71ce3d7f2c9c3d755c1141958d88f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b149005c-d6cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652893947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893947, "uuid": "9cce8ef7-ba2e-4132-a1bf-8dfc2f9501b2", "comment": "Malware payload (Mirai)", "value": "0a881d60316fd0a30fe261aff30162a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893947, "uuid": "a3235241-c5c1-41f9-bbfd-f266cd73fbb1", "comment": "Malware payload (Mirai)", "value": "6807751901dd7ddb460e9832d37858af1adf65a80db8e40503a09c4257fd21b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893947, "uuid": "eb0da970-2828-481b-be4a-a3a3e437d239", "comment": "Malware payload (Mirai)", "value": "dc78f486b5b6e7aca4b454bbba1b1641a2715e2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893947, "uuid": "5debe8a3-b221-46bb-95f9-298234d99b61", "comment": "Malware payload (Mirai)", "value": "9edb9f83c46f6f6c28e1b801b47731a07e1a0da059863f09c09d2df4de3d371149ca3fdde82591bbdbd4d4675f4b07c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893947, "uuid": "d715a646-8b18-474b-8691-2d96402679ad", "value": "T1CD93D81D6E219FBCFBAD863447B34A219648339627E1C685D15CEA012F7034E349FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893947, "uuid": "090015fa-3666-443b-9484-ea515eabbe35", "value": "1536:6Jv3wP53+9DqdduhwK5jna4BFpoWA+L1Uxep+BeM:83e39uhL3BFpoj+L1UdBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652893947, "uuid": "f65e375a-4863-4160-a029-08e26c8004df", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652893947, "uuid": "c4f8cfb3-ce5e-4f29-92ff-1cdff20b8203", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893947, "uuid": "070bd0a5-367d-4360-a475-963e9243d98a", "value": "0a881d60316fd0a30fe261aff30162a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb9c830-d6c1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652888547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888547, "uuid": "e2b567ed-bb87-40ae-b790-193caa63b0d0", "comment": "Malware payload", "value": "a5a4fcc263370aabff8e66d7c6dfe121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888547, "uuid": "25b0a4c8-473f-4555-8aec-998a0a1f9557", "comment": "Malware payload", "value": "684e7365753a974042f21a7ebb4cfe271f4265567d16e9fbc9b9f2b00ef39683", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888547, "uuid": "7c10150d-e4ef-418e-aece-9d37c657a6ac", "comment": "Malware payload", "value": "e4ae4586b725fd5eec6ef92e45d246c248a80b46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888547, "uuid": "c1cf7427-d40d-44f4-b320-8a9aacb4213f", "comment": "Malware payload", "value": "c93220d07b19f12288dd63f683ece6b2df6292f5a9cc6b9fd53b5a7a0ef4a4d4a1275a0d9324b79b1d5c90d66d8de32a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888547, "uuid": "51b74610-e917-4b5d-8786-d209cf919c95", "value": "T19194C04A73A50CB9EC7282798C574A01E672B8150771EA7F03E0875ADF2B3D1A53F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888547, "uuid": "e2cd470c-7cdd-4bf7-93e2-e3a987ff482b", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888547, "uuid": "63a41705-6810-44e0-94cc-fa2959a55351", "value": "6144:GgIYnzcJxDpmJIyeV2vR3JDEohbEuRfoP1SKL0w+d7sWOQSH0E9cWdb3BHq:yKz+1pcIuvR3lEoZEu+9T0Rd4Hr9H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652888547, "uuid": "5323b3a1-2ff1-4275-b5f3-37162822b007", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652888547, "uuid": "1f62e0be-cd96-46ac-8abb-2f94e5662fe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888547, "uuid": "4c7d6b3b-1f53-4e79-bd92-b4608704bd47", "value": "a5a4fcc263370aabff8e66d7c6dfe121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6978207e-d666-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652849588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652849588, "uuid": "ce757be4-9abf-425f-ae9a-9c785a7c4840", "comment": "Malware payload", "value": "c7b8831be20f923967cb9270080a3d98", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "shella", "colour": "#F0ABAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652849588, "uuid": "2225e5a2-c6f9-48e3-969d-c09266038559", "comment": "Malware payload", "value": "68816201a76f15dc37c13369bc693825a4ad0c43de96f6fdcd41d77200ff1922", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "shella", "colour": "#F0ABAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652849588, "uuid": "6b0e974b-86a0-4bec-8401-a5ca7cd86c71", "comment": "Malware payload", "value": "3430082d0c1f575a0b486bb4b142ff873dbb9dcb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "shella", "colour": "#F0ABAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652849588, "uuid": "df8f1b9d-e590-498f-a968-2589df25e35c", "comment": "Malware payload", "value": "b36d46dc4eb131d1e9d7fa5ce1f5ab44b45f4b75fdbe866a6bb9c7f22448550653b50f33d6ed3a756ffafbcb0ab9d54a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "shella", "colour": "#F0ABAE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652849588, "uuid": "3812557a-cbe3-4cc3-9591-07c8c46f98e9", "value": "T18A348E007880C436E8FF15324A7EDA6D4A3CB9610765D8EBA3D81D6F4F366D1BA30976", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652849588, "uuid": "41fb03b3-29f5-40fc-9d8c-c77123c0a655", "value": "03e4852cc497d1819eb9a6d5582d4905", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652849588, "uuid": "c5568b79-2fa3-46b9-a34d-102685f4cd25", "value": "6144:lyQIYjNMIVbAkjm6jrlUU7IOAODIRmS3v:lyQj6IVbcuIOK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652849588, "uuid": "c841ee3a-f0ef-408d-a481-33d3dd65daaa", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652849588, "uuid": "e016290e-cec0-48df-9a24-4d375d89358d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652849588, "uuid": "ab1c114d-829d-40d3-83e9-6676d0ade6f0", "value": "artists.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1dc223-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908945, "uuid": "2bf44855-abb2-4ff7-8574-9a5d0e03042e", "comment": "Malware payload", "value": "e3ae1d386499ab7538230e084631e147", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908945, "uuid": "147e2c6b-c51d-4e5b-a2a9-98619a393899", "comment": "Malware payload", "value": "6896b02503c15ffa68e17404f1c97fd53ea7b53c336a7b8b34e7767f156a9cf2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908945, "uuid": "070bb6d4-3453-4f12-844e-f250912c8a95", "comment": "Malware payload", "value": "db96e43a998813447f858e2f429d9a74f4afabc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908945, "uuid": "0e48692e-979f-4660-ad14-e98339e47bf5", "comment": "Malware payload", "value": "0d9aa8ddaa005bc8fe27e2ad4ee9007e2629a91e1ff19ccd3812bca5218eff95550a50e22e71750fcc321feb57ff51d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908945, "uuid": "842de831-4a43-45fc-973b-83bb3a50f2cc", "value": "T1C9F6AD77910338E9E5A98CB4D11425426DAC38875738A3C7BAC871F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908945, "uuid": "63ed595d-20df-483c-8922-9cb7da361e8a", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnai:sXyWSpV+Wu7rI3JEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908945, "uuid": "83f1d876-fd87-487b-924f-7ca996aab676", "value": 16678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908945, "uuid": "e5eebf4b-8087-4d24-925c-bc331c97f6b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908945, "uuid": "ecdb74b1-4e08-46db-a0c8-c37d07336f07", "value": "6896b02503c15ffa68e17404f1c97fd53ea7b53c336a7b8b34e7767f156a9cf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75bbbd7-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909070, "uuid": "4e9e5447-1765-43d9-bf13-938aa068e0f0", "comment": "Malware payload", "value": "9ce1d0cf4f0501efa23b6f9899d3de69", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909070, "uuid": "4e93ae56-3034-4e5e-815a-222bca376539", "comment": "Malware payload", "value": "692ccfa6300c9a1123511303b01d1c194e7c4c3eb9b07cb5eae73c456e01d18a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909070, "uuid": "39a55201-e402-454f-9bab-972d34d46ac9", "comment": "Malware payload", "value": "3fa27dcff059ad1b9c49ff814a95a753ce11b72e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909070, "uuid": "72ed10ab-b289-4b22-b8a7-e5d955f35cac", "comment": "Malware payload", "value": "0c05ad8464f28a6a332525f50bbe9e046307089f31eb0c2389ceb766fd7548d724bf2b47b70b73332ddd9b5500ed8ae2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909070, "uuid": "370d36b6-33b9-49ee-9f0f-544b8a7830fe", "value": "T1453186DA139303756E62A93A76BE4535F180E2CBA8CE9E55F4D838E881CCF086065A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909070, "uuid": "d5303007-ad0e-45b8-a931-0612ba01bc03", "value": "12:q0F/SKfBSKj0F/SKFIBSKFBZ0F/SKvONiBSKvON3Eb0F/SKnBSK/0F/SKYBSKTV+:vyFwL3Eomo+mNNIL8FrsU/wTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909070, "uuid": "2d71127c-285d-4c12-96a8-4120e55fb4ec", "value": 1857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909070, "uuid": "504058f0-1eef-4f38-861c-78c9cd0b4e66", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909070, "uuid": "886806be-c47d-47f4-bc17-7d0af7fb47ee", "value": "692ccfa6300c9a1123511303b01d1c194e7c4c3eb9b07cb5eae73c456e01d18a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5b618e-d695-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652869731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869731, "uuid": "e79f529f-7e94-4af0-950d-beb7c3c1c36d", "comment": "Malware payload", "value": "a0813e4183ced2fbd482abf57b98550d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869731, "uuid": "b52287cb-4fea-47a2-9f4d-1596363c3baf", "comment": "Malware payload", "value": "69a4a076e0d905a2975d5401f324643f661c543c3b30d205818a1b7364a49ec1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869731, "uuid": "82480493-4789-4da4-ba20-d1e3645735f4", "comment": "Malware payload", "value": "d982319c0eb92268d2befd3def52c4d0bfb17982", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869731, "uuid": "881c87d9-e1b0-45bd-ab03-c8a9031e276f", "comment": "Malware payload", "value": "c75bd62923a8ce41363444e5ceb7a7211b4dea2aabdad7bdbe30fb02795db162bb8ccb6cfd3c6aaf7d48a24130b2be68", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869731, "uuid": "6f34f92e-9cb0-4571-b548-3b9b76758559", "value": "T1A233080C38038073E1550939D2C586C55FFE6D133BE3B46FFFA6064A5AE129852BAAF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869731, "uuid": "fe3a5c66-407a-48ee-8cd7-93ccd3a0c94c", "value": "61b61d960f03e3ceec6e590f70d14c25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869731, "uuid": "676788f1-0258-43a8-bcac-73ce89dacf5b", "value": "384:D6EiXKrv4FvREvWtmQknYCOafhbm7qf2AP61UjR+fufJQ4MRoRxSr/UgIeuhODjN:+EEKrURTLv7y2v1UKsC4AzDZxtVt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652869731, "uuid": "7a322e79-cd6d-4e76-a4d7-111141592d17", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652869731, "uuid": "8ce3d317-95cc-4561-aed4-f4de88df3e3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869731, "uuid": "271c5bfa-973a-4302-a3ad-69330e19465c", "value": "login", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec03758-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908975, "uuid": "bba25da2-a8e0-46d3-ac41-9f432b9440dd", "comment": "Malware payload", "value": "fb004406246cceba8c47644e43a1b961", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908975, "uuid": "bdcd6e08-70cd-49e7-b64d-dcc6f11fd911", "comment": "Malware payload", "value": "6a7e8136b080bd81033aa5621bbe6ff36d2f5985cdd98d56eb31056055d8c3e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908975, "uuid": "5bf71cf9-06a3-435a-8a6d-42c4840e1dc7", "comment": "Malware payload", "value": "0a103c9960d4aaf5c4ae94e7f65d592850d7f24a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908975, "uuid": "86c17a31-1d1c-4009-80c8-ca8b2cf138d7", "comment": "Malware payload", "value": "a8e672cb6bc819e255288ff13b9c4d965f512cbd72e938da00692c78891cc17af6e158165367be3b26cd98c80ff5809e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908975, "uuid": "101aa8d4-823b-4eb5-b7a7-6d1bb1e04735", "value": "T1EFA1F850112C1AB07246597AD26FFA52B50EC81B097B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908975, "uuid": "fe7383ef-8337-4574-8388-fed76931475e", "value": "96:gRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:gRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908975, "uuid": "09436fe3-98b2-4ce4-a559-29c3d6d10e32", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908975, "uuid": "2d28e715-e4f5-444f-a405-7b5c455b154a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908975, "uuid": "cd96f710-1ad2-4ee2-8b1e-a81b9396ce0e", "value": "6a7e8136b080bd81033aa5621bbe6ff36d2f5985cdd98d56eb31056055d8c3e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ee9382-d65c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652845153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845153, "uuid": "c1337ff5-277b-4189-9428-b370b6de9797", "comment": "Malware payload (Heodo)", "value": "d76906569ac9b78add275c0caede7487", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845153, "uuid": "6a9480e8-8943-46a8-852c-722304a44a97", "comment": "Malware payload (Heodo)", "value": "6aef558c3dd6566d2a2fd1b560089b3c5b73763f7da00149f2596bf82d10a439", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845153, "uuid": "23031f3c-53df-43a8-8549-f3dd73077408", "comment": "Malware payload (Heodo)", "value": "5e12470b649838964d2cf98bd5fdd9ab44e82147", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845153, "uuid": "7e49b6c8-d5a2-4415-88df-eab28c181207", "comment": "Malware payload (Heodo)", "value": "e98d3d3420bf5fc6673f8ad87c64b78467072f7ea823bb7fd03d476b65690963b28decc65c4cc164a1849dc8fa4cd6b3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845153, "uuid": "b3a49e8f-0b56-487a-bcc5-d09ed37ac39a", "value": "T1AC94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845153, "uuid": "50de6b38-821f-4d76-b41e-b0a7bdfd7a44", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845153, "uuid": "6775cc61-9d43-439d-8bc9-a6722905459f", "value": "12288:M3hV6Pw4aT23s2oQd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Di3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652845153, "uuid": "dc8b1d85-1225-4762-9127-a25c17f4e368", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652845153, "uuid": "551b23ef-5a7d-462f-b956-75eab077ee33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845153, "uuid": "81fea6fc-f310-4207-b659-ba3a848937e3", "value": "d76906569ac9b78add275c0caede7487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6cc5c5-d689-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652864657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864657, "uuid": "bb784a8e-d7da-40c7-a498-056d41da87ce", "comment": "Malware payload (Heodo)", "value": "c2c04ed645a185b58b396e9918e2bfd2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864657, "uuid": "19313694-c95e-4187-a818-6f6495a82a68", "comment": "Malware payload (Heodo)", "value": "6b11da05c36275552b0be17f8f602f45d37af65f05119f9ddd4a2e03a50ae70e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864657, "uuid": "a131e669-6ea4-44a8-8ad3-0b1eb455a7ad", "comment": "Malware payload (Heodo)", "value": "830ddb6749e457ec72f600064a64373e8fdc891f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864657, "uuid": "d6b1cf65-bfba-4f35-aa97-8a88c3d203d3", "comment": "Malware payload (Heodo)", "value": "3d9378566f74b4250db3e7840879302fd89674e46c947363f7a1c9492563b635d79a6e33f84937c5c9a0fc202b357f33", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864657, "uuid": "262e5008-80a2-4fde-b791-9a4a95dd61ad", "value": "T1D994CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864657, "uuid": "8bf9c55f-d8fb-4fd0-b2d3-0067e187ad40", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864657, "uuid": "af4d59ef-2c8a-4846-a1d6-84150e1b4638", "value": "12288:M3hV6Pw4aT23s2oRd9zi3BBoNIQ/hsA7:Yb6Pw4R3s28i3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652864657, "uuid": "2cea5dee-6986-4e1a-918b-64c8f599f135", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652864657, "uuid": "197cc04b-a465-459c-9d30-5dc5ed33f4f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864657, "uuid": "1d2280c5-c30b-475f-a325-81cb9b52e084", "value": "c2c04ed645a185b58b396e9918e2bfd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b034761-d65a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652844490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844490, "uuid": "9146347e-8c18-4ddf-ae7f-d1eb0721bec1", "comment": "Malware payload (Heodo)", "value": "78ef9c838d6bcf2bd06db07fe991033b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844490, "uuid": "2de4f71a-2bc1-4c2c-80b0-10e8465431db", "comment": "Malware payload (Heodo)", "value": "6b5579eec59b5f87edbbb88c23d8307a3cb55580cf5100d9f4ddafe69378f4b6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844490, "uuid": "b5a27331-b37a-4aba-bd2f-93dc627d1ae8", "comment": "Malware payload (Heodo)", "value": "edb1ec4d7d35df29e3661c55aecc8072cd8922c0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844490, "uuid": "b1f61907-3a6a-4ee7-ba89-408873282baf", "comment": "Malware payload (Heodo)", "value": "f937c3c3776d297eba040ed1af947eace10c0b39711767b747a2322b04d994456cb79c90468ae9a041f40533fd59bac4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844490, "uuid": "3527964d-8551-40a1-994c-6f3dd7f21146", "value": "T1B594CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844490, "uuid": "17ddec53-a41c-4a5c-ae00-ff0fb6a468ec", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844490, "uuid": "f2f1604f-0476-437f-a6b9-4379d8752ece", "value": "12288:M3hV6Pw4aT23s2oId9zi3BBoNIQ/hsA7:Yb6Pw4R3s2/i3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652844490, "uuid": "b501dfc6-600e-4683-9d3b-649412f5bf92", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652844490, "uuid": "4066e5d7-820c-4f45-9f09-eb788abf0466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844490, "uuid": "611a90df-d7ad-45aa-b5e8-8742b0e76f65", "value": "78ef9c838d6bcf2bd06db07fe991033b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a13f50-d69c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652872835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872835, "uuid": "30b57aaf-307c-4068-9770-d43f03892bdc", "comment": "Malware payload", "value": "ccc9b019a018122f22e26d9d37ca3ece", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872835, "uuid": "4f567e50-b643-4a85-8788-c9bf6d6bd644", "comment": "Malware payload", "value": "6bbaa968ace0b8f18e386380f14d93bd3cb356978277e557f604731caf76e5a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872835, "uuid": "1c7517c0-5c35-4551-8336-c9da0ec77eae", "comment": "Malware payload", "value": "d6cddf472731e143e1f5191394829c02a54bf429", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872835, "uuid": "b79f0043-88df-4f2c-b9a9-60fc7bda4758", "comment": "Malware payload", "value": "9eb9aa9aba0fe1269dee000f04ea71db869f4013a81187ae4098aae1bacd3706f5bd7c9568b36cecdeaf692e83a2fbad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872835, "uuid": "896acbb9-44d5-48eb-8b53-3f60c47217c3", "value": "T1C2950309A187E27BFCEC08F3445090D4C29C7FAA7B128DCDE97AD58A141F542B7B6D86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872835, "uuid": "90045274-0fe5-4679-aa6f-36c225033dc6", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872835, "uuid": "8b34839a-9093-423b-b022-709da36aaad7", "value": "24576:zry2uXzmwLUCYibhA7b67S2tfd+XW1dphbHEai9K0YP9R/vAG:zun1K/GnTD1d3a9zYP9hAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652872835, "uuid": "9263f3f3-3064-4489-aa33-6f61a658f604", "value": 2061621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652872835, "uuid": "84d5b5b7-677b-4ecb-9565-9e351276d88e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872835, "uuid": "73f6f1a8-035e-4e54-91a4-e01fb3a78206", "value": "ccc9b019a018122f22e26d9d37ca3ece", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca862b1b-d6e9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652906015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906015, "uuid": "123ca18e-9eeb-4d9a-8626-3cb13429a633", "comment": "Malware payload", "value": "bb51381736633ebe935a07b0727b532f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906015, "uuid": "c653caf6-81ba-466b-9020-d0043b04c02d", "comment": "Malware payload", "value": "6c2add17b8ddfbd6cf5d64de6872d794b5455de1b2556599fb0c879fb1de0316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906015, "uuid": "f8adb60b-11b4-41b5-b0a9-6aa6c06152e0", "comment": "Malware payload", "value": "fd33dd6fb61feb60bcdf0bcbde3332f4c3d7c422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906015, "uuid": "7546c1a5-164e-4b8f-8e0c-24f542853fc3", "comment": "Malware payload", "value": "598c87c1773db46ae5961d21c274500f150c133fc22dbf87858574f423853a659dd40cdaf27522a167cd4a4e373b3bda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906015, "uuid": "e5afa7e2-9c5f-47c4-be39-129e5ffa8056", "value": "T15F05283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906015, "uuid": "f395e6e4-0c5c-44df-8956-98158f316d83", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906015, "uuid": "428a621c-f6d4-4fa9-a04d-472df812f90b", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7XmpE3:BTg9UXRD2SeqfZZijm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652906015, "uuid": "0aab54dc-c67b-4370-a838-f15f4bed1f93", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652906015, "uuid": "5399f2fb-8ee4-4b35-b04a-dae4adf96a51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906015, "uuid": "06036b6a-d5c3-4575-9598-ed118dab3084", "value": "bb51381736633ebe935a07b0727b532f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e566123c-d6ee-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908208, "uuid": "bf96f0c7-c119-41d0-932a-f496c64adc11", "comment": "Malware payload", "value": "431d1015c9314efa3fd15b5c4d391a81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908208, "uuid": "69c82a19-2e24-49e1-82b4-68bdc8ba595b", "comment": "Malware payload", "value": "6cffcf30896ced9d6798840837406f8eddd01b16f9fac18d936ff47dfc40f2c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908208, "uuid": "14657dbc-59fa-4104-8bd6-512e4dc406cc", "comment": "Malware payload", "value": "c485291b6ee98e1b499b8e164d2589105d011a81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908208, "uuid": "d36e4665-cdd8-4bce-8075-6bdde89a40ad", "comment": "Malware payload", "value": "df197574e30520bafb4e32ac4457b9798d30805e6370580467f365e825384482d8886530aa5322389c131c08dcfef1a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908208, "uuid": "be3f91f4-1660-4fe5-bfd1-d5950dc819d1", "value": "T1B005273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908208, "uuid": "0378e960-9639-428e-a7ef-b442c337dc41", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908208, "uuid": "7663ee36-e8a3-4672-9e0a-18ffbb4fccbe", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oaaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7YUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908208, "uuid": "7c4d6a1b-550d-4825-b3e6-2bbeec0684dd", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908208, "uuid": "f3b40ced-6f94-4fae-9c64-ef5cdb5f5be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908208, "uuid": "254ef0a7-1133-4c85-83f7-d766a76b8e3c", "value": "431d1015c9314efa3fd15b5c4d391a81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98153515-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908937, "uuid": "34680f1e-af90-4858-80c7-80a9276f6e9e", "comment": "Malware payload", "value": "febedbf78a729ddaa1e41a43b8ebfb3a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908937, "uuid": "92701a0d-bd3a-4e5d-bd7a-2a786b824e61", "comment": "Malware payload", "value": "6d2fb93813495100f6f0f31883753fb669d85e6224a5f1a73f5ef67f41b48ac0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908937, "uuid": "ab1a6bab-d987-4eee-8f7c-d22f8d1d1547", "comment": "Malware payload", "value": "7119703c20de5e715e89d666a3219bf0e196afe7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908937, "uuid": "34e308e2-7cfb-423e-87cc-597211291663", "comment": "Malware payload", "value": "1c36319d6ff908d51591980ddcb050a5b021e5acac3120a0288677520bba524e9164dcd2c963cd606280786e7bd8e3f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908937, "uuid": "f8b600c3-15e3-40aa-b95c-d5c43aaecebc", "value": "T1C7A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908937, "uuid": "837d6b17-1808-425b-8ff8-c28062b5dca5", "value": "96:4RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:4RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908937, "uuid": "d7d21df8-8a71-4cb1-aa6d-7dbf87fdb1af", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908937, "uuid": "ef15677d-9d88-4d35-ab27-0dd4940d9dc5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908937, "uuid": "094d845f-f612-4c5e-855a-5fd5c8352448", "value": "6d2fb93813495100f6f0f31883753fb669d85e6224a5f1a73f5ef67f41b48ac0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb9358f-d6d4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652896816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896816, "uuid": "c09ee4fb-abca-44ac-abd3-95377117469f", "comment": "Malware payload (Mirai)", "value": "770c72da9642942e6a4f134d44ade6a7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896816, "uuid": "382a35e7-5afa-4fa3-94f4-43399f52ad3c", "comment": "Malware payload (Mirai)", "value": "6d9f10faaa219d2816002287c54e62325625412edbb0be29e022b07106d9b88f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896816, "uuid": "74dbad9a-ef79-4cc6-9197-ceb1dacff3f1", "comment": "Malware payload (Mirai)", "value": "c78ceb9841419b4a2aeebc660398661735086ccb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896816, "uuid": "817cf789-cf69-4cf7-8357-90a12af179ef", "comment": "Malware payload (Mirai)", "value": "cad1e7e17ad12fe5d43ef13d02998634b9ec51bae46ec09d8d335814f8a1ba4314b2d527aed01ff2ca98d537bcd61ddb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896816, "uuid": "1633cf9c-ce75-4728-95fe-169d4cea24b9", "value": "T12B03F784B8868A07C6D4537BFE1E42DD3B297388F2DE3313DE166F51368A92B0D6B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896816, "uuid": "62583c8c-e537-4b3e-98e7-5e817f1d9418", "value": "768:vLzqA2WRg5eo40oNCoeS1h3StWBMY/07J1bdWdW:jzq8jyW8tWBJc7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896816, "uuid": "9b8c9600-372e-4d27-8e05-fad391e76245", "value": 37884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896816, "uuid": "259804cc-7b4d-4576-93af-004daa3e85ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896816, "uuid": "d49cb37b-82a7-4c91-b6e3-788acb41121e", "value": "miori.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3935cb-d690-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652867877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867877, "uuid": "784cb850-f346-4832-8e06-fd2896d52eed", "comment": "Malware payload (Mirai)", "value": "8cb21c888c80b7a8e392b2b0eb225b29", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867877, "uuid": "a9062351-26bc-4b5a-8198-841f862a226c", "comment": "Malware payload (Mirai)", "value": "6dc734d40a753becbba9268a82d2efe7b841a3f2613883f14247da46e8c74e02", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867877, "uuid": "04a6494c-ea88-48c6-88ca-dcdd05ca6027", "comment": "Malware payload (Mirai)", "value": "7a2aedea0c45435f792d2131367c6970de60356f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867877, "uuid": "8cbb9875-1983-4b8a-a50a-7b6c3aa6e897", "comment": "Malware payload (Mirai)", "value": "842c582fcaec04737555ccad7f3491263847f0fd1dd6185aec60661f85bbd6f708f9084bda62ce0df11c6b214f1b4032", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867877, "uuid": "58d1a314-cca0-4b1a-9fac-758d5cbf2792", "value": "T1C9630212562A8C02DF314AB57CF86B8B83222FE891EC23F7365D07E41C9B952379F459", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867877, "uuid": "fcd3e668-1c52-48c4-bc7e-53d997c77d4a", "value": "1536:jGcbqBgowX1tHcmQdVkoINlevFf5+GQV9NtgkMNLoYTBZAPvP4fi1U6:9bPcmYvFBUZthALoYTB+P342U6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652867877, "uuid": "61abd47c-a196-4ee1-9940-5aac626d01d9", "value": 70872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652867877, "uuid": "6afd4179-563b-4ee5-8484-89bd17ec1145", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867877, "uuid": "134beb1b-f847-485a-b9df-9bf73027562c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8c05e5-d65a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652844523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844523, "uuid": "92085da2-2af3-4d3b-9556-8e7b94017f94", "comment": "Malware payload (Heodo)", "value": "0e03fa746f38c547769222cb591552f9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844523, "uuid": "ec2f93ab-243e-402c-a895-7445d810144d", "comment": "Malware payload (Heodo)", "value": "6df096e18781a23c1a42cb7eac5304038e38b34dce0cda9b99a9942b89a7c316", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844523, "uuid": "650e60bf-a8ee-4e81-8988-786b545e66cb", "comment": "Malware payload (Heodo)", "value": "897d40973a60d96f2e07d57453aeedfeb314b656", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844523, "uuid": "f464d088-9d2c-405f-ab77-4f85f638e937", "comment": "Malware payload (Heodo)", "value": "249fba9f9b36da1f3dfe4ddaea6c924ddcd96cd03a32ffa52ef43701d2a7a7986b8b3df956f06cb32f47271ecbbc6c05", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844523, "uuid": "4fc2f5dc-e3af-4866-aaea-2efa586173d0", "value": "T1FB94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844523, "uuid": "23609c73-df40-445d-a846-074398d54df5", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844523, "uuid": "be3b16b3-4efc-4b57-8ddc-0cc83c764264", "value": "12288:M3hV6Pw4aT23s2oQd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Di3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652844523, "uuid": "b62bf284-4717-4f13-8a70-508e8c93f52e", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652844523, "uuid": "6107cca0-50d2-4a2b-a6d6-08bbf6c7aada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844523, "uuid": "12dac8ee-c033-484b-967f-2c9e8b98b99f", "value": "0e03fa746f38c547769222cb591552f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2de2930-d6b9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652885333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885333, "uuid": "d4b9bcdb-4b7c-4982-8599-ce44eb54c5fb", "comment": "Malware payload", "value": "67f4e3a178cee3ed31ceecd8fbbf81a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885333, "uuid": "f3705cd2-c39c-4d06-8181-9efb5e3259c9", "comment": "Malware payload", "value": "6fc6719adb17665f0908e1ee93aa7630dd1acf2e11c2230e59d65be2985ea493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885333, "uuid": "74f0d003-1ba7-44be-a299-3696b8c7f405", "comment": "Malware payload", "value": "ea54c789662360c7fa1bf987ff9e2026f00d5eb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885333, "uuid": "c5348e6d-1201-4587-98f9-0d35f9ccb656", "comment": "Malware payload", "value": "25ee9caef34f9a737fa0f2b14d9520e60186f608d11a6fe58f78b24219a468a81cb80ad30a7e7cf962a8bb7100cff2d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885333, "uuid": "959f238e-8ccf-4a93-b311-3ef091922548", "value": "T14854E007A2E940FBE9678278DC570B06D3B2B81257659B9F0371476A2F1B3A14D3EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885333, "uuid": "8cdbb14f-5c86-4e5a-85ae-0a7fe5ede666", "value": "8814d1a94d80f9b49a103ad2cb419460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885333, "uuid": "06dbc9ae-560f-46e8-8eae-c52e3a6ed384", "value": "6144:yRjSsk3AzLPQWQgbZJpDphv4MOTRqhTAK3yUil5FCsCfHG72:ojVhTQWfblv4RqFAKiNL4tm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652885333, "uuid": "75d66af3-a5e8-419d-8e01-a379d77388dd", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652885333, "uuid": "86695843-695b-46d7-8628-5acf452611e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885333, "uuid": "3802b4bf-17f1-4e33-a22c-54d354ccee06", "value": "67f4e3a178cee3ed31ceecd8fbbf81a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36279ae-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909090, "uuid": "eaae6453-c2b4-4923-95c7-5fe3fb048d0e", "comment": "Malware payload", "value": "ef8f9b3991bd5481664344ba5ea90acb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909090, "uuid": "d7cd4fc4-af12-4b74-81aa-af671b5f2551", "comment": "Malware payload", "value": "70b52017d6b9ff88fe5f6ea80337eb3c09abed1570078a928b9943f9dbef77e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909090, "uuid": "c8a58cdb-4703-4c95-903c-20007863ad43", "comment": "Malware payload", "value": "f6c9bf8f39fdbc672a0e78ea7becebcc1f979392", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909090, "uuid": "071a79eb-caa9-4783-9040-e0c58cb577c3", "comment": "Malware payload", "value": "da9f274910674a116d596286a5bad34d68e65f40350c7a3b73b0795d3420f03ac1dfc17d061e06a7876acdee6cfab75a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909090, "uuid": "f3f9e241-c312-455d-82f1-251b7a78dc93", "value": "T1AFA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909090, "uuid": "f5c49736-746e-4b69-a9d4-c749e09bff32", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909090, "uuid": "5984f076-59fe-4524-955c-c14cc51064db", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909090, "uuid": "57859efc-72e6-481f-904a-e18f5f46a89f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909090, "uuid": "10f28932-c3dc-4fc6-8958-d830d351fe1d", "value": "70b52017d6b9ff88fe5f6ea80337eb3c09abed1570078a928b9943f9dbef77e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95cba19-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908993, "uuid": "12668f11-247e-46ca-9855-2ec24ed61dcc", "comment": "Malware payload", "value": "ab24c530b3da4d09a63f9a0d414239dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908993, "uuid": "4e9a0d88-f6e1-4915-8805-63759436685a", "comment": "Malware payload", "value": "71bc3c74ae9589977ef598cb2f7103d7e2f0c2bf153ffea47f41ad69f99f6982", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908993, "uuid": "bbb47962-b740-40fe-bf35-a15efba266e7", "comment": "Malware payload", "value": "b152f19ddae7ec47bb5f1dada5af719681587e5c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908993, "uuid": "7d546424-6941-4e46-8dc4-e371574ca6ee", "comment": "Malware payload", "value": "e45b664c274c3f2d2e7605783805a4f2faba2a4b3d035c360204bfcb6a585bc4324cc6d1d50f5b2b8668c48c889125cd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908993, "uuid": "a269fc31-b27e-4f75-aac7-b1a2ffd30648", "value": "T110A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908993, "uuid": "eaf5b0c6-892f-4175-884e-666bc5faa322", "value": "96:vRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:vRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908993, "uuid": "4a968b6b-f39d-46dc-b8d9-60dfab5d9166", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908993, "uuid": "bbb5c862-320f-46bd-bd97-e003b1134f26", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908993, "uuid": "60276215-0bac-429c-a711-3c8b72a02441", "value": "71bc3c74ae9589977ef598cb2f7103d7e2f0c2bf153ffea47f41ad69f99f6982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6043d35-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909094, "uuid": "dd4691fd-ef30-4d6b-a94f-3a98cc5802e7", "comment": "Malware payload", "value": "012c29d85a8124c11e620371f6859add", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909094, "uuid": "ad357905-95a0-47f7-98d5-f68e26986701", "comment": "Malware payload", "value": "7260a9ce2f1df7e263b23eb65aef833cde755798522ec09e3b6aaa032cc6ca9b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909094, "uuid": "de8f544a-b35a-469d-9272-2861955ffc6c", "comment": "Malware payload", "value": "746648c224ce62d8be6f444dfdd9aa548ee9858f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909094, "uuid": "515b927e-0d72-4178-9272-62ead405c1c1", "comment": "Malware payload", "value": "11b648dfb3881e7123d4e36a21c4f97d7d4ee1bce5120cd6635725a65c88fea14eefc178b5014f5ad2710ab168224ce2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909094, "uuid": "aca13fa8-2707-4511-8b57-b9560c645105", "value": "T1E7A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909094, "uuid": "309a99b2-bf22-49cb-a530-24ed206e4797", "value": "96:SRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:SRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909094, "uuid": "6ac7a3ce-5f59-46df-bd96-21abbdcdf178", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909094, "uuid": "97dbe158-3c54-45cb-a6d9-508b5817c8c0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909094, "uuid": "7a7a6ae8-77fe-46de-a7a6-98e73fc59331", "value": "7260a9ce2f1df7e263b23eb65aef833cde755798522ec09e3b6aaa032cc6ca9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cea4949-d654-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841917, "uuid": "4e2a8b18-fb5d-49b2-aa70-9b7a6bc73047", "comment": "Malware payload (Heodo)", "value": "18f7c570d03dc1eafa2422f6d5da9f75", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841917, "uuid": "e903f5ac-1eb3-419c-b540-56419c625e9e", "comment": "Malware payload (Heodo)", "value": "72d325e4f35d21e7ec8deee986d36c8ba493c80aa979d386b4998de3e9237f0d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841917, "uuid": "7a77030b-6a04-4865-ab0d-5d8a2cb44bbf", "comment": "Malware payload (Heodo)", "value": "ebc74f93844822902a352a675586f59f9a1ccf16", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841917, "uuid": "8a3691cb-cbf7-4d33-aa09-b0dff26f740a", "comment": "Malware payload (Heodo)", "value": "f374a25e2206e654f5f391dbfe74a25ff2545ab26f4f616400583c56b4fc6b35c2ba4825777273664847e5e95cdb5788", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841917, "uuid": "2709f47a-38bd-4b46-8854-9bc08778715b", "value": "T1D794CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841917, "uuid": "efb3ec59-9205-44e8-a9f7-a4f399fbd89c", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841917, "uuid": "a812dc8f-b735-46a9-af15-d8ada461fa96", "value": "12288:M3hV6Pw4aT23s2o6d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Vi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841917, "uuid": "4e6f9791-5638-4dd2-9bf5-d3700d427565", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841917, "uuid": "28fe1c3c-1038-42ee-b45c-314fc56245ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841917, "uuid": "21cd5089-2cda-443e-937c-fbe5d7ef4161", "value": "18f7c570d03dc1eafa2422f6d5da9f75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac639c84-d698-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652871175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871175, "uuid": "c31c537f-18f4-4817-83db-51d07ba81365", "comment": "Malware payload (Smoke Loader)", "value": "80bc7b2b5a80be0f2f093db4bae44723", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871175, "uuid": "94530f84-b293-47ee-a4c7-f6be9699b451", "comment": "Malware payload (Smoke Loader)", "value": "73ff374c87dca3383cff39f9bcb242cb00130d83daed745461245a8c52185046", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871175, "uuid": "864f5389-e058-4d93-b507-772b63edaf3c", "comment": "Malware payload (Smoke Loader)", "value": "de391a3b8150ffbbc738d5d246878a19dc870da9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871175, "uuid": "0c91df41-1492-4acf-939c-7ce442a1e78b", "comment": "Malware payload (Smoke Loader)", "value": "384c0e05af73b2de262e70e80e0b33babda89ca3ac8108931ad1f8dda62780bd30a8d58045b2478b6039ea06497e815b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871175, "uuid": "aecfd633-302d-46ce-93bc-3c338b6803b0", "value": "T11654CF01F7A0C471E0522E304471DBB15B3BFA625570594BF794AF6F1EB33A08AB6B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871175, "uuid": "d812ee4f-9d3f-4e29-b7fe-6263558b2c60", "value": "151adccff5e70213fb31de55ca880f7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871175, "uuid": "ffe58f8e-f0e0-49c7-b443-81a38e0a1bcf", "value": "3072:rqaNh+bIWwRoHpIjd9/zHsxkgaBChUpZa9uD6VdyhkN:2dbIbupUMiga3wVfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652871175, "uuid": "a183216e-3355-4b43-82cc-858f69a89b1e", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652871175, "uuid": "2d08a559-7abe-4824-8b13-846f3e4e54fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871175, "uuid": "e6b56410-35ac-4817-a2f9-9ef369510f87", "value": "80bc7b2b5a80be0f2f093db4bae44723", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2da03a8-d674-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652855724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855724, "uuid": "2c63f334-67da-4a67-9321-08dc8c023476", "comment": "Malware payload (Heodo)", "value": "e19b728da33da224c6ca93d13395e2a7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855724, "uuid": "fa54ad5a-66b4-49c0-b7ec-c03fb2fa8c80", "comment": "Malware payload (Heodo)", "value": "741cef6ed785d872895cb384083af1ada7223e9e0c6ac814b6bf7fc488f46d91", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855724, "uuid": "6faa1802-be3c-4ee5-aee6-176438909a73", "comment": "Malware payload (Heodo)", "value": "0539164af659d794f998e0ba6c42e677c6b1ad9c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855724, "uuid": "0a7e9609-cd6f-41c2-888a-a2476b649516", "comment": "Malware payload (Heodo)", "value": "734cec6f4fade7edd6c5b6acbdb8f0e4bed71a1a7d53c5ed4eae6358be9676894be35f7d55970a11995e8223ef1f3157", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855724, "uuid": "56aae139-fecc-4ef2-9eb3-0f6cf4144f3d", "value": "T180A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855724, "uuid": "8522468a-d867-44ee-bc5c-56c2e1e555f1", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855724, "uuid": "2c70a2aa-897c-4192-81d5-dfa6f6b6e708", "value": "12288:uS4BnAed8BK2o0ara5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANK6a34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652855724, "uuid": "fef111ee-a3d3-4533-a318-7b786dec1037", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652855724, "uuid": "1e4ebaef-a075-482b-a6da-fdd9c365170e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855724, "uuid": "9f4ca1a6-dd1e-4b6a-8699-43070f970b68", "value": "e19b728da33da224c6ca93d13395e2a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c380c05c-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909010, "uuid": "3a7a4066-76c2-4521-ae93-46edc116c0d1", "comment": "Malware payload", "value": "4ea25fa87b0ada823dd817b74c71bfbb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909010, "uuid": "8d295551-4b74-4fb8-8046-a1da381cf9da", "comment": "Malware payload", "value": "7467c44e5cd69dc364da3b31041f919c3947520497d81f08ac95d4d2a26b6571", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909010, "uuid": "22a82943-b4c2-4e07-a750-0c3348e64bb4", "comment": "Malware payload", "value": "e8799fc05a0930d1cb6511bee09ce7b381d95192", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909010, "uuid": "4e05c8d1-1d2b-4dae-8038-7e17b95dbf5a", "comment": "Malware payload", "value": "ef1aa475a6e1970e51ce2b1aa19e50c050db9c9421f43f4ee8f50a405a6b407c35b344fc170e4a4cb5e422386caaeac1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909010, "uuid": "82d2aa4f-d0fe-4351-9d2a-91755d91a3a5", "value": "T1A0A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909010, "uuid": "e744a8f5-0198-4b47-b50b-f24554a34341", "value": "96:yiBRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:yGRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909010, "uuid": "611a6ba9-7151-4b36-8aa2-0d8b87c7b200", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909010, "uuid": "17f3f46d-4fef-49d8-861d-a7e49888d520", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909010, "uuid": "f28db997-0061-4a7f-880e-6eb3e6c56d57", "value": "7467c44e5cd69dc364da3b31041f919c3947520497d81f08ac95d4d2a26b6571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30e7441-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909036, "uuid": "7717588a-df97-43ee-9b84-5755b3e51091", "comment": "Malware payload", "value": "bc581cdee184c348da6f619e2cdb71bf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909036, "uuid": "d4553025-2caf-4c3c-adcb-97d8d990625a", "comment": "Malware payload", "value": "746e400308c107964f581d72b5c5846f152c72b9d9527b244f68ac22e5cc7a99", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909036, "uuid": "43228f61-2548-4c35-9f3b-8b78503d3f66", "comment": "Malware payload", "value": "fd79a3d551fd38da014bb8980c3e16accff7e7f0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909036, "uuid": "a607bb31-d030-4fa8-973b-0bb2ab47e941", "comment": "Malware payload", "value": "ff0efd5c9a3043dabbc2173b1f9139013eea7ff3221878b958b6414a4776dce8a29c9bd669fbfb0df1b4af6f8f8e9180", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909036, "uuid": "04cd8371-a2cc-4dbb-9da7-615d227963bc", "value": "T154A1F750112C1AB07246697AD26FFB52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909036, "uuid": "b972bea0-ce58-46df-a4d3-77bcfe3be45f", "value": "96:ERYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ERJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909036, "uuid": "f6dfddbd-d08e-4e03-85ee-4ebf221d8fe3", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909036, "uuid": "3edfa4fa-b446-4669-b219-437aee356d3d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909036, "uuid": "a0296cfe-8c4e-4912-aaf1-8fb001482a5f", "value": "746e400308c107964f581d72b5c5846f152c72b9d9527b244f68ac22e5cc7a99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a303e7c0-d65a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652844531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844531, "uuid": "56a4d28b-12b9-472d-a7e5-3d7cb244a6ee", "comment": "Malware payload (Heodo)", "value": "b81703c9f983e3120a3a43ff8c27b826", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844531, "uuid": "5e45e69e-e466-41b6-a018-61d27fbf9ec7", "comment": "Malware payload (Heodo)", "value": "74d84618e0e20e2d882863df5a0b6f804a269de7b70d2e443998adce1bbc448d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844531, "uuid": "cac66933-c1a3-4fa7-9a0c-f5bf88a0a494", "comment": "Malware payload (Heodo)", "value": "7a6bbee864b466bfad20e4dea2eebccf1d3a70c9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844531, "uuid": "497dd636-1d7d-4a33-b63b-a9e746e8696b", "comment": "Malware payload (Heodo)", "value": "0416011abb8b894b5d4d15099192cc7d716f0e88fd7058b508dd3354fad44f20e577d0e339127082ce86f589569dc93d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844531, "uuid": "ab65b2b9-7ffb-44a5-a35a-bd8aa3495dfc", "value": "T16DA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844531, "uuid": "c8f70bbe-32eb-4941-b690-03ae127501b1", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844531, "uuid": "fa3b255f-bb0a-48d1-b509-56b3303f8565", "value": "12288:uS4BnAed8BK2o0aga5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKba34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652844531, "uuid": "629cb114-196d-4bb2-a554-3a295c088f4b", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652844531, "uuid": "b1c8a092-f53b-4960-a621-12cd80495745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844531, "uuid": "2f4e2508-8843-4ece-9a4d-3ecd3a4a43f6", "value": "b81703c9f983e3120a3a43ff8c27b826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea962d09-d686-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652863549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652863549, "uuid": "ed4249e8-a4dc-4454-995e-7c169f5e7957", "comment": "Malware payload (Formbook)", "value": "83ce6e5657a000cdc73745b28c947062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652863549, "uuid": "3afa6928-e014-4f8a-a2db-c60ea1162cf4", "comment": "Malware payload (Formbook)", "value": "74d899ed4530360888ebb92670a622a99d8afe21dd4d3aa91d5e2501d7137f60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652863549, "uuid": "fac6defb-0635-4bc3-8aa3-cde2bd8a56ec", "comment": "Malware payload (Formbook)", "value": "bda7c70de89de4793ecbd3d83a726b2731bf3832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652863549, "uuid": "d0b1324d-5e2c-43f0-ae63-b8783e291196", "comment": "Malware payload (Formbook)", "value": "3616f5f4f0c2361d61761de77b255c73034e3c55193f1ce01c273a3ce6e669ac94aade3d3b9d3f892bc7653e2f950d25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652863549, "uuid": "d5512d32-1f13-4191-b858-4ee40bcf5228", "value": "T146F3B557BB8C9B8EC709CBB5347646301620EF6366609B56F9C4FE3D09B13DD26180EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652863549, "uuid": "35582912-c98f-4558-bdb7-367db4ed3b0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652863549, "uuid": "884f2381-0de7-436a-b6f0-0f4b367d33a1", "value": "1536:K0NgMSQnvYJxqG1BzlWSZxinhbsANixUm67Jb91LbiG:8MSQngJxqG1BJWVnhwAixUmiFiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652863549, "uuid": "a627befb-f843-44ac-8357-9411d8914af4", "value": 165936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652863549, "uuid": "4b03fdf6-5c67-4e06-b8b7-75cd47bdf276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652863549, "uuid": "5cd9dc8c-b8f5-4485-8b7a-35cfb543d790", "value": "New Order No. 6353526728.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4166eb56-d669-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652850809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652850809, "uuid": "a8d075c9-972c-4798-ac52-bdd88d127352", "comment": "Malware payload (RedLineStealer)", "value": "c66c7b69f97756c822d96f391efc0071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652850809, "uuid": "89aa08eb-a7f6-424f-82ab-57a5503bc633", "comment": "Malware payload (RedLineStealer)", "value": "74dbb920497b47d6ad0e96b5375723d9bc9534ace5f2260a2d2aaf0411e8894a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652850809, "uuid": "15d5d70f-ccde-4073-8a23-9854cc74d676", "comment": "Malware payload (RedLineStealer)", "value": "4acf8174189b0a7459eba90da5abd76cf146ed4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652850809, "uuid": "ca2be96f-15a4-4e6a-a8e9-b7e254ec0cf5", "comment": "Malware payload (RedLineStealer)", "value": "9661df84084a0ea645dd5755ba48f93494292978df65aa99ca5feced1f989d3411f8492714edf543a920c8894cbc23bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652850809, "uuid": "6b1289bb-b20b-4f6e-94ab-f0eabb6bb70a", "value": "T1714502126B91C832E56522B808F7DBF563AAECFD2311710769D43B1A2E16382DEDD731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652850809, "uuid": "29a433fb-e5d6-4465-a9b5-9757c686d866", "value": "8fcc5f774a216e90fb9a3f769d223996", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652850809, "uuid": "d88dd662-86b5-4db6-8bfc-ba0400c00ed8", "value": "24576:F65Hx0qvmYQzOf2lm24s1fJ6wX2co9B5RsyZq:F65Hx3vsO+cVEX2c+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652850809, "uuid": "36527f28-439d-494c-8bf3-4f7210608abf", "value": 1187360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652850809, "uuid": "acd6656c-9672-45fd-9839-ef60eca81f58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652850809, "uuid": "a6b4429c-a475-4103-9250-89db7153ff73", "value": "c66c7b69f97756c822d96f391efc0071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a0b86e-d69d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652873179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873179, "uuid": "a60388ee-2768-435d-b110-0cf33d70b81e", "comment": "Malware payload", "value": "0fc7696b30ffd08c67194a4a631bf003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jlaive", "colour": "#8D1737", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873179, "uuid": "dc8b1fea-0833-4a8d-abf9-91fc6b0a4c26", "comment": "Malware payload", "value": "752f7a41e54b838825578bf7c29e547a9879f947e5963c5b7249e63451cc50cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jlaive", "colour": "#8D1737", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873179, "uuid": "150cd25b-b2d2-4523-bf1c-997767048672", "comment": "Malware payload", "value": "593b2a06009ad075de6ab6282072662644318d4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jlaive", "colour": "#8D1737", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873179, "uuid": "e4848d0e-33b3-46a0-8b20-3023f3c79508", "comment": "Malware payload", "value": "c5d2d6fa80cc72319bbefd81ec90e1cca33b3affd797f6ee4d22ecc3fdde35a2f92d4eb51a3c3f8c27dbe236d773dc43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jlaive", "colour": "#8D1737", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873179, "uuid": "7b3cc424-645b-4085-99cd-aa5b107fd5e4", "value": "T14232E91277E4C637DA7A56F254E321000BB6BA166821EEEF5CD7188D4DE1F4046A2F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873179, "uuid": "98fcd7d8-db71-43fb-90c6-f4fc39cb0bd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873179, "uuid": "630a6960-fd72-4053-ad54-ace3e220f440", "value": "192:4q2qIjQe06RUsvR3UNWiwBrs06aeKH8AMU3Dn7MPBC/fypn:8T8e06RUsvR33iwBdteC9MU3Dn7MPBcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652873179, "uuid": "38843d2b-2ead-4278-ad9c-65b93b1e29e4", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652873179, "uuid": "7944b2d7-bc6e-43eb-9451-889f247fd768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873179, "uuid": "fb048f12-476a-43a3-a0af-9fd5c193a70c", "value": "Jlaive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d985d9-d655-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652842494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842494, "uuid": "adb5f243-3c6c-4949-adc1-5a6256a04ec8", "comment": "Malware payload (Heodo)", "value": "c98aa028fed0c3839606496970ea9a62", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842494, "uuid": "7e390b4f-d9e5-4aa4-b71b-e4c635870eaf", "comment": "Malware payload (Heodo)", "value": "753bd031159e6e624584ec02ff212859a65fc908b8645d0d0e99d315ecbd7dce", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842494, "uuid": "fc026b4b-64ae-421e-88f3-d17a4318c111", "comment": "Malware payload (Heodo)", "value": "32ae0d844809f40dd8ad8a15e1bc0365eccaaa96", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842494, "uuid": "a9c64acc-ba99-41d4-a23c-b608eb568d5b", "comment": "Malware payload (Heodo)", "value": "dabfa15a5e4668e7ac1311f61249bf8136884b522c6e2cbb4b279333265b625ff40096553086c0ed9e2de7a5312f4763", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842494, "uuid": "3ed41faa-9204-4fe7-958d-d137c23a28b0", "value": "T16C94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842494, "uuid": "8ac87f02-53be-4f6c-8cf2-9acd1ce9b363", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842494, "uuid": "6f00a587-05db-4503-a1a6-79639d6298a6", "value": "12288:M3hV6Pw4aT23s2oZd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ai3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652842494, "uuid": "bbf7b06e-eb59-4f86-a17a-e19fbafa9c29", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652842494, "uuid": "3937c487-71ba-4c68-bcc4-28d32270d9e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842494, "uuid": "18350d7e-8685-47f3-93a7-b17ff97fae7c", "value": "c98aa028fed0c3839606496970ea9a62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc524e99-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909025, "uuid": "26881e28-2360-4b9b-a208-ff3664c9795d", "comment": "Malware payload", "value": "3f30c6afd7c16eee3f8f266dcf3b707b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909025, "uuid": "72bd92fc-226a-44f3-93db-07b7b0f38d9b", "comment": "Malware payload", "value": "757560f2a6c50679515af70ea228c4a0f5910ee5a9008cf7b9960ae9be8318b8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909025, "uuid": "382e66ba-2fb6-4058-87d1-473f8d291350", "comment": "Malware payload", "value": "2dd89133311993caa44bc02823b23b8e12048f7e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909025, "uuid": "2267a318-3f51-41d2-9bcf-38f77a293f20", "comment": "Malware payload", "value": "a974e89395fe3963806305b427da8e7ed2f194b60c2bf16ea7c5a0772a48bdf8a409c0293551eb635e0f0f77de9c2415", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909025, "uuid": "ce75918f-46f3-4f93-a8b6-91290cebcef1", "value": "T10EF1F9D8A14C0AF318D8E69A35BFDC9C77E4C1C7751B5E4D59AB0CBB6005789B00A9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909025, "uuid": "c95cbe10-b6ab-4f0c-a234-a56212426fe7", "value": "96:jaJRSciZ4caiyjHu1DF+f4l2onzg0UtXbG89ZgwD9q9z:jaqLzfqyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909025, "uuid": "2edf9410-3b20-4d11-a4ba-4f2091f203d7", "value": 7790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909025, "uuid": "13e0c7e3-ac1b-4d06-8d41-d502e9032185", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909025, "uuid": "2439f39c-9803-4747-ae2b-b06f11f31dec", "value": "757560f2a6c50679515af70ea228c4a0f5910ee5a9008cf7b9960ae9be8318b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d46bb2d-d6fc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652913912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913912, "uuid": "89293ac1-1c89-479f-aa9e-072367f70de7", "comment": "Malware payload", "value": "8ebb25947e786f53255810554570b438", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913912, "uuid": "f2860de0-81cb-4c03-af4d-d9cac07baff2", "comment": "Malware payload", "value": "7592412937c52f7d81438e54bd987ad9a79cad910930dc4ae18d5b4215d52221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913912, "uuid": "01f24a4d-1683-4490-92c8-0cf709bb0054", "comment": "Malware payload", "value": "667b23c4bf60dbbadf38c6d58a33b4fba294947d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913912, "uuid": "297b19f9-4a3c-4b22-8497-a0171a32bd8b", "comment": "Malware payload", "value": "d25aa33c6bf30b322d5e16e9e61a2f68c5ceef9a4d81d2b447a6a3d5785cb6d53f247bc88ed27ba185ce0efd129aea36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913912, "uuid": "17ae1f69-9616-40a6-a8e8-cc444a89cf30", "value": "T14705273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913912, "uuid": "312440c8-295f-4eb6-adc5-ddcf36cc2fbb", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913912, "uuid": "c9a861d8-82ca-4078-b11e-25839c2ea6c0", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7ozaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7HUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652913912, "uuid": "68fcfeb6-1531-48a0-b1ff-bb7c2bdbbe77", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652913912, "uuid": "d3ae4a8f-5e59-4159-a0ca-cf8989fb527b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913912, "uuid": "86e4b9e3-eca6-46c7-920b-bbdc77ee6c72", "value": "8ebb25947e786f53255810554570b438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9924ddd5-d67f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652860406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860406, "uuid": "6b14c656-cd9f-4e17-913f-1573b12cf64e", "comment": "Malware payload (Formbook)", "value": "f32d7708daa66db9ee48d1ecd7b7fd49", "object_relation": "md5", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860406, "uuid": "502429fb-b250-4bd4-b4b7-069c1b0185f8", "comment": "Malware payload (Formbook)", "value": "762443c9560131e5f19c297819952e4b27f530c88db902cf4d4f6886cd129f28", "object_relation": "sha256", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860406, "uuid": "2174c3e2-d066-4722-a8a9-5fcb00ab5c24", "comment": "Malware payload (Formbook)", "value": "bbd8ae2dbb703ee480b67bd6ebce46b6b649b3b3", "object_relation": "sha1", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860406, "uuid": "8ac9ee8c-d359-49a3-a3e9-25a50048a8b8", "comment": "Malware payload (Formbook)", "value": "6ff88ed002045945c48ab7f00a0c6c2112207588f5e0666cdc74dfa173abc344554e930f139bdf844ef6cf5da2b3a5da", "object_relation": "sha3-384", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860406, "uuid": "ddc07d29-dab2-4c6a-b553-4f6175dd961b", "value": "T1C7F1AF8815240434CF19FE37D1428827A76565A2E8ED78CA482D84B3DC239FF1C4ABE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860406, "uuid": "54784c3b-d08e-44a8-8700-ac1756652fd2", "value": "192:KCh29StQCsWqOwAo63bflPaQSigqgcR8UhuND+QvLRCyOb:RM9qqao63bfBgJm8e062g5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652860406, "uuid": "1af72bab-edbc-4a6b-b786-4295707e98ad", "value": 7674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652860406, "uuid": "6c959c60-188a-4c86-af5d-7644716a09ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860406, "uuid": "7bd3d793-bc3b-4321-8bde-952ac0e478e3", "value": "AWB-2091647183.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca14563-d6c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652888490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888490, "uuid": "82bf8f1a-edcf-4ce0-a4ab-9d93c0b6fc47", "comment": "Malware payload (AgentTesla)", "value": "3dc482fc808624a30b33c22f01bf3383", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888490, "uuid": "08cc7718-a447-4359-9ecb-8f69b3881b2e", "comment": "Malware payload (AgentTesla)", "value": "7686ac2172f774100227dc9bd20239a503225adf567c183e1354e5858bbefbce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888490, "uuid": "b0473d40-c958-4b74-bb2e-4a3200661d78", "comment": "Malware payload (AgentTesla)", "value": "c40f3768aa609d709564b2998d7530c06aba35ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888490, "uuid": "7e8d55ee-01c2-4516-b69b-eb2e4cdfe66c", "comment": "Malware payload (AgentTesla)", "value": "93b2e740bfdb41d9e097ffe33ac3e9da6866d0c5e92391199a58cef69e6b8a3787c38723d729df95280b1edae2608aef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888490, "uuid": "db9f3a3f-c250-4727-9d1d-4cb4cce60988", "value": "T1C1B22D6793C49625DF260AF66F2293F50E25DEC18E23965B178C333D4A723C44AA3B30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888490, "uuid": "c0c2b061-4030-438f-b956-ef92889bfcf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888490, "uuid": "927b5e1a-c244-4b43-9882-07c46d7b7a7c", "value": "192:LrnDvScgcdPOh4z5wEe9lI/x4p6D3MWsSYI:XD6TeV5wEeDIOpS3aSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652888490, "uuid": "058221ce-b0c4-41e1-9539-2afc3a39ba3f", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652888490, "uuid": "2fdde829-6cc2-4422-9afa-0f3cc627c4dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888490, "uuid": "17fd1763-2fc7-4b03-9df7-3fc433296bc9", "value": "SecuriteInfo.com.Trojan.Siggen17.52581.6270.19874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb3d76a-d6df-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652901695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652901695, "uuid": "0cefb98f-7dfc-40c5-9746-d6198f2c77ce", "comment": "Malware payload (RedLineStealer)", "value": "28952d497c2c05af31332a83af81fb86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652901695, "uuid": "3a8590d7-753d-4617-9bcc-658b4bcf2037", "comment": "Malware payload (RedLineStealer)", "value": "7712a874f0c18a75f2e4aca44ce777d2d792a85c4e98aef0b85c725a4e71b15f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652901695, "uuid": "4b00efed-d5b7-4dd4-97bd-25345c8d0d37", "comment": "Malware payload (RedLineStealer)", "value": "28fb9bf9ba83a1f7634525077974b9e5b9cad88b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652901695, "uuid": "d6a82fc4-f20b-4ca8-9af0-0014efc9e9f2", "comment": "Malware payload (RedLineStealer)", "value": "7302e77a88f5b650d2bfbe85a797a008279f3c5fe51b322247541b76276c1261d3303256d93c29490c8bc15f16487a6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652901695, "uuid": "7209a8aa-93df-49fe-b4ad-44c88c253b93", "value": "T1F294F101FBD0CC75E0621D3048B1DBB15B7BB86355B0958AE7909B6F0EB37909EB631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652901695, "uuid": "6d2a7c1c-9bc9-4590-9e9a-a6ac6ff4ad07", "value": "772437747c205badf1dd67f2dee75de8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652901695, "uuid": "a082d1ff-d579-4801-8ce4-4b9eee8d423e", "value": "6144:XV20QcNmRnh75/qsEd5ZVDu3mPlJh72zEH+Oiga3wVf:g0QcNGx5SsAPVw0l77+EHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652901695, "uuid": "c677dddb-663e-4b55-839c-5becdb45e8b6", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652901695, "uuid": "1cc4f85b-5978-4e05-9306-d7b07f5bd5fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652901695, "uuid": "f5702c83-ad64-4378-b421-cd87e8192d8d", "value": "28952d497c2c05af31332a83af81fb86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366cc376-d6b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652884721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884721, "uuid": "4f9e747d-5fdc-4212-ad7e-af4fe5448f72", "comment": "Malware payload (Heodo)", "value": "379a60cf710f10c70bfb4feffccfc68d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884721, "uuid": "7d0e707d-a931-4718-9990-e533a84a7a13", "comment": "Malware payload (Heodo)", "value": "774483bcbada5012a172e98f091475555dfa3692e82b54c3fe28897b667de870", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884721, "uuid": "55788700-dfe7-43ea-89e5-c4173274555f", "comment": "Malware payload (Heodo)", "value": "0abf8ed25fa98407b96626c5155623ed806628e9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884721, "uuid": "776cbe79-b086-41b3-b534-e400f456b560", "comment": "Malware payload (Heodo)", "value": "90048c90c1cfc7e3ea2da1bf1dd786af7b8572308882fa3f12fe49a3ebf27f9125df67a8b327f8c0660c90f8666e6c1d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884721, "uuid": "a3792ffc-353f-44ea-8c61-94658aa919c7", "value": "T15D94C04A73A50CB9EC7282798C574A01E672B8150771EA7F03E0875ADF2B3D1A93F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884721, "uuid": "f6895aae-a69e-4419-9edd-ee9bbee204a7", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884721, "uuid": "c1db735d-c6c4-453e-ab36-6ddae91e75b0", "value": "6144:GgIYnzcJxDpmJIyeV2vR3JDEohTEuRfoP1SKL0w+d7sWOQSH0E9cWdb3BHq:yKz+1pcIuvR3lEohEu+9T0Rd4Hr9H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652884721, "uuid": "42696b7d-6411-4b4b-8318-40a2cf5e8c7f", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652884721, "uuid": "d24669a6-2879-4e8e-a353-1a743b519db5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884721, "uuid": "5dcd0c4a-83e1-46ed-8fae-272636d3f19e", "value": "379a60cf710f10c70bfb4feffccfc68d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188fa471-d653-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841292, "uuid": "c5629611-2580-42f3-bfda-45a4ecf5c9e1", "comment": "Malware payload (Heodo)", "value": "4eae451c7164d040bdc2eb7fb1de577e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841292, "uuid": "8c7ff3ad-c6a3-45d7-aec5-fdd441f7c3e0", "comment": "Malware payload (Heodo)", "value": "7829b52d8f5d92bf03239acb99f95209f027703b57b9a5069563767a3dbbd442", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841292, "uuid": "f7f211cd-e744-4c20-8966-08b635ae4caa", "comment": "Malware payload (Heodo)", "value": "30d78b73b9f3dda1e0520a4e26e9ed0dc7bd2c38", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841292, "uuid": "7da3127f-1efa-4a13-a6b3-fb89f260bec7", "comment": "Malware payload (Heodo)", "value": "1378471bff12edc9372df85f37b58f40326b6a401bd6ed21029783faf06a72f514b3e75d74729c247c19e7448be13b7c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841292, "uuid": "e06fbf33-dc51-4505-be2e-6dfdaff702e1", "value": "T14194CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841292, "uuid": "0354f4ee-1bad-4824-abf4-8e04f3b616a9", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841292, "uuid": "39d4ee59-ada2-4ab5-a594-2b6de5e52a23", "value": "12288:M3hV6Pw4aT23s2o/d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2+i3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841292, "uuid": "ba4e320b-1788-4f2f-959b-77f623c187b2", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841292, "uuid": "fa0c891e-a3e5-454e-8e9d-8c272105a6e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841292, "uuid": "6d6dee13-38b9-4dac-ada4-b781ae3d52bc", "value": "4eae451c7164d040bdc2eb7fb1de577e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af93c53-d688-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652864086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864086, "uuid": "7203b3f3-65ad-4c2d-83ee-71b00e1ef4dc", "comment": "Malware payload (Formbook)", "value": "919ed1c45e226b89b37e92ce6e594bd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864086, "uuid": "8cf3fc6d-a6e9-436b-9a53-5b165e22a150", "comment": "Malware payload (Formbook)", "value": "786d7fef1f6b313461e01a67b89db558dfd79a558a2669e73ee0483717600bd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864086, "uuid": "23a6ee4d-77d5-450b-b030-75e4daed06be", "comment": "Malware payload (Formbook)", "value": "cd045d8cce613e9732dbf35a6984a0825b5e64c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864086, "uuid": "69e79e33-742c-441a-aeb1-ea41a35e59d4", "comment": "Malware payload (Formbook)", "value": "431248a56a2694920544eb70bcffa61ad13500a98b3437677220127b30b7e21017ce49fe2392a0da4fb5031e70df41fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864086, "uuid": "ab3ca4b4-1f29-41fc-a546-7c562f721c86", "value": "T1FBE4F0166FA8D951F9A94BBBD05206F917742D07E512F34BCEA0BCD93D323C24E0A61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864086, "uuid": "3440e3eb-54eb-4986-9d3b-a3a072c5bf1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864086, "uuid": "8bd8bce1-b3e7-4bd2-bfd1-e3f788f54933", "value": "12288:0A5nYeRE8XplNkSxDyIGlngn4KCr6L/OG5bFC7dOQZ2+9:NOil5XtHGlzluOG5bU7Q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652864086, "uuid": "2d65b22c-8b62-4871-a126-963aa8099084", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652864086, "uuid": "4c74d8ac-4925-4f3b-bb1a-c51c94c80198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864086, "uuid": "fdf24526-becd-47b7-90c8-1c2d753e61b1", "value": "M456 \u7684\u65b0\u8ba2\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5f82ef-d660-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652847258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847258, "uuid": "b9267417-25f9-4e1f-b04e-412283899be2", "comment": "Malware payload (Mirai)", "value": "d1e792b8c8a9a81f0115b29994deae37", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847258, "uuid": "6449133e-f46e-4042-91af-8f8aa8aa4fff", "comment": "Malware payload (Mirai)", "value": "78aa153d2adede842709f071fa8b70128cbe82eb3f1e9532286d6ddca3f756ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847258, "uuid": "e6e8efc1-ff49-4a8b-843f-533624b0a3c8", "comment": "Malware payload (Mirai)", "value": "cc536d831e04909dad2b0eb7ab4558b044461a68", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847258, "uuid": "3058171e-e797-4056-afc3-9e414cc515ba", "comment": "Malware payload (Mirai)", "value": "5e3ac8312dcced619d5d5bd9f092363d5e80dd61ba313e4d0de574a23e58b288ad861f1a24e07ca0f70c68ac5f713f4b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847258, "uuid": "2bae4b8c-8557-4b2b-9971-bb8113206574", "value": "T1C7E33C46EA418A13C4D61776B6EF42493323D764D3DB33068928BFB43F867AE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847258, "uuid": "f172017b-dd3b-447e-9a53-2f693c21a1b6", "value": "3072:BURsdPk5sw6eBaUaWBDc9fkikHPnRNb+YcGxVsh:WRek5swzBaUaEDc98ii/b+YcGxVsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652847258, "uuid": "443170bf-d94e-425a-97f0-0dd3ba6b5d8e", "value": 153560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652847258, "uuid": "226ecf67-173d-4df9-b0d7-c901d54e231c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847258, "uuid": "6bcd2e7d-2994-4ebe-8000-59820da75a2e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4a070f-d6dd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652900646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900646, "uuid": "2ea1e8bc-9189-4780-929e-55eaddeca03c", "comment": "Malware payload", "value": "71ba924d3073cb4753fd578cac0afac5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900646, "uuid": "a025e84f-4670-47b4-80b7-5fc9b5e2bcc3", "comment": "Malware payload", "value": "798e7d6816c13d5932a073bb17850bba21c76f87c9a6d087f8c4dab5836f76d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900646, "uuid": "eaa1b0ac-e208-42c8-a3d8-a2915908d021", "comment": "Malware payload", "value": "fcbb9b7300bbabd27c2bb58fb50a9f763ff5cde0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900646, "uuid": "02fbfc1e-7ee4-402c-8d3f-c1a87ed635a9", "comment": "Malware payload", "value": "4da824f1104065f0e70b4ce689fbb547c888efa640ed94f04d5ab2f98f86915fdccb7b14c3df2855a04a24bacf2faeda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900646, "uuid": "8d623764-cd1e-4d87-ad72-5b3fb871fa6d", "value": "T1DD05273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900646, "uuid": "076d0ddb-6237-4719-b264-a0de771b3caf", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900646, "uuid": "9ccbb240-38a5-40b4-a9c4-faf9abe47fb8", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7o4aIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7SUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652900646, "uuid": "e70093ff-89f3-449c-aad0-5537ac497443", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652900646, "uuid": "a959dcb4-6ae7-4cac-b425-dbfc16076793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900646, "uuid": "1ade10b7-98c1-413f-86b8-822db77b9502", "value": "71ba924d3073cb4753fd578cac0afac5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad30de75-d68d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652866452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866452, "uuid": "ada54361-765f-4280-9711-5b78179f4f16", "comment": "Malware payload (Loki)", "value": "88782ac0e364987d780341f55f15d7bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866452, "uuid": "66649dcb-3d53-40fc-8470-95b215c1c963", "comment": "Malware payload (Loki)", "value": "798fceb7a7e82c3d02867a7c163e6dd356f8b39c6fd20f7030eac68f4928907f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866452, "uuid": "199399d3-8e76-4a8c-a4f9-8cd5cb51f743", "comment": "Malware payload (Loki)", "value": "78064ef8444f7ddaf01051a73b86ac8c70f3ecdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866452, "uuid": "dd7fbdff-3953-498e-8377-12b71602d13b", "comment": "Malware payload (Loki)", "value": "7ae7a842c842d25b3badb1d4bcb93f42c1ed08c6ef994a99e777ded9f489d594fd93e50a746c11b764e7453bd97d6f3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866452, "uuid": "2ea68b03-945d-4e87-9c43-9847f83d870c", "value": "T14A64BF52854762ABE498453ECB25D9B3FBF5CD180046726B2A79F53F4E201E0CECCA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866452, "uuid": "a4a02d2c-b8ba-4cd3-8dc2-405d96c0e4dd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866452, "uuid": "2e678519-0c23-4b7e-b9b9-58747c8460c9", "value": "6144:qOtIgBml+/+cAoTthDpCHv6S4mHL9Qv1YPbtMokgB+CH9fRQ:qO79ZQi3StMwBZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652866452, "uuid": "fd6d1345-585d-43f7-a054-554440791c8a", "value": 323411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652866452, "uuid": "637def36-367b-45f7-9921-d1521f0b5fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866452, "uuid": "5d430d09-936d-4338-8695-18c28422ba33", "value": "SecuriteInfo.com.Variant.Jaik.72878.25259.1954", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999a37e2-d69c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652872862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872862, "uuid": "e9d33e5f-6624-4c78-aa5a-cd04b8ee9907", "comment": "Malware payload", "value": "4d5abeca5c18dffe09e5dbef1377a52b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872862, "uuid": "41abd29c-3cea-43cd-bb76-290459f9b6ef", "comment": "Malware payload", "value": "79ce6bd0c7b73ae15d2d7bc398660061392529a76132b0de5c5063b0dc74301c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872862, "uuid": "365b637e-8623-45a9-9868-ff2cf5ed8538", "comment": "Malware payload", "value": "59e2192120fd83780e97b93aaa84b984972330da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872862, "uuid": "520f7f05-d828-4519-87e7-c380a4995ed6", "comment": "Malware payload", "value": "abf3b16e1aa020c2294727dbead8911496b558a9f9f7f52b83b08bf19d799d30a81d052e0293e17d2da461b49e11d3f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872862, "uuid": "b274452a-39e0-44dd-ab1c-7232b74d0eb4", "value": "T13C647C1233E1C877D5A601334A92C359B2F6BE51AD3686477BD03B0EEE70252CF25B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872862, "uuid": "7e474de1-4459-4322-8711-0629249d47c9", "value": "4660d4f55970ca074db150bc25297558", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872862, "uuid": "ec546496-000b-4e20-be6c-9ee479981865", "value": "6144:ULwpEFWtfJqN4ACGWkDQoYshnGMApM9LXYREPf:NqN4ACGWCQmGMApM9TYEPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652872862, "uuid": "be301c38-61f4-4c04-bea8-0a309009d217", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652872862, "uuid": "84ed9a34-84d9-4c4f-9b9c-488b0603cb9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872862, "uuid": "cc75b151-6186-481d-a3cf-c806cbcdc2db", "value": "4d5abeca5c18dffe09e5dbef1377a52b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8ccbc9-d65a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652844547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844547, "uuid": "a5deaab6-1665-4334-87f7-f21f6190e1b3", "comment": "Malware payload (Heodo)", "value": "d6f31a395301b324fe8fc9fdfb70aee4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844547, "uuid": "c53694b9-198b-4b56-9370-df4aa7f07536", "comment": "Malware payload (Heodo)", "value": "7aac561899ef96a1fafeaa397cf3c86f17bfa52092e37e95ac7cae2b630d22ee", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844547, "uuid": "5b93dbf0-6703-45c1-8508-0e97a3c08ea6", "comment": "Malware payload (Heodo)", "value": "0f31deb54a07e6ad1dd48338c12176884a198aaa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844547, "uuid": "0ba951f8-5948-4224-981d-574c720b8082", "comment": "Malware payload (Heodo)", "value": "0ab393d6c6035884194d61cab34d07d243f52b37a3cce85ab9ddea3b5396e8c25b3a90c2dd672a8fc029bdacb224fb3f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844547, "uuid": "d44693b1-5703-4f5e-957d-9d70929c3460", "value": "T19BA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844547, "uuid": "5b68b856-3f93-45e9-9f43-5b27906a272b", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844547, "uuid": "bc5dffec-0098-4276-8df1-d05203712235", "value": "12288:uS4BnAed8BK2o0asa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKva34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652844547, "uuid": "3bcb6010-f2a8-492d-bbb8-0157674eaa63", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652844547, "uuid": "c3ac1948-ca20-4f27-9178-a1533d4b0924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844547, "uuid": "8c5f0fdc-b8e4-4d5c-b4a7-39a359d56dce", "value": "d6f31a395301b324fe8fc9fdfb70aee4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad73a01-d65a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652844463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844463, "uuid": "b2c34d83-a36c-48ee-b33f-ad210e86ce36", "comment": "Malware payload (Heodo)", "value": "e7884d45b19f1ecf11b8e1b41cc736f0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844463, "uuid": "abecd44c-fab8-46d1-ae93-2a4fd3081392", "comment": "Malware payload (Heodo)", "value": "7ace86ffb8f0975cc245be33fab5c61deaa7f95422fcad499a8e046908b115ae", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844463, "uuid": "33d34bbf-04bf-4dde-82a1-f0e8fc2db483", "comment": "Malware payload (Heodo)", "value": "59400f387968871822caac61484be83e3463f56a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844463, "uuid": "d3b8e240-3927-4198-a40f-27f0324e370e", "comment": "Malware payload (Heodo)", "value": "dc6cb9255cde716799f296ce6e0d2cd80e90bdd35f0283515839a5b12e8535b11697718c79af5ff86bedc736d255a0ef", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844463, "uuid": "1c1dc4e6-5b53-492d-966d-9c317ad9e5c1", "value": "T17CA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844463, "uuid": "58f8c626-b641-4ac4-808b-a4cdfa4794bf", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844463, "uuid": "d8e36ca9-c3ad-4746-95f5-0272dead27d9", "value": "12288:uS4BnAed8BK2o0awa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKfa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652844463, "uuid": "efe4c461-a4c4-4a59-a87c-6a474e805bd8", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652844463, "uuid": "c80da0a0-2763-4778-af9c-ea80c76a6975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844463, "uuid": "61ef301c-0ff1-4b5b-8c90-6578f8dfadad", "value": "e7884d45b19f1ecf11b8e1b41cc736f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ed295c-d6c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652891490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891490, "uuid": "a88209fd-2a98-4e34-bee8-7f869cbf9473", "comment": "Malware payload (Mirai)", "value": "00e24c67efbefacbf0db7221e320fd11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891490, "uuid": "c8d5a48a-0c8b-4bff-a607-72b7def282ab", "comment": "Malware payload (Mirai)", "value": "7af6fca0cdc2937d9c2b7e3768fd26988af6322e2ad41269198bb22c6f8ffba2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891490, "uuid": "710bd4b0-9711-4812-9547-42a1e29cc754", "comment": "Malware payload (Mirai)", "value": "0ea8d54a0d8b8ce878ab96276c8d4584988c5d31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891490, "uuid": "2019178a-5dca-465f-bd15-3cfb8563ffa0", "comment": "Malware payload (Mirai)", "value": "47c0ecdd31868ac43c618a351b3bd6bc7af539e210255c374b01a6f328c6910aa236a29f79ce05393038c36a7f2a0e99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891490, "uuid": "7399d34e-44a1-4b3e-b198-9a97e9fd5ee4", "value": "T1B2534B0277684F07FAE61AF4243F1BE483BEED8025E4B588690FC7424635E374999E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891490, "uuid": "3f54481e-c66e-444c-bd4d-756419d38165", "value": "768:Sr5Eg6nb5usRVQq8WTUqYhcBJcIGsllk5M9Bv6GG4TlW2c5sjgi+DDiZ/vPBbsVf:2KbpuqJlzk5xGpJgbDOZ/vPuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652891490, "uuid": "59b46555-86f9-47bd-8af0-1a22c307ff28", "value": 66468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652891490, "uuid": "11553572-515d-48fc-82c2-a59f5bdd6a61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891490, "uuid": "912175e2-c445-4646-8725-fe15e33df485", "value": "00e24c67efbefacbf0db7221e320fd11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d783d56-d6cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (FormBook)", "timestamp": 1652893323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893323, "uuid": "1e8cdf7f-5cf6-4c40-b7e6-b655021ca695", "comment": "Malware payload (FormBook)", "value": "ec27e930143d69f20909f44c4f19eab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893323, "uuid": "bb25d9e3-f287-45f5-9469-b8e68a412ab4", "comment": "Malware payload (FormBook)", "value": "7b3ac209ae00cd1fdb297032b35d2d0b1c0e1e66d95b1c90045e44c223232c93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893323, "uuid": "b0713f7b-5f26-45e3-ae50-7e45d3f30cfc", "comment": "Malware payload (FormBook)", "value": "74ad83335575e4737fae14ad0a46a2a22e98ef6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652893323, "uuid": "5e45c6bf-3753-4ef9-af73-5a637c5d071f", "comment": "Malware payload (FormBook)", "value": "ec5a7b3435e4c9fe751ad0663517a4fbc2f88aeee2f1c7eedacb21a509c22680e9be84c78d475bbbdd84f7ea9a29ced5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893323, "uuid": "93695622-ab23-4ecd-94f9-3f4bbab204cd", "value": "T117F49DA03ABB0B57F9388BFC00A6217547F13072D66BC2991F9375EB1461B9A0EC495F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893323, "uuid": "260bee9d-ca92-4746-8960-7bea8e99d8bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893323, "uuid": "777df8ea-c94d-431c-b4cd-a5bb21ebf01d", "value": "12288:g2E7bzigWIqc6kJn/qPlVcNIEhHR1BJwcZvQtiJzva8Mp:g2E7bzvJ62niP4NIEFBac9giJu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652893323, "uuid": "31b348f4-2cd3-47dd-8bc9-610b350dc4d7", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652893323, "uuid": "30cec439-4bfa-4157-a078-e000e8656cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652893323, "uuid": "01b32fb6-5a5b-46a3-9d14-6ea8598081fd", "value": "PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee29e73-d6a3-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652875823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875823, "uuid": "fc0ad687-45e8-416b-9b19-b48b1c3cea5c", "comment": "Malware payload (RedLineStealer)", "value": "4555a90f1eda16055c5c49d4dafaffc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875823, "uuid": "95de2944-94d4-4d0b-8d56-45e00afbe64a", "comment": "Malware payload (RedLineStealer)", "value": "7b5f56377642b1f16dc22bd704d91b9ae9b1ecbbb2519fb0f4a9d87f20efe649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875823, "uuid": "4c4f3a6d-fd67-461c-afb3-74544dd8b329", "comment": "Malware payload (RedLineStealer)", "value": "0048205010766d373e57701e245a7b23cfa0306f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875823, "uuid": "7479c742-dee8-49a2-b255-53fb5258ad56", "comment": "Malware payload (RedLineStealer)", "value": "b3dce8c06ff79ba1b9ced53389b35a62d47d8cfc43badd2f5f9b7a97d8bf06a06c9f1ab6f081bb1058d2898f39a0f38a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875823, "uuid": "8474ce83-1c81-4d35-8fc9-23db60e77d0d", "value": "T1C084F12133B2C075D0AB663038B5C7915AFFB972A531584BEB6C06391E702D1AFF671A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875823, "uuid": "a78785ad-7fe4-491e-bc53-aa53e6d2cb0b", "value": "7f83c3d2c71504a0c9bb3a99cae3fb31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875823, "uuid": "adcfe2f9-0521-419f-8079-8517818892af", "value": "3072:pOLzoXVL5KSa9GrN0tN4/3Ap3t+Ed63f2q2075tpFVl9vr100SsI3rZ+764qHiHM:onoXp9AGrL3at+mXOfHvr1413CZbkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652875823, "uuid": "537b5ea3-fa60-4858-b7b3-80e2efa3f33d", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652875823, "uuid": "937c512e-06ab-4f1e-9b34-508647cb4633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875823, "uuid": "d8e40cff-749c-455c-9e0d-739102af21c9", "value": "7b5f56377642b1f16dc22bd704d91b9ae9b1ecbbb2519fb0f4a9d87f20efe649.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9700b2ea-d6a7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652877582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877582, "uuid": "bcdeffe8-26da-4783-af47-650d6e8c723b", "comment": "Malware payload (Formbook)", "value": "ac8277c3692625aef76c998dad8efe60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877582, "uuid": "04d91800-e7a2-4523-9a0d-3c4aa9fab5a1", "comment": "Malware payload (Formbook)", "value": "7bb515c5560b2fce20a7a48762601b0ececd37fafa0cea4295d4d430d7fb176c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877582, "uuid": "12e45e56-7aac-4467-b5c3-886cc6b3b64a", "comment": "Malware payload (Formbook)", "value": "6f6eb4f3ddd4a8d1dad3866fd589c86e139016f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877582, "uuid": "30bc5419-da81-48a1-a66c-f16bf261738a", "comment": "Malware payload (Formbook)", "value": "24612c220674c5b864c5b7acc04f0425d5083a5bd64aacb8288ba63f52ed9d1b36a4681e49052e4629295a1c593182fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877582, "uuid": "54c3ccaf-d259-474f-9bae-f013ad038e7f", "value": "T1F224F1C1FD18C493F8BB163254361A566BB5EC35EC28920F2790FB982D776E3A51B702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877582, "uuid": "0ed29707-0685-4d92-9d70-ed8eaadf1caf", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877582, "uuid": "84ce1f33-e099-4b81-bec4-2981110c9ecd", "value": "6144:KYa6vVGpY1EDqBvvlVMWQvmjpN0pey/NpRAqX:KY9VGSED6VMTpeqVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652877582, "uuid": "03bcf525-0f23-408b-a283-4f75e4ba8145", "value": 228228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652877582, "uuid": "99359024-d99f-44b5-9eb1-74957c3b6226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877582, "uuid": "5df5ca71-32c0-44f4-8a48-29462d17f933", "value": "RFQ#70005745623000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87235af-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909072, "uuid": "a79c27c3-f311-499d-a994-1a87f3d3b951", "comment": "Malware payload", "value": "dc10b5e96ad9c656bdea2ead3bb85bf8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909072, "uuid": "a47860b7-0d58-4585-a59c-6ecfbe4fce0f", "comment": "Malware payload", "value": "7c7d28e50fb348c2fcf8a3a59d17869f5fcafd47106ceb52e35b9811923fba38", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909072, "uuid": "e434e5e8-a70e-4275-b931-1ae930cf6e5b", "comment": "Malware payload", "value": "f93046399629294a9b1c8691bd2df40c20d23ad7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909072, "uuid": "18272013-4537-45dd-867e-ad0ac8593a82", "comment": "Malware payload", "value": "c368ba9a7b35aa83ed1ff11ecea61d0e4a71447d83f45d94c3f73ed2001a6a9699c676be244158dfdaa6f137984a83d0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909072, "uuid": "c2a98d0c-d923-4c54-a086-c3c46f7ca8c2", "value": "T173A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909072, "uuid": "c9fe2fb9-0d9b-436c-a38b-f44b7a6a2856", "value": "96:nRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:nRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909072, "uuid": "6ef1f3e8-2d2b-459a-8323-00edec1bd794", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909072, "uuid": "56efe17a-dd12-457c-b336-9904c62c88d1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909072, "uuid": "eebcd206-ee41-43c4-9126-25ccd60bf66f", "value": "7c7d28e50fb348c2fcf8a3a59d17869f5fcafd47106ceb52e35b9811923fba38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f855f8a0-d690-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652867867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867867, "uuid": "d59bdf39-86d5-4bc2-8720-56491d8dfddd", "comment": "Malware payload (Mirai)", "value": "5b1846af5c8bcdcd60e1b5fd9a071200", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867867, "uuid": "9cdceb31-3d2a-4b7e-8900-a1aea14123df", "comment": "Malware payload (Mirai)", "value": "7c98807d9a5faa47bbc4532cac711b0d93bb6066e4733ea15dfb1352dfca585a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867867, "uuid": "b04fcc53-89f2-4aa4-b017-fe7511283561", "comment": "Malware payload (Mirai)", "value": "ecf99fa6dd97fd86a1504b2ba1c01ea8b109ad1c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867867, "uuid": "a677aabb-1ae0-4121-9201-d63f7931c6f3", "comment": "Malware payload (Mirai)", "value": "ba548ea95ad2f289b0ab4eb9607738acb4ed03af1e860e48abd537ca02c2172b4ff74be8eb5cef718534db00bdc3d634", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867867, "uuid": "a12ed3a2-491c-4ac7-8f2f-eaecb2a35ae9", "value": "T137F2F161F872E101CE3566F01CF6BF4F0117D82DB055888F18CAE4269EDBFA95068FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867867, "uuid": "0cf8af55-796c-4386-865c-8f1bf0ccc0e7", "value": "768:B0zTwKmbXi49KJHMpYcW3Hpwgqada2qMSFKZrg34g1oAuOXnbcuyD7UHQRj6:Bmw3LLwJHK+KgRk2nSFKZr2uOXnouy8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652867867, "uuid": "63ec81f8-2ce8-4a1f-9859-75f230189155", "value": 36112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652867867, "uuid": "c320cff9-ff42-4a19-922e-22b3f1375a0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867867, "uuid": "c015ff36-afe7-4986-8ba1-d472b9a32b69", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96a4981-d654-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841964, "uuid": "bb85b7a6-9699-4be4-85b3-104c8aa54e6f", "comment": "Malware payload (Heodo)", "value": "675292784ccd620afab9db2beb8c054f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841964, "uuid": "fc179612-75ae-4c8b-8528-cedcabf179c0", "comment": "Malware payload (Heodo)", "value": "7d38635f1ef2b31540d13cba8332f8311455ba413c9a45d15939a75cb503e6ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841964, "uuid": "b7e6bde4-c57b-406b-87f9-e997404380aa", "comment": "Malware payload (Heodo)", "value": "37c13af64fc20ee2247dc4c8f62c4bb7e30336b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841964, "uuid": "f0a55222-e868-461f-94b1-bc89e2369c48", "comment": "Malware payload (Heodo)", "value": "c908af7153d68e8edf2bb1c40260c89e0cca74ea5c5811891c6e1bc02ec109775392ee85afbb53b9042f61b9f5c39667", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841964, "uuid": "efa67ece-3893-4dc2-816f-33c2172a76fc", "value": "T1EFA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841964, "uuid": "7efc0d41-f4e6-4f59-bf20-f046bdd40dca", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841964, "uuid": "151211f6-8776-400e-9f94-857a04e1b5b8", "value": "12288:uS4BnAed8BK2o0aHa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKWa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841964, "uuid": "d832e9ff-93d0-47c7-a9ae-bb0527488288", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841964, "uuid": "70e1a15a-dddd-4076-8eec-9dc1ac02f9f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841964, "uuid": "6895a120-85b9-495f-8b97-a317762c18c5", "value": "675292784ccd620afab9db2beb8c054f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa4e9ca-d652-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841250, "uuid": "30e6636e-8620-421c-a36d-6400ef0f14f4", "comment": "Malware payload (Heodo)", "value": "5be2595d6d4f6c5cfefda1ac5c5eafb5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841250, "uuid": "8eda4341-0687-4cc1-8a7a-c0c107b0e229", "comment": "Malware payload (Heodo)", "value": "7d40417fe69a19e549c452ae81134c3f63dfa10321c030c687fd00a3214d5dfc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841250, "uuid": "13f8d66b-47e6-4d01-9a44-60250ac8af2c", "comment": "Malware payload (Heodo)", "value": "bff6f059c12c83d143fc9180c7f0a2143cfe289a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841250, "uuid": "73be2e23-f890-496b-b4a4-1623d062d56f", "comment": "Malware payload (Heodo)", "value": "b7e6795c5caf39be4d31e3ce98d1104ec81a4f139b6acadd32facd78f56f00e665d57756fec4e95ab19bbe95ef3e5785", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841250, "uuid": "53d4fe60-7bd7-4520-a99e-727392897d3c", "value": "T1E594CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841250, "uuid": "70357842-6ab5-4e79-b0f0-62ad56ae3970", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841250, "uuid": "29f6ec07-b902-434d-bb55-cfe69d010112", "value": "12288:M3hV6Pw4aT23s2obd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2qi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841250, "uuid": "f6ac3317-1aa3-4f4a-a8e8-eced9f9109cc", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841250, "uuid": "66de95c9-4327-4fdd-a5ac-12fe303a718c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841250, "uuid": "edc34bed-b19f-4799-8dd5-199de9722566", "value": "5be2595d6d4f6c5cfefda1ac5c5eafb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6957de-d6b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1652884459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884459, "uuid": "b83a3d36-ea80-4410-b3c8-617167aa5e7d", "comment": "Malware payload (CoinMiner)", "value": "187f371801c56a6a6b1162e46abfcc84", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884459, "uuid": "4d998d25-c55a-43fb-8d4d-868256e9b095", "comment": "Malware payload (CoinMiner)", "value": "7d704f667ba5d07382ba8bcf5304020f2ef09969443e32b5e9816d1a67c59523", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884459, "uuid": "38446e1b-26d9-4ccc-8650-4393f45b96c1", "comment": "Malware payload (CoinMiner)", "value": "cdf7b167de6c8badd65ce65f069957d5421d3afa", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884459, "uuid": "fa214cd7-5d06-4915-a738-24711ce11623", "comment": "Malware payload (CoinMiner)", "value": "9b9e17d0924de7148fcbc9bd826e6743224c64ddabd92202e0ff8a780da4a94675054d0a8f514c28a940561d18a58e53", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884459, "uuid": "77caa905-d7a2-4a48-ab39-e2e035047887", "value": "T133A63342DDAE6CF4D8B312F2615EF3F4A41978F910DB56C08BBF742ADC01E4DA164629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884459, "uuid": "c33d0e53-6193-483f-8ed3-0a6a4b202fa4", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884459, "uuid": "5b7b26ce-1871-4e57-935f-b6ffc2f9f61b", "value": "196608:MiTV4n1TbhD+g3baXxn4sqURs2ekmcRFGtTz1:MYGphvbaXxn4edm++N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652884459, "uuid": "9a5480cc-d03b-45b6-8a36-b382bf4cb908", "value": 10167808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652884459, "uuid": "f56b6e52-f937-4591-a92f-50bffd19a2f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884459, "uuid": "c892c597-adb3-4eab-a132-8d93efd27f4a", "value": "rawetrip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18427d0-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908953, "uuid": "9a87fe70-18e7-4b28-867d-edda31118d55", "comment": "Malware payload", "value": "9e4997a5537ab18c988b6e7d4fc5342d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908953, "uuid": "71bb61c6-138a-4701-a1d1-2ea9d3a5c1ce", "comment": "Malware payload", "value": "7d7551437d62c82c01f10b7e2acf014cdbb35e11736b03245fa9ddd3ba8aa1b2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908953, "uuid": "2a9db57f-b05a-42a4-a2de-33cd52eeb9cb", "comment": "Malware payload", "value": "880f113ff01448953415cc71d35d0ce71b29bfa7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908953, "uuid": "3b0fbe11-6eb8-478f-a9fe-099598e89011", "comment": "Malware payload", "value": "a8d4aa61c26cb8dd0c33e15f89c0f31686942ef82b8e746e3236354543b6b2fb668924bb2f5c12025ef7a5177d5b2743", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908953, "uuid": "59aadbc4-a058-4e87-9f61-f0bb7fc1f776", "value": "T1DEA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908953, "uuid": "bbe1668a-de5f-4439-9a6e-f793ed75b468", "value": "96:dRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:dRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908953, "uuid": "4d1edfe5-f21a-43d3-a73b-8ec1c567cdeb", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908953, "uuid": "8b5333ce-535e-4bbc-b6d1-c78b815679ff", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908953, "uuid": "1e87fcd5-89ae-453d-83ea-a68d5f5266bf", "value": "7d7551437d62c82c01f10b7e2acf014cdbb35e11736b03245fa9ddd3ba8aa1b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a406bc3f-d68a-11ec-8e58-42010a9c0032", "comment": "Malware payload (TeamBot)", "timestamp": 1652865148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652865148, "uuid": "94d410eb-9403-478e-94d6-fab50c834837", "comment": "Malware payload (TeamBot)", "value": "20412e905d572b58bb5e8cc8b30ad9c3", "object_relation": "md5", "Tag": [ { "name": "193-106-191-197", "colour": "#FAF2AB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652865148, "uuid": "79326806-87a5-4303-bdd7-b7f57a321dd0", "comment": "Malware payload (TeamBot)", "value": "7d9e22e88f7b5abf22553dfc438d8f40e17c33e8fc9fb0141f25eaaba8ebca6e", "object_relation": "sha256", "Tag": [ { "name": "193-106-191-197", "colour": "#FAF2AB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652865148, "uuid": "6311f111-93e1-49b2-8d99-e66cf2da5657", "comment": "Malware payload (TeamBot)", "value": "0a52d28426e056c1369a5432f1c7ab5a752d2525", "object_relation": "sha1", "Tag": [ { "name": "193-106-191-197", "colour": "#FAF2AB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652865148, "uuid": "12ad8f93-f205-4768-a573-01f296c4d09e", "comment": "Malware payload (TeamBot)", "value": "4565f0a52b50758733e2b0687aee8ce796b91043c1c370553f238c71ca9f5966fc554d1e7ba03b3e75eff2340e570b50", "object_relation": "sha3-384", "Tag": [ { "name": "193-106-191-197", "colour": "#FAF2AB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652865148, "uuid": "f3fecacd-5229-4e37-b1b6-92a9e0875cc1", "value": "T1A834BF5535C09072D5A709312470E6B54A3EF9300B668EEB73C41AAE8F316E2BB74F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652865148, "uuid": "ab7124b9-038b-467a-9034-300c12c11b2b", "value": "a09fb7ac37c6846f86e7eae4dcb32d14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652865148, "uuid": "5bf6be95-a8a5-4f57-8c19-e3fce80ce223", "value": "6144:+TxLfvl8PmgNJPuirvFoAhMLn0anOiABjUhga/:+ViPbuirvCAEnTnOiWjkV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652865148, "uuid": "f9c792c4-2d92-4044-89eb-f69cc8d225a5", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652865148, "uuid": "6c81cc57-04f8-4b9f-9a5a-eacb52d9b62d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652865148, "uuid": "b8b81517-f797-4a22-b058-70ddd96c9c49", "value": "7D9E22E88F7B5ABF22553DFC438D8F40E17C33E8FC9FB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d18118-d65c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652845228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845228, "uuid": "67b58f8a-0c71-42c6-b520-ef9ef928690d", "comment": "Malware payload (Heodo)", "value": "c6c4b2b510f394f622ccd21ed35dfdbe", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845228, "uuid": "8b30cac5-6d38-4efa-90e3-1f01553fbd8a", "comment": "Malware payload (Heodo)", "value": "7da7831bc5e3394e4c22f8fa58c12296ff6a3ee30d1195faef0f512f99c1b5e3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845228, "uuid": "fa99e489-532e-42d2-aede-fa2c0d4bb142", "comment": "Malware payload (Heodo)", "value": "7f0e56ace01b477586ac55144db11f0e2ca5bbe2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845228, "uuid": "cf5b8ff7-f9b1-4f4b-9fd1-cc7a39d936d8", "comment": "Malware payload (Heodo)", "value": "0d4909964fbf4424931a2053118b2f44c37de254b49b3fedac82c63330ba213fd3d5b0266e65ababb68d83448e10ac6e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845228, "uuid": "dbf65f5f-7df0-47e2-9763-71bd127bc733", "value": "T1BCA48B4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845228, "uuid": "5617e271-973f-4298-aedd-0078b69fd814", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845228, "uuid": "2f2f03de-ade6-46d4-bdcd-4c54823b7828", "value": "12288:uS4BnAed8BK2o0aZa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKAa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652845228, "uuid": "62ea17f3-54a1-4053-82c7-c22f7723afc3", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652845228, "uuid": "6cccb9b3-627c-46e3-a9dd-d011833c0eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845228, "uuid": "1237def2-699b-478c-9f71-df4e7c1c79be", "value": "c6c4b2b510f394f622ccd21ed35dfdbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28a0ef0-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909035, "uuid": "dab5e22f-d2fd-4fe5-b3a7-99f8cf7b40be", "comment": "Malware payload", "value": "f3e5b6063a0b84a862b3a6d364254ee8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909035, "uuid": "816f7d23-98d4-4442-acee-954bb939184d", "comment": "Malware payload", "value": "7dad090a93719864b04e05848a7fa6caf516b5e830f5ca0d12796f63d2be9e48", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909035, "uuid": "f5c8ccc8-b349-4d95-a10d-c826499539b7", "comment": "Malware payload", "value": "6efe2f4954a346d9c675a339647fdba6b512014d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909035, "uuid": "9a9b1f8b-a2ae-4a1d-90e4-f6e9ba5a5aae", "comment": "Malware payload", "value": "febedbc2478076f3951a7762a9a0fa9b4fcf81e5377b049a13b22965071f70ba20b802204c3e352a1e20d7fa239582a6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909035, "uuid": "aeb57472-af7c-47e7-969b-da917ea577df", "value": "T173A1E850112C1AB17246597AD26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909035, "uuid": "cf6c4992-5372-4430-ae94-7fd27ccec941", "value": "96:WRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:WRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909035, "uuid": "6a17db2e-50a0-4370-9e15-f1be3ab6c01d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909035, "uuid": "76a85ed9-100f-4bca-bb8f-9d03dcef38b9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909035, "uuid": "a6c99a49-0508-4b25-a65c-3c8b11124b59", "value": "7dad090a93719864b04e05848a7fa6caf516b5e830f5ca0d12796f63d2be9e48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a96b43-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909074, "uuid": "4965c5ae-1217-4a0f-841e-d22238f3fac9", "comment": "Malware payload", "value": "c040d7fcfd1f9552cdadaa3808bb43b0", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909074, "uuid": "58688c8b-6c4a-4e73-a7df-98a93973df18", "comment": "Malware payload", "value": "7dbd3cb31e8e0fdb1540a3c6586a0ba8b602d99815ba1bbc7ae2091db9e5345c", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909074, "uuid": "e8fb1d6f-2c85-46b4-8db2-612fd50143dd", "comment": "Malware payload", "value": "3d1095454976cf92d14011064f06e40c19910428", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909074, "uuid": "cf709c51-cafe-4e3f-9278-3005f7b380ba", "comment": "Malware payload", "value": "5b3d51f831016ebea413f4e5eae48c17e62c7b6a5ec451c107045be3b17f24c6d98a72ea723af2c9acfe7209e979d743", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909074, "uuid": "8df0a108-afb9-4cc9-8ac7-91b95706d0ef", "value": "T1B146336CA1F87DEE424898B593DFDF1070AA0BCEB0A1D752D55BD54B0C16322B8FD928", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909074, "uuid": "b17f14c3-df85-4fa7-988d-9de51da7e860", "value": "98304:tos909Qg6ecEZHyEexmLaI9MY7bxTE8SSvEgP3N2v+KmFLBLRV2B0:td69Qg/JFeQ5x7bhE8SSdP8v+nV2B0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909074, "uuid": "33def763-050c-471d-8bec-da020962692a", "value": 5697536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909074, "uuid": "4f6da02a-dce6-41ec-b8b5-dd594f72fc5b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909074, "uuid": "d6610365-0c37-45d7-94a2-35db4e411757", "value": "7dbd3cb31e8e0fdb1540a3c6586a0ba8b602d99815ba1bbc7ae2091db9e5345c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5f221b-d6c2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652889004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889004, "uuid": "62c9691e-1f64-4a37-b7dc-063ad37e3294", "comment": "Malware payload (Mirai)", "value": "9e2539c503e507f947021587a65891a2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889004, "uuid": "3fc73d33-a288-4939-8419-ea48e92361a4", "comment": "Malware payload (Mirai)", "value": "7e1c2713579e43651deb9ef28cb025e6081f5799e1d11abbc458d14ce3dd114c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889004, "uuid": "99cbba5c-6edd-49d2-a8a5-662a34e87ce1", "comment": "Malware payload (Mirai)", "value": "368ef72a2fa50101abd18185f8487434478b5857", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889004, "uuid": "057ba699-4154-4828-87b3-68971c4bde3b", "comment": "Malware payload (Mirai)", "value": "8d559e560afc9bc8c3492ddf561ecb727eef10c7ca8e93f1d09fe8ea9a3c467f972f75b1c0ae327079952e6f3cd86fbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889004, "uuid": "59eaa0ee-03be-4462-ab87-260444b849a6", "value": "T1AB5329C8A5D3F8F5DC140978307ABB66AEB3F13B7135E99BC3D82927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889004, "uuid": "fe2b4054-53d8-4ce7-9f44-93c9ddda4a8d", "value": "1536:IoRC9170vwHbQXZ5+qXDEuXi90dSW7V/DjObeFt6PuQ4ZA:PC917iwHbQXZ5+qXA594SWZ/XObeb6G7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652889004, "uuid": "3cee5dc4-99e8-47d0-a471-efe0a4edaf30", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652889004, "uuid": "455dd9c0-b4fc-4937-958c-b2a363d61471", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889004, "uuid": "26cae243-4ae8-42aa-b8b5-16c207fd20ba", "value": "loligang.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b79b839-d65c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652845135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845135, "uuid": "013ca46c-3c3b-40af-ba63-f90d119ee887", "comment": "Malware payload (Heodo)", "value": "d2bbaf3ad5ddd81bd767c0e0cd3ad294", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845135, "uuid": "e5f057ef-3f6d-47e7-880e-c1dd72a22ca2", "comment": "Malware payload (Heodo)", "value": "7e265f236a5a1b613f03df5b48dc26875386e4d4c2ae65ac460da300424566c0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845135, "uuid": "60eb623b-a13c-4039-9037-b61cfe4a907b", "comment": "Malware payload (Heodo)", "value": "c170e6d6af4a218a0fc53435b34ebe30754d3bdc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845135, "uuid": "3469e5b4-33c5-4c20-8893-dcc0cd09a6fa", "comment": "Malware payload (Heodo)", "value": "0a225f0b694b39e1afc43a3d3f14933c981c390b6082b7b4f8be12a88d55471a83d4892e61a95059bc7c16d96645be6e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845135, "uuid": "14a1af25-7225-4f70-bf5d-cb0e17cb9827", "value": "T1CDA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845135, "uuid": "f619c3b8-b484-4c40-a5cc-aa7b6a5a45a4", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845135, "uuid": "c601f7dd-2d8c-4191-af6c-bd4a671ed690", "value": "12288:uS4BnAed8BK2o0aqa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANK9a34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652845135, "uuid": "928c57c8-53c0-420b-b745-9c798f0bb713", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652845135, "uuid": "33aa02fc-de5b-4717-8a32-87c3dc086ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845135, "uuid": "5e341d2b-3798-44b0-9dd6-ec8d621c0948", "value": "d2bbaf3ad5ddd81bd767c0e0cd3ad294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6bff2f7-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909042, "uuid": "7881d501-9dfd-4c7e-8590-c2e2569b7e7b", "comment": "Malware payload", "value": "4d4f3bf35391de38a52e49494f701e16", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909042, "uuid": "efd27eae-725d-4b00-827a-a7ee15809c11", "comment": "Malware payload", "value": "7e7395ae0a24e61fdd4e28ee943f279ba6e29d834c14c09058028d0c569a2ed1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909042, "uuid": "f76a486f-8b06-4018-8f87-19c48635bc82", "comment": "Malware payload", "value": "a3d5cd4c1b3cf8e338dc922e22718070f0aa961b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909042, "uuid": "9047b7a1-bbd8-4125-ae09-a1359ee737c6", "comment": "Malware payload", "value": "4bbb5631193f2eb35201baa0288db7d961940f15cd5e0cec424e93de853a3fb89fb21b31887d02ca2cbcb8978bea90c6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909042, "uuid": "923e7750-e31e-4206-92cf-8e6ebf972a0e", "value": "T1A5A1F750112C1AB07246697AD26FFB52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909042, "uuid": "880645e1-5f59-4e50-af0c-ff6636a08b77", "value": "96:TRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:TRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909042, "uuid": "aa8115dd-7c34-45a0-9b0a-490ceff1c630", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909042, "uuid": "0d5f02d5-d0be-4877-952a-faea9c3f535a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909042, "uuid": "42e9974f-ce4e-49e8-a8b8-9bab75f06fa6", "value": "7e7395ae0a24e61fdd4e28ee943f279ba6e29d834c14c09058028d0c569a2ed1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f5b15b-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909066, "uuid": "7363d37c-8f10-4ae8-a427-21723099242b", "comment": "Malware payload", "value": "b6c9de6f57033f8ee4d430984bc2e89d", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909066, "uuid": "4b850429-a506-4a75-8c7f-b90a42c52c9f", "comment": "Malware payload", "value": "7e7bed35a0a31e524cbf1b6b0b07e45f0a6c87810866cd37b91a68923cbbf1dc", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909066, "uuid": "a39ae0af-4598-4b24-b2ff-c0abd8edc8cd", "comment": "Malware payload", "value": "5f2674566d6e9157e00dbc20f18103297f8dd988", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909066, "uuid": "039799b9-0454-48ea-8037-91734b9c4bfe", "comment": "Malware payload", "value": "309062129073ae805be3cc98172db3b2078c22480c16382e838d43f153c625a3cad9694f25909ab31af99a1682a8f344", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909066, "uuid": "cdacf18c-bcb8-441a-931a-0cd38657f04b", "value": "T1B7D533BD71DE28BD82E8A772B6EFDD283416A58D602183906DB391CE1C17131D9E9E1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909066, "uuid": "3713b3c3-7252-4bf7-8efc-9e22bcdbbfb3", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexlwLE5Ig+M4hS:tos909Qg6ecEZHyEexmLaI9MYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909066, "uuid": "68b60785-0005-4760-be95-e346dd833458", "value": 2764800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909066, "uuid": "0084e011-acaf-41d9-ad1f-1c50b84ff9af", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909066, "uuid": "8c0e056e-81cd-4e99-8aa7-46dc77c6d4b5", "value": "7e7bed35a0a31e524cbf1b6b0b07e45f0a6c87810866cd37b91a68923cbbf1dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664b1c89-d705-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652917873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917873, "uuid": "2d48cced-c8f1-4f02-b641-1d09f1078359", "comment": "Malware payload", "value": "96d9f0e2ec0e10fcf862856a88968700", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917873, "uuid": "c437fc8e-6c37-4fac-bf62-d0fb53ae3537", "comment": "Malware payload", "value": "7e9bba03e9894f4338479e2471f97af42591c0c2046b345d9d6cf37f886d9276", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917873, "uuid": "88f2fce5-91ac-4b86-a71c-d7aadf67581d", "comment": "Malware payload", "value": "ca0ca48a39786fdb706fd78dbc7aa7c45f8a63ef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917873, "uuid": "9c6c2508-045e-4417-a238-0bf4bf9c54f2", "comment": "Malware payload", "value": "ec79e62c7339f98511f3fbfd278e8353cdc451d43ac578f4eea22798dce262a3ef0e8d53a3c4bc40ca95ef344f842382", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917873, "uuid": "9e5724d5-e545-42c6-a7cd-9c0fa8955f8a", "value": "T137853339AD430B9ADBBD80B60AAE6DBD5076FDDF5354483F33863649723A7324283518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917873, "uuid": "d95fa2cb-a226-4294-ad92-5482816042a2", "value": "49152:4SDRFTl8fLWSAtQfORT7p8LmGFapZhFvEpSwc:4qFl8DpfCT7pG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652917873, "uuid": "757a1838-3b7d-497d-b265-d0b57c598467", "value": 1744384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652917873, "uuid": "26c5b42f-aeb1-452b-9b0f-a59b87ac9e6a", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917873, "uuid": "ceb62302-793b-40fb-a031-4b521afa4bac", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.1191.12690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef16e4d3-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652909083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909083, "uuid": "3ad0c01c-a093-4190-b711-fff1b53d9a8e", "comment": "Malware payload (Mirai)", "value": "6088d02781126d37e4e469d4729d5770", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909083, "uuid": "4bd43960-e912-4a68-9e9f-ce320a517273", "comment": "Malware payload (Mirai)", "value": "7eec97b7c1b57cf3d65a7de572d110af52fe481317242cab3c156767803d1fc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909083, "uuid": "33fd6b6b-3bf8-4498-99fa-a924dde86ea4", "comment": "Malware payload (Mirai)", "value": "2355bef8eae84bc91c42c8f6ff4622d7274d3e83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909083, "uuid": "ccb462f6-eba6-434b-805a-9ef2eb41e816", "comment": "Malware payload (Mirai)", "value": "da51054aa5cf0512a17aa8723feffed16672a0bba4e5356c872c80f6d0089dc0fd2ac6b3fe82779e808879b1d303dbe7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909083, "uuid": "26c093bf-1297-4770-8a09-f340ff867182", "value": "T1E0F202919E058E9BD8FACD3A43440F4074121742F9977C915AD6BA8FEF4A6ACB4833E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909083, "uuid": "d3091717-fca9-446e-8d2e-ab9f4f404e42", "value": "768:xJ17P52eqxyDOoypR5aSTphfdGLkbywStHX9JKILkmM17hp6HuJgGlzDpbuR1JJ:xZ2eFOff5vFddqkbitHX9sILkHdhpoa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909083, "uuid": "ec09f009-bef3-4357-a64d-fe2cc2aec8d8", "value": 35164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909083, "uuid": "36ce0b23-ceee-4a13-b585-bc91d24920ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909083, "uuid": "6fd2fe9e-8682-4702-a4c7-166bc6275cef", "value": "7eec97b7c1b57cf3d65a7de572d110af52fe481317242cab3c156767803d1fc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9a6d75-d64b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652837888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837888, "uuid": "f3fe7334-67d7-4706-9ea5-7448da9bf0a1", "comment": "Malware payload (Heodo)", "value": "eaadc6aa2fbdfc2222468fc0001b4eaa", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837888, "uuid": "3da18b97-8407-4338-adce-08a702dc1629", "comment": "Malware payload (Heodo)", "value": "7f8119176dcf4378c0616b18b723ca75345cbd2ac32a6f62136a8033881dce19", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837888, "uuid": "5957167b-2d84-4269-b7fd-e0aaee05272b", "comment": "Malware payload (Heodo)", "value": "c660cba7df5de9b535d511995f7af7c3016181d5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837888, "uuid": "a210cb50-53f3-4fdb-91f1-c98998bd92f9", "comment": "Malware payload (Heodo)", "value": "102a16df41ebdc9863611a87085371dec7294520d7fc8bd37d7955b25168584a6d1de20d70aa224100e00cf7199ebb6b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837888, "uuid": "61b72841-9a50-4a0d-ae0c-5bc9541be1c5", "value": "T11794CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837888, "uuid": "e507f4a5-4d64-4f4b-aebd-883ab7221016", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837888, "uuid": "47baa01a-6503-4271-8a06-c4cb2c8acba4", "value": "12288:M3hV6Pw4aT23s2oed9zi3BBoNIQ/hsA7:Yb6Pw4R3s2pi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837888, "uuid": "f0c7834c-9f65-4c02-8629-717d9ff6db5d", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837888, "uuid": "3fbfec99-50fe-4515-8716-cfa265199365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837888, "uuid": "3cb3cb0c-41ff-43c8-9a6c-36f03f83b3a7", "value": "eaadc6aa2fbdfc2222468fc0001b4eaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c27f34-d646-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652835867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835867, "uuid": "47a22499-bad8-450d-a837-5d8331f9f7f2", "comment": "Malware payload (Heodo)", "value": "3881dcd7c60e521ed994f0c39b79e953", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835867, "uuid": "8d324262-345a-43a5-b09c-ed93da2501c9", "comment": "Malware payload (Heodo)", "value": "80cdc11b144747a058b75855103e9350fb55e85a09146102f73b9def27e76763", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835867, "uuid": "0700df49-face-4fac-97b2-78505333a097", "comment": "Malware payload (Heodo)", "value": "137ea9bf035dedaa429bfe75498e1108f960f2c8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835867, "uuid": "64516bf8-86d3-410e-ab8f-a989615f99c9", "comment": "Malware payload (Heodo)", "value": "7ce6ed5b11df3d0986e30df6289d2ba19152245b14a02474d160b8fea9054f7d84c6f385611aef2b14d8e75e8e096336", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835867, "uuid": "ef0224b4-c0eb-4b95-9009-76483bbd2b37", "value": "T19E94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835867, "uuid": "5768480b-5562-46ef-b51b-690a100f7aab", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835867, "uuid": "f6aca340-e69d-4450-83da-c0a83f6399ab", "value": "12288:M3hV6Pw4aT23s2ovd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ei3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652835867, "uuid": "a767f199-3206-4911-8306-fa0e3e057773", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652835867, "uuid": "5dbbf4c4-8e2b-4bcc-9a8d-1cc14250b8d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835867, "uuid": "6cd901b8-668e-43cc-b1d1-c1058d8b2232", "value": "3881dcd7c60e521ed994f0c39b79e953", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d91c237-d6d2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652896034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896034, "uuid": "bf4cb065-d51c-42a0-b502-0cca03207b6a", "comment": "Malware payload", "value": "c791f4d69f14fd5e75c83610fb9ae025", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896034, "uuid": "29dfd8af-79b8-4f1a-b195-e7a8032a77d1", "comment": "Malware payload", "value": "80d6d5e05616fd64ef95fe7f76ceca050335280f160275522839961f30fa96e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896034, "uuid": "bc8bfd36-e7f3-4a2c-b2f7-b0dfdee3a2b0", "comment": "Malware payload", "value": "0e24d2e718c620f73eaf16deea3363ece658cace", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896034, "uuid": "daddfbeb-fc0c-4096-b289-a05117d3cc28", "comment": "Malware payload", "value": "680789ee58ab9cd02b32f00985755f90694b20a652b9a19dc0af226fb9f813abe6450aaecbab535a54c90511565349ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896034, "uuid": "d23d8715-e4ca-45f4-bcc8-b42af7ace067", "value": "T10A65BF12B2D04837C57317349D0B67A4693B7E112B64D4BB2BFA2D8C6FBA6913C35287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896034, "uuid": "93e8300f-c2b9-4cdc-838e-074d97f83fba", "value": "36c0ffdab89e265b5a748a59648230b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896034, "uuid": "d60759b5-4868-47b1-8455-444605e60d74", "value": "24576:IS9G0VKjq4R7Bi2JvS761Y9uIyd73h5j7nOVy00xBORvOZO:Ie1WxOPyRhdOVX0Sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896034, "uuid": "620b9ac9-a9d8-4e88-ba41-7f5ee1a5d0b4", "value": 1461248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896034, "uuid": "f11fe29a-1665-4c65-b46a-ae309410fd0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896034, "uuid": "be1bed31-4a87-4b8f-99f1-f935a0028fee", "value": "SecuriteInfo.com.Scr.MalPbsgen1.6020.9272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43106e0-d6c8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652891885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891885, "uuid": "24c34484-8bdc-4526-a096-2af34c86e3a0", "comment": "Malware payload", "value": "24dca53ff5d9ed229297ede938d38a44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891885, "uuid": "61788772-c11f-45a9-bc44-4cb172b680cc", "comment": "Malware payload", "value": "810102412c21a705c2f5d69d459a4198ac8b44e97bc1a7995d7edfaacf083eaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891885, "uuid": "8395a21e-9511-482c-a22b-1099cf384057", "comment": "Malware payload", "value": "3eec148cbb122f2c9e22087a40a39d26b10036d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891885, "uuid": "0905ba39-e7ae-43ec-9ec2-3323c9a943bc", "comment": "Malware payload", "value": "79656f7f09148090b405035a9ee8804f56c3ce698fb6896f8f94d7a8147e51fa0cc826cee32c6c0639507d61e619a6a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891885, "uuid": "3ce899d7-3484-405f-a76d-80f7a17af06a", "value": "T1009633E51ED008B6EA0A767B8AF74114F9DF3D774066214CFC9CA1A957E3B60329C2E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891885, "uuid": "556282c1-6514-4466-91c3-14f5a9ea1c28", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891885, "uuid": "f17e2959-0396-4576-9d19-3d0015a32d69", "value": "196608:INBhR7cXUekiG+UW1vwEqrtLvnzSkoWVRoJiIdkNUjaHLIqdJv:IbhJcXTTUCoH7zqdkGC5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652891885, "uuid": "38fdacd2-cdb6-4390-b2bf-7640d193ca06", "value": 8816560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652891885, "uuid": "e8cccfa9-7f03-4f8e-acc2-81c4f77bb81e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891885, "uuid": "b2a71eeb-b5a2-42f6-ab2d-55f80dff21d4", "value": "screenshot-captor-4-21-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017e2fe3-d68e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652866594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866594, "uuid": "2f199a48-03d5-4d6c-86d2-83f2a2c5edf8", "comment": "Malware payload (Loki)", "value": "4eed468b0e55bf002a7c9794cbef7f11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866594, "uuid": "61ae2a32-5ffe-47c2-aec0-4f94b74e03c0", "comment": "Malware payload (Loki)", "value": "8275697787639625be4a663711127bfe1c84c0b08b67d8d6c59fdd1890130b23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866594, "uuid": "376f0131-8faf-4bbe-ab86-dcf19d112f2d", "comment": "Malware payload (Loki)", "value": "12e328496090290adfa3447c3c86ea28a2269ec9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866594, "uuid": "0738af59-0efc-4241-a0ab-c403815c78fb", "comment": "Malware payload (Loki)", "value": "824ef5251e4dc6be2b0b2907b9ccf99561b9f921924c2c2527b140c1eb71157f93e794f0de5336f7b7abe6ddcf430d3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866594, "uuid": "480be91f-5fd8-41ef-aac4-851d5423e8d4", "value": "T129F4BE5D3290F99FC4578D36C9641C70A660AC67970BE307A0573AADAD3E79ACF102B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866594, "uuid": "95c42331-cee2-4ab6-bc36-e96a974af357", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866594, "uuid": "c9af1f82-4bdb-4682-a63b-fab6eef384d1", "value": "12288:G+Z23BNVR50Joa7J1wncVyzfq7D1vdAKIz1zQbzFOiXNPXzsOxgXa1P0yUJfTsG4:jC5c1Mfq7xVU5QbwiJzs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652866594, "uuid": "886ae0c6-24ee-410c-86aa-d9cf88f0cfb5", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652866594, "uuid": "cc1e149c-aab1-4e9a-a39e-26c4888a3fc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866594, "uuid": "e9777fce-9b21-4406-ad6e-3c4b8030cb74", "value": "Waybill Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc47e0e8-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908998, "uuid": "7383d767-c3ea-428a-a059-c013e67fecfe", "comment": "Malware payload", "value": "b1e954cffbf341f3b483de0b0e7ae594", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908998, "uuid": "7e6ae53f-44f0-4735-a34d-8143ecc78137", "comment": "Malware payload", "value": "82ef14bcac9e0cb91a7e13eaaef78607f9b1d15e487da1b919d67142d3b89938", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908998, "uuid": "6433c424-f06c-41b4-a4fd-aa87de49f0ab", "comment": "Malware payload", "value": "f4f7840ce7ff3186d715fb50ba9b76c57249047c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908998, "uuid": "327384fa-c8c4-4d69-8529-f8d3fa1afb36", "comment": "Malware payload", "value": "686bcbb66c135fe42fa1e53fd2a2ab3cf175298214e0352f631daa8ff90152610732c6e379f470a73b9dabe56a38314c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908998, "uuid": "b113ca51-a050-4d5e-8b1e-75a4426d0cc4", "value": "T1272168656C7C213534EBCE12BA6BC019D514E8D288EB4360B794AB388124C28D38D0C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908998, "uuid": "071e908c-9da5-4c53-bb8f-279950969a42", "value": "12:aglDiX9MrALcTe0hb/6Ty18DypX9MrALcTe0hbv6Ty1o:RstMrAICQLEILptMrAICQDEIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908998, "uuid": "3e922f54-3636-4bee-8006-94370598db17", "value": 1377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908998, "uuid": "23d53463-a0a0-4df9-9d95-afbe6035a321", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908998, "uuid": "225e5032-7529-46ad-b4ef-c0423966292b", "value": "82ef14bcac9e0cb91a7e13eaaef78607f9b1d15e487da1b919d67142d3b89938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e375fdfb-d6b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652882005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882005, "uuid": "9c44bad8-cb8f-4435-8bdd-d463dd30dcbb", "comment": "Malware payload (AgentTesla)", "value": "4356ec13f3ecf498927e9201c486efe8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882005, "uuid": "abc0b094-261d-456d-92f0-a5fe63c51e62", "comment": "Malware payload (AgentTesla)", "value": "839fe50643326105b4a44193db365e347eebdb98fd9cbdb22b26fb64589605a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882005, "uuid": "e029bcfa-cc19-42a8-8498-8e87a635df89", "comment": "Malware payload (AgentTesla)", "value": "629d568f17687fba89d7d9af41e2f1669bdbc828", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882005, "uuid": "1a4e717d-a849-405f-9633-a822a86db756", "comment": "Malware payload (AgentTesla)", "value": "1454fd5da59101d9b4662e02250e6f2ec7297906bbaf2a5014b4c9af05ef00bd1f77c2fa9854ac0df0a086a8928ad32c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652882005, "uuid": "484a77d6-08a9-4408-a400-1523beb11a9a", "value": "T17DE4F12963A8DE50E9BE47BAC0A201F817B46D47D512F75BCED07CCA3D363C1461AA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652882005, "uuid": "6570ddde-f1a2-40f2-b2fc-f94007434358", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652882005, "uuid": "903af6af-39fa-4a66-b891-d000339dad66", "value": "12288:RtTTBd5X1ZRRyNeT7Gx6QOHeqsi9jO0LgvxUDosGQr:7/BfFZ+eTE6b+aPsfQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652882005, "uuid": "e494f91b-3cb1-497a-b1f2-8f1b22afbcd5", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652882005, "uuid": "0c0ec11e-bd93-488c-9307-e50b823de557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652882005, "uuid": "83a7b627-169e-45bf-993b-2f81fbdce9fe", "value": "Bdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a201a680-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908954, "uuid": "7601712f-c63a-4fd2-85b1-ade2b1585cb6", "comment": "Malware payload", "value": "4328fc55a98afb8f03965596bdcffe72", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908954, "uuid": "6af3d5cf-1aae-47ec-8dd9-6c097b1692dc", "comment": "Malware payload", "value": "83a8a0f5ea27b184af710a083c76300e29f6a65ac65aaf2aa24e7b9dfce3c160", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908954, "uuid": "cb3b3272-3cf9-4785-a239-6dd66b15457e", "comment": "Malware payload", "value": "c5a76654b1cac79fe614800fa057a89e36085c1d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908954, "uuid": "fc09cae3-cc83-455f-ae38-275b894b52b5", "comment": "Malware payload", "value": "7d76a77c160f41785c00e12e53b2c98373bd9a92bae377dafe15808b9f6c349a6e86e270ad4e9b55ebf65266d5c5df9d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908954, "uuid": "b875f964-a2b8-4883-9f4d-f531f2e1c595", "value": "T184A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908954, "uuid": "25082997-0f72-4b3b-9764-b538eeebc35c", "value": "96:1RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:1RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908954, "uuid": "c13e412a-fb67-4b86-882f-6c5f6c675a45", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908954, "uuid": "12505a51-5e33-456e-ad38-386b7cf68418", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908954, "uuid": "2698d3b0-5805-4378-893a-57fa00728c3e", "value": "83a8a0f5ea27b184af710a083c76300e29f6a65ac65aaf2aa24e7b9dfce3c160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3718a4-d6ab-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652879203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652879203, "uuid": "da702ddf-867d-4f33-b9d0-acee1146a187", "comment": "Malware payload", "value": "d483c9e951903fc26e5146bde17dfb73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652879203, "uuid": "cec7f096-afa9-467a-ab8d-ba0bc6e8c374", "comment": "Malware payload", "value": "84483ed46317d2ba114e3b5f49c4a54a8801bf648b73578135372dedd3f8a9ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652879203, "uuid": "98f0db9c-70b6-4dab-bb14-87624722ccab", "comment": "Malware payload", "value": "4ad10060ddb7c26432bef8fa23eec3fed92d7478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652879203, "uuid": "1a6d1d87-c266-4d2a-ab0d-dc1d411dc3f0", "comment": "Malware payload", "value": "c6deb1a7606967f895a268d9579cc897307831acc9045b755c14e8f67dec36217625259bc1ad8d4bee3aad3986c35ab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652879203, "uuid": "fa4cb9d3-1cca-4c79-911e-d13d214fbfeb", "value": "T13266A2728874FF02F6660C5853A11EEA015C5D6F4FD85309A8AEDFCB7193DAA306F846", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652879203, "uuid": "b1fe6c2a-9b99-44cf-b56c-3e3d3840fe9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652879203, "uuid": "a64c4143-07cd-4ae6-97b4-d3e0bb2591dc", "value": "196608:AD6ogcJXjJSS1Mmigg4LckIjeul6BqfOQ+1Ng:A7UaMmJcmuu1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652879203, "uuid": "91c91035-b1e6-44a3-aaad-10c72e8bc87a", "value": 6590976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652879203, "uuid": "e8940778-8dee-44ae-b75a-41342d27c242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652879203, "uuid": "b7780800-f199-4bcd-b97a-6e62277b51e8", "value": "B9757A1C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175f0cee-d6b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652882092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882092, "uuid": "7e11fdcc-908a-4f22-9e3f-6c2d855373fa", "comment": "Malware payload (Loki)", "value": "ccfb1788d4a0c8d790b8453c95b936a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882092, "uuid": "41a77ae1-21d9-4884-8de5-532cd7bf1c6b", "comment": "Malware payload (Loki)", "value": "859c4d32d610fa0a47a5afd95c6dc1e1eb550ea8b93d6e2dc56f2db52354e345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882092, "uuid": "c8a4edb6-0354-4b61-9fbe-a313ea0d59e2", "comment": "Malware payload (Loki)", "value": "38cba2ec996aec8cc6a8a407b4df2ed339d367c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882092, "uuid": "00767ebe-de50-48eb-9873-e6d7d5c89d34", "comment": "Malware payload (Loki)", "value": "34cc4e7196d9855ff4f419c97a8beb4c76f8ddd3b96fc5f346c9ebc056aa02ef80c1086f18b3201484ee2e8c48a1bda3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652882092, "uuid": "bd17d44a-3a41-4154-8088-b77073d60c4b", "value": "T130D4E16A7A6ADE13C7A542B1C0D3842803F2A4C76776E75A3ECD13C60E427B15DC978E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652882092, "uuid": "6a201aa3-a6ff-47a4-9390-8466c66b792d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652882092, "uuid": "e1c00aa4-44f8-483b-8105-3cbb04565437", "value": "12288:JiKRnZ/+P8Lxz4tAZz1L9tnhb5cR3XhvMX3RN6hrxdJipwj3ZZW2CnV:JBtZ/88LiU/hORHJIKBxd4pIpKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652882092, "uuid": "cfefff69-645c-449e-8a97-9c3788a9d89f", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652882092, "uuid": "6c86dd84-b594-418f-911b-070c151897b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652882092, "uuid": "282d302e-0cd0-4ed8-a78a-df06e979c381", "value": "kellyzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb247d92-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652858771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858771, "uuid": "21c08d1f-7f8a-475c-b426-7f02d4e923f6", "comment": "Malware payload (Heodo)", "value": "0bf44f20719cbbb569c8bb30a7f4c655", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858771, "uuid": "21a1a67f-e33b-4d1b-a442-9b29e6da7f1a", "comment": "Malware payload (Heodo)", "value": "85e7f1016f3f8cf42a62fa8e37a2d1c19eb24ac5ede1efa6a55c67c2a39c4cce", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858771, "uuid": "1127b231-fce5-42c4-94df-04b2af6ed998", "comment": "Malware payload (Heodo)", "value": "1668d16d59371096d8abeef5022f7081b946e9ed", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858771, "uuid": "79529f48-0dda-4c59-b677-d5550643598b", "comment": "Malware payload (Heodo)", "value": "612011cb404c0facff035ae0cce9d058f9d865586a78a52644446424c0a8a91f1acd72179e4d92227ce7ee9737e82749", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858771, "uuid": "d3236aa2-c057-438a-bd81-a531a0d73ad0", "value": "T1E794CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858771, "uuid": "385907cc-2de1-4e4e-ac80-7cfa6c781f7a", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858771, "uuid": "74c1f91d-b687-443d-8104-8fd6da222526", "value": "12288:M3hV6Pw4aT23s2oMd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ri3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858771, "uuid": "36e21527-cf18-4375-8f56-5b2276b6c796", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858771, "uuid": "51849872-f93a-4b79-a65e-767070b48e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858771, "uuid": "768fa1fe-2638-4851-8b8d-045025895539", "value": "0bf44f20719cbbb569c8bb30a7f4c655", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4afe3d-d6d2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652896029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896029, "uuid": "d14ac90f-604f-41ea-9bad-56c7f87efede", "comment": "Malware payload", "value": "1eba1198debb43b0c0e154d854ed9a35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896029, "uuid": "15c7ba53-a8d6-4cf2-a48c-b46f9bbbfe5b", "comment": "Malware payload", "value": "8645e8246b3572cfb504cd7f95c9221547f0a7da9a3b53f2192c41b8c6f08365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896029, "uuid": "e69b4c1b-8645-4a64-a548-5ade98266377", "comment": "Malware payload", "value": "3e2c5740b0b89f25d5d9479064fd80bf4df7ca99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896029, "uuid": "81c134b7-5f5c-49e8-b2cb-2e8b9e4e5109", "comment": "Malware payload", "value": "c00ea689d20f697b9ef1dcec754e2575c8ac19fa54f180062dfecefe18c84c11fcbfcf1d984a54780a07c749007cb9cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896029, "uuid": "af4fe7e8-e13a-4ae5-b1b8-824be1f885f2", "value": "T1FBB25F35A387C128DDADCD77D86211BD46EDBE038862D67B14C4FF8E3972D06C6A1660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896029, "uuid": "e752a28d-5250-44c8-849b-3590419b41af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896029, "uuid": "e70aa41a-8628-4a20-8a7e-28af6baf6255", "value": "192:rZu/vDxYWmxXXLnceTJa5G16FdF36xAvvu1c67PT:r6FYHxXXTcesG16Fru6w7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896029, "uuid": "8161f688-064f-47b5-b8e9-fec3147ed2da", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896029, "uuid": "b72d0ee0-e58a-44e7-8d65-b0184922a4db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896029, "uuid": "09145c4b-a662-4bc6-b59a-0553f6f7fbd7", "value": "SecuriteInfo.com.W32.AIDetectNet.01.2337.21873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ec9c70-d6af-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652880940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880940, "uuid": "bb2b24ce-64d8-4433-bd30-385818ab1aae", "comment": "Malware payload", "value": "bc4c675cb9ff8c4df32caeea668ebb44", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880940, "uuid": "55ce767b-b9ad-4598-8d19-a4f15e3f8cc5", "comment": "Malware payload", "value": "86618518ff796dca429e7eedbb97b9859c7cc3371b41ac51ebd8b03599496640", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880940, "uuid": "b8a1293c-c760-4d03-b227-f0c561bd2474", "comment": "Malware payload", "value": "25e348327ad1f8b8f0a40406fe7337dc778564d3", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880940, "uuid": "d54af139-d5fd-4894-a942-9eb70aa679aa", "comment": "Malware payload", "value": "8ddd674caee7001a9a1e5c08149571dd0b3ca1ca6e938306c27e139817e05ac8bb66f4f3f602877242f993e05ae05572", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880940, "uuid": "67c98b0c-f91b-4415-8bde-b03904dc7076", "value": "T1FA75EB31B132BA87C3160561565FBE86531CBE43B2C55F8CA04DFAF82CE6CA79342D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880940, "uuid": "b1050f20-db19-4994-8766-e954999b767a", "value": "1536:Kch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+6fw5be:iIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652880940, "uuid": "ec77aa87-c6e1-4ad3-98fa-7eee2159aa77", "value": 1676208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652880940, "uuid": "ebe54729-d03c-4e51-b115-6e983514d6f4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880940, "uuid": "b9b04306-6b14-4983-8911-2e4627a520b9", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.12901.873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedf8a88-d6d6-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652897808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897808, "uuid": "fe15547c-00c5-412d-a523-fb37a93051e6", "comment": "Malware payload (SilentBuilder)", "value": "7ba8d019f4bfbf169aa4c31dbf28edb8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897808, "uuid": "4d02bb2f-2e87-4b97-adf2-ed891d49b9f7", "comment": "Malware payload (SilentBuilder)", "value": "871c3a560fe16ebb0c953f84ff95e05eb7c5075b8356b09aa43bddeec9c21826", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897808, "uuid": "4d38d5a8-cef1-40c9-8743-8bf300ef76cd", "comment": "Malware payload (SilentBuilder)", "value": "72a7923a60de928fe371e465ca70700c4d1bcbb8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897808, "uuid": "cda19399-3b0b-4eac-9c7a-4c42d1205ddf", "comment": "Malware payload (SilentBuilder)", "value": "5da585430e060f1c1b27103ac8b186feaae07be6a1a298a7512c52b13c0845e2e6ae90c09c1b452f3bf0698e871a25d2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897808, "uuid": "8bf604e1-80a9-46d9-adbf-5d01031c249f", "value": "T1A0834A4AB69AC85DE523873949A783A9B323FC150F6B0747350AF3613FF49E05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897808, "uuid": "150faaaf-c163-45d5-bc4a-b4dc37ba7960", "value": "1536:H8nKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgwRAezwrMC1vJec/RtbKQ6w:gKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652897808, "uuid": "0154ef96-4bdb-4b00-97bb-66b24c2cafd8", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652897808, "uuid": "59907fec-773e-41e9-a25e-c3674d5413a6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897808, "uuid": "6dc56fde-cc30-4bbc-b2b5-2653aabc110b", "value": "Contract - May 18, 2022 from Reliancecorp.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e87a9c-d6b0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652881497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881497, "uuid": "2631a87a-6f0e-4349-b002-cffae4d3a321", "comment": "Malware payload", "value": "aae9d3939f5ba5501aeead395a33e451", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881497, "uuid": "da1727b6-2c01-4aae-8d9e-16c42ae42ddb", "comment": "Malware payload", "value": "8721f4b4012db9f00e5a1c01cdc7952aecafa2ba080e4a003258e7dce5a57123", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881497, "uuid": "502d96fa-0f57-4b9e-904c-ef766f822e1e", "comment": "Malware payload", "value": "a999ee8d4f132d87653b2134f62f42752d0199d4", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881497, "uuid": "9138be5b-b3b7-4527-8e3f-27c1767ce0e0", "comment": "Malware payload", "value": "913a69d505b0d7a6cd5741a53ace9430b6c35a4c1244c41d57e98b92e87926cffeb974a092ea49f2ea42722c127d717b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881497, "uuid": "e5e302cf-c637-42b2-b2e6-36655e49adcd", "value": "T1E3241224BBEEA41DF0B920399E58DC314522DEF50F025DCB7A6B713916705386C9EF2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881497, "uuid": "86c5a799-9fa9-49f5-9c18-2b2d35dad64f", "value": "6144:Vn1Yk/Js9ST05gZ2FLqoqNRUsn1rU149gVv4v6Lr/Q6epiIO:DF/JsYTUgUjqjJi14Cx3eNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652881497, "uuid": "8922b08a-31ee-429d-905f-dfff8fe8cbf2", "value": 228840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652881497, "uuid": "35a2a1e8-12bd-4cde-9bca-26d83b688ff2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881497, "uuid": "7f5ab396-d18b-4411-99de-94bae51462d1", "value": "PO91372D120.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0f0b90-d65a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652844497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844497, "uuid": "7c245b7a-dc67-4d3e-bf4b-f969cb1c0703", "comment": "Malware payload (Heodo)", "value": "6dc3805a354d92df149508ef88ec48bd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844497, "uuid": "ea216677-1229-4ce5-8602-b2e059fb8cb1", "comment": "Malware payload (Heodo)", "value": "87461e39a3cf142271eb5a35111ffab3c20be098d95e79ea92e901a2a2cb5df9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844497, "uuid": "dc4f9a40-b9c5-4b8d-8ed6-8c17a50d1b51", "comment": "Malware payload (Heodo)", "value": "799f33ad791e96f375fd73a19a73e9c455a22ebe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844497, "uuid": "669b0211-ca69-40aa-89f5-462c8e91460e", "comment": "Malware payload (Heodo)", "value": "ae1bfe7eac74108751ccf0dc3788b8811afe9320784537a66b24ee520dd9dfa33e1059e535f475183fa98686727ddd70", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844497, "uuid": "d2158e92-0085-46ad-9821-583a786a4754", "value": "T1E194CF1572A50CBAEC779239C9434A06E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844497, "uuid": "d3d4013d-da6b-4a55-9314-2879cf4e9e54", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844497, "uuid": "4c98d7e7-10f7-4e04-8341-7d9d7dac20cb", "value": "12288:M3hV6Pw4aT23s2oLd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Gi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652844497, "uuid": "db41c29b-fb15-42ec-87be-85b88e7dfd24", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652844497, "uuid": "3501d40a-7a27-493c-9a4f-298c69522bdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844497, "uuid": "c781251f-cb18-45fb-89bd-2acf538cd911", "value": "6dc3805a354d92df149508ef88ec48bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bce0531-d695-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652869644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869644, "uuid": "404dbba6-9d16-48ca-99d7-ac3f5df662d8", "comment": "Malware payload (RedLineStealer)", "value": "81571a28b21cab8c74c722efa2f29962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869644, "uuid": "c9af16e8-27b8-447f-8b96-8d8f2871c66a", "comment": "Malware payload (RedLineStealer)", "value": "8760a055ce1f31f4940e600680f31d80e37d40202d1d71ab284608affeea916d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869644, "uuid": "c034dfb5-ecb3-4dfb-895c-328d45bed37c", "comment": "Malware payload (RedLineStealer)", "value": "cfa0f304a45741c26576d2008385d8e81c457150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869644, "uuid": "7bb82ef4-a5c3-4f92-b1ee-914c291e3065", "comment": "Malware payload (RedLineStealer)", "value": "e5a87dccf6971e7e21dcbb6c6a0a6668d397f32ff1d0d7cdf06d46281d4a4833c3df2ad9bf1eed7bf0092c63cb8d2534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869644, "uuid": "4a9a4748-4ca2-4c19-8627-f8bae3f37766", "value": "T11694F101F790C470E1951D7048B5F7B1177BB86265B0991BEF906B9F0EB33A18ABA31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869644, "uuid": "22ea0e14-7cc0-4bf1-af03-d473941bf25c", "value": "151adccff5e70213fb31de55ca880f7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869644, "uuid": "4639d318-5453-4bdc-ad3e-ae50c8aa65da", "value": "6144:p3ZS1o3m5g2uFDKvj77qlV5rcMxdcFv+srufcT33iga3wVfNX:VZS1ovRQvPG5cAdbg3S0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652869644, "uuid": "8a3f68c0-c2d3-41da-917e-6c026f8098fb", "value": 446976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652869644, "uuid": "dbb8a654-1f79-4228-b6b7-67fb0946bd99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869644, "uuid": "11f45f20-f5cf-4d3e-985b-82cec4c167af", "value": "rrmix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc76f94c-d6c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652891389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891389, "uuid": "34d0b392-03a7-458b-8121-b837bd7116c7", "comment": "Malware payload (Mirai)", "value": "8def05b37246177b8cfc8b6e1d55314a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891389, "uuid": "af02a1ce-ba0a-46b3-adfd-22e1d29212b8", "comment": "Malware payload (Mirai)", "value": "87662a9435b8bbfc8ef1a62c4aaa12966441f9caceaae928c760ca1d62068ce9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891389, "uuid": "a201b933-804f-4239-a621-a6fdce5d7af8", "comment": "Malware payload (Mirai)", "value": "ebd08552684fd230d2e1889dabd65bd2ce3e232a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891389, "uuid": "895d55bf-754b-44cd-a8fa-0d671e441fb3", "comment": "Malware payload (Mirai)", "value": "8d16ea85819cb98a1a16a5459ea592eb178fffff6e395586d4457a3d406c429492fd4c72b25e2a2734e243e0df3fa1fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891389, "uuid": "8514ab3d-b3db-4224-bf41-ff3bd62a0cbf", "value": "T1B7831981B9809E15C6C5177BFA6F108D331247A9E2DEB353CD145F6477CA82B0E37A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891389, "uuid": "230544bc-8040-4ab6-9101-62658f2d724a", "value": "1536:29n7/xkRBFg3yFhk20WtEu+1F4YPjaduBcPYO9mrsplDKZUlQBKXAVan1X+F8JyD:gJTyHknWt/+L4qjmugd9mrsplDKZUlQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652891389, "uuid": "ab29224b-ef4e-4932-9d27-b6567e5e1cff", "value": 83072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652891389, "uuid": "0ee2de0e-2012-463d-ad41-24e13bcf6992", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891389, "uuid": "218b1ac5-d85b-4c66-8d67-b288944d81f4", "value": "8def05b37246177b8cfc8b6e1d55314a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfe6636-d6b1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652881966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881966, "uuid": "b0639784-a1da-433d-bc30-5179e981592d", "comment": "Malware payload", "value": "4e6628e5f18ab15aac6fd96ef95b656d", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881966, "uuid": "dce4ec33-c537-4347-b31b-bc0252214841", "comment": "Malware payload", "value": "87937d8e251601ab750fc53c6fed7e34f1f4400cad227e5083aae26ac09daf4a", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881966, "uuid": "098d05a3-de50-4c0e-8250-302806a24efe", "comment": "Malware payload", "value": "71414122a1f431f62087841084e200955e2b20b8", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881966, "uuid": "e0742e32-eaad-47c4-856f-0a3e71868b3e", "comment": "Malware payload", "value": "deacc6758e8915e0d1e55065256b82d308fbf2ce71a15b9771ddc4fc54740b558d043f9c1c0acc3a8d31364f658fdb9a", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881966, "uuid": "6194c086-63e9-42ac-882e-233eb033726d", "value": "T16A6533BACB4700C8E6E40AF75F9CAC48A47EFDF91B9A1E4DBB6310DC131E1594A85D09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881966, "uuid": "dd703c4b-6238-43f3-a3ac-fef0e0985064", "value": "24576:9yIFvkgm6EGX+3LgS+i+NScA4RNc413KwBr8vzd8Q67tOI0gmQ7hHUd0vuWwpJ:9VFj3+3LgS+RQj4R31v4L6ZKQtHUdasJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652881966, "uuid": "6c11e89a-08d9-4b90-ba03-66d657033fb7", "value": 1495717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652881966, "uuid": "c10b4f24-4121-4fcd-b7a8-142bbe5d421d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881966, "uuid": "591dcefe-2514-4ded-9637-89ad64e01815", "value": "invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48cba3e-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909092, "uuid": "00c11979-b0df-4b2e-bbfd-5954ef3fafa4", "comment": "Malware payload", "value": "7a702abb9d85f125f79f94805ae4dd68", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909092, "uuid": "9b2bd491-a8c5-496f-b0c0-0c000177a0a0", "comment": "Malware payload", "value": "87ac6ef209b98b6ee7fa0d87a281259aa0e8d660f848ceb3e1915511a0bbd729", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909092, "uuid": "23d1121f-4417-40e4-8a34-3d0bc6b7c824", "comment": "Malware payload", "value": "251e0f0d5ad1a83f80ef8cdd754673847a8c89ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909092, "uuid": "da7fc19a-2b71-4f2d-9f0c-1187330355e1", "comment": "Malware payload", "value": "1f60032eb8ec6891206cf3650fc78a571456b2f8d64d2ae66327eebe8380c9f5bdc5e6aece329ca05a33446a96a45241", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909092, "uuid": "2f906542-83df-4a7f-8dd7-80335e4c9ed1", "value": "T19FA1E750112C1AB17246697AD26FFB52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909092, "uuid": "fc50ab41-c032-4a69-bc51-82f9d46a58aa", "value": "96:4RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:4RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909092, "uuid": "59621892-89e1-4f5c-aea4-3eff9c55b16f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909092, "uuid": "41c5dbc4-a48b-452e-b341-886259aa1055", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909092, "uuid": "f5845a07-b794-499c-a702-824963e4c30a", "value": "87ac6ef209b98b6ee7fa0d87a281259aa0e8d660f848ceb3e1915511a0bbd729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ecba83-d648-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836810, "uuid": "eb2db5c1-dd11-4679-aed4-42b3ee1ff67f", "comment": "Malware payload (Heodo)", "value": "f5ef44d0a7e9a710c54e88f1ac67554d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836810, "uuid": "fb950e29-e9b8-4aaf-a2fa-7db1a595b57e", "comment": "Malware payload (Heodo)", "value": "87c95450ce1451a05f22cf0e7ee2cd6c251f571cef4bfe80a34c68f1b4f78d95", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836810, "uuid": "f0da035e-c5b8-454b-bbc8-7a3e2cb3ec5a", "comment": "Malware payload (Heodo)", "value": "f279c04a97a06d50f479c718739c7c6ea6a09e7f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836810, "uuid": "047452ce-275c-438b-9611-f65275cd167d", "comment": "Malware payload (Heodo)", "value": "894a7114f90c4b2b4c7f896e18d00bd8f24bb7c6ebd52dfa6fc6e1bd8b5aa3c907849318f74dc09cc2df56405afff84c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836810, "uuid": "a157ae90-f0ca-43a0-a7eb-88cd9e7a8484", "value": "T10E94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836810, "uuid": "ab807e7b-4d69-47e5-b73e-62a7c6b8dfcd", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836810, "uuid": "30be0d46-b457-4c58-9084-8f8615baa9e0", "value": "12288:M3hV6Pw4aT23s2o9d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ki3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836810, "uuid": "d13e251e-9843-4bd5-8f02-e81add55af40", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836810, "uuid": "d9c5db00-6055-4d81-9cf2-5dc4de8a0c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836810, "uuid": "306d94f5-c199-404f-a1f7-2ad0ba541b4c", "value": "f5ef44d0a7e9a710c54e88f1ac67554d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3949047-d6d0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652895266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652895266, "uuid": "6fb61738-6e21-40e3-920b-6853c573cdfc", "comment": "Malware payload (Mirai)", "value": "14af4936ca972c32afb145bdf5b39ec5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652895266, "uuid": "e46ab9c4-9aec-438f-8916-7613b3cc75ef", "comment": "Malware payload (Mirai)", "value": "885d4a0c21c2a4316873011a6bf7a5a11ead15c186b54350334c23b9107d75ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652895266, "uuid": "c335acd0-5f86-465a-b8dd-7800372f4bc8", "comment": "Malware payload (Mirai)", "value": "fd0f1af52c30dba007d6ec7110c4bed44a5cf048", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652895266, "uuid": "173d8530-2de9-4473-9913-251349f40d93", "comment": "Malware payload (Mirai)", "value": "27237599fc8854e4a205b4dcc913914fdbbaef0069c49e6473f3f5f8aa7def975420f731439d081d10105c84fcef51e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652895266, "uuid": "13b7eb1a-ab93-4f28-a88a-e0f6b9bbffb1", "value": "T13B734B0271280B47E5930AB42D3F1BE05BBEEDD035E4B688695FDB664A35E375086ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652895266, "uuid": "5a74c495-cb1e-447b-9ff2-19d3abce1e0b", "value": "768:v5DtKQQ/uUHRAlfu4cC1iJUqv2LHHBJnc1eGQ2iNk7kNHoOTrI+5Rmnp5UIPEtPX:uHOPcC1iJUM+bnc1/7wPmfUIGPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652895266, "uuid": "fe4fa75f-fba0-43eb-825e-42444a294f6a", "value": 74848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652895266, "uuid": "9c5b736a-c57b-42d1-b381-cba9dd02a294", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652895266, "uuid": "5d7a248f-54dc-4585-97f1-d2b75f1571cb", "value": "14af4936ca972c32afb145bdf5b39ec5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470233ec-d65c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652845235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845235, "uuid": "c7ab1522-cf51-4f56-8edf-5dd7bbf93443", "comment": "Malware payload (Heodo)", "value": "a8cfe7f3c87f50bb32efcc05fad83d72", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845235, "uuid": "ea58c3e2-9edf-4cef-a27c-617f1876535e", "comment": "Malware payload (Heodo)", "value": "886518195dd3d16918b446d96bb3423c832264d00835772e9f2a92f205d2be19", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845235, "uuid": "65b1cf23-97e6-4549-84f0-6aa0e4216053", "comment": "Malware payload (Heodo)", "value": "e16c4e794e849d1f69d53f5b92883d0c0fbd1fff", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845235, "uuid": "c4738e0f-2def-4cda-92d4-9a94d4ac4c8a", "comment": "Malware payload (Heodo)", "value": "a411e7ee4aec9ec7929ff36e0ad10116b94d046e47bac51f0ed722b394118b77b87a345964f062e7c76c9ba5e8e6e6eb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845235, "uuid": "30eb5741-9a85-4abf-afd3-8edeb41b6756", "value": "T189A48B4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845235, "uuid": "42568733-fc40-4dfd-9a0e-b3badbc5f9c8", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845235, "uuid": "08f9503d-40f6-406f-b177-f1df7ddf0a7c", "value": "12288:uS4BnAed8BK2o0aaa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKBa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652845235, "uuid": "fa783681-dd80-457f-8d35-f2a9a0eea86e", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652845235, "uuid": "8f0c6df4-d8d3-47ad-8316-e867957f9bc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845235, "uuid": "43d2c15f-8c83-41be-89f1-e3a2e68097ec", "value": "a8cfe7f3c87f50bb32efcc05fad83d72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e1547b-d6b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1652884405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884405, "uuid": "2fb2b762-ddc8-45cb-9427-c5114c6de844", "comment": "Malware payload (CoinMiner)", "value": "f4169c7f4288fbf9f0c8b52a93eb66d4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884405, "uuid": "c1bb1309-e3d4-462c-90d8-2ae30415606a", "comment": "Malware payload (CoinMiner)", "value": "88a4419d9349e54e507ca3a16b68f9581d5b17d32618df2ad91e458bc54c7142", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884405, "uuid": "c1577e66-f266-498c-8608-82fd9ecaf266", "comment": "Malware payload (CoinMiner)", "value": "9525fae477b988602e33629f5ae6dcf41e87ca08", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884405, "uuid": "db29eb62-d5e1-4e04-b91a-8e980742d130", "comment": "Malware payload (CoinMiner)", "value": "e66412bdc2acca4d103b43b2cb7c7e859eb5690d5b47c1286cc6a83b91669729188c1f48d05d3431f8da1130f72d7f21", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884405, "uuid": "2e77e468-4b02-4d4a-8b15-1192052dc724", "value": "T1A7D633CAFDCC62DDEE7A0FF142B8C8D5A020AC9AF240528DBAD6AC5D5C4D61C255E11F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884405, "uuid": "f3d00233-7fde-46d5-8081-b7bb755c187b", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884405, "uuid": "7b33fee6-53ec-425e-945e-d4a8b8975fd4", "value": "196608:n2RdgRbHKK6EAp3Qefm6gASlDBRhZRcPZ1koJOnKjvIc:n2RM+nTp5PktRHeh17jvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652884405, "uuid": "ecd75037-a8bb-4038-9e74-16b74ae50ab7", "value": 13274624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652884405, "uuid": "cdeb7b79-9acb-42de-97d9-0a7ca50ae244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884405, "uuid": "5cfb5a6d-4d40-423b-9fbe-dde8437de3fc", "value": "onetapv2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03459f9-d66a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652851532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851532, "uuid": "d39198b2-dc22-45d1-9009-9d9fd51fa1a4", "comment": "Malware payload", "value": "43fab095725f7e09bf57f8d80404fa48", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851532, "uuid": "2b629060-dae0-460e-8435-7c631fdadfa9", "comment": "Malware payload", "value": "88c6043d1416110fb459a41df0a9e2683af1df04963c80484d2e1b70b678c198", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851532, "uuid": "6b0e6238-3119-4ddb-9e2a-3b1d39f6be87", "comment": "Malware payload", "value": "bbebae05da1b35df223a06e2016197d68504a399", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851532, "uuid": "aa6086ba-0512-41a3-bd75-90a1f68ce56e", "comment": "Malware payload", "value": "f517a979990be405f369ffb1bcad38728b241fbab3c875a248972b00b8e834a27eaf58acc4f96a3c31fb8e05d1371e62", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851532, "uuid": "d7830abb-a77a-4ccd-85e2-1aa5fac390a3", "value": "T1CB94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851532, "uuid": "a2ae8986-1dc9-4610-b077-5bc7c0d8c566", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851532, "uuid": "0bdaa328-4a90-495a-8192-c21ac772929b", "value": "12288:M3hV6Pw4aT23s2oJd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ai3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652851532, "uuid": "1ca22390-8bfa-40ea-905b-e052fa072bba", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652851532, "uuid": "08b22b1b-2690-4f75-8f9a-f72594ef0e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851532, "uuid": "af70f2bd-b3ff-4fe9-857e-99910bde0397", "value": "88C6043D1416110FB459A41DF0A9E2683AF1DF04963C80484D2E1B70B678C198.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9098864b-d6ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652892603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892603, "uuid": "4dfcd04c-6c49-40aa-90f9-f980292009dd", "comment": "Malware payload (Mirai)", "value": "6578ce6d298bf34b0359917f65ed08d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892603, "uuid": "1aa7f3fd-01d1-46ef-b19a-ce5ac9f0c9ce", "comment": "Malware payload (Mirai)", "value": "88c68b7066c4bc68084d294cb5c69a5bc465c1056e85c487d1a44d5153cc549b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892603, "uuid": "ad598927-38c7-4cd0-a81c-27177051a600", "comment": "Malware payload (Mirai)", "value": "7643912e4aa7c46ea6f2af0d14202fb470204a5e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892603, "uuid": "0d721c55-752b-46ad-94a5-4dea26ec5b44", "comment": "Malware payload (Mirai)", "value": "d7b12ebed8fb842421274f91cef7f0d4e048efa012423a14521a91cbf88b4694842a02912330f8daa8b01a560a5a34e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892603, "uuid": "0531f15f-5f4c-49a8-8cfc-30d002b8f1df", "value": "T10DE34C46EA818B07C0D6277AFAAF424933239764D3D773068D18AFB43F8679E0E63545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892603, "uuid": "17fef2fc-eb76-4e6e-a724-9a99ffbc72bb", "value": "3072:ES5T+cN5QKyKXvdM8gYCKiE6/RaPNIMQwHKZB5XzGLEkm2LSM/9EYzd:ES9+cN5QKyKXvdM8gIe/RaPNIMQwqZj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652892603, "uuid": "fdef7f5f-30b8-4f87-b7c6-0b68b1a1cb73", "value": 155700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652892603, "uuid": "b0d70161-08b3-4c93-8142-505b8decad99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892603, "uuid": "bd2d1f96-5b45-4b23-9198-c7a88f2a200f", "value": "meerkat.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d41f5b7-d6c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652888598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888598, "uuid": "e8463652-1bde-48d7-80bc-77b27fa0d314", "comment": "Malware payload (Heodo)", "value": "8fb7bbf74577cd08d29c2fd6835bb402", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888598, "uuid": "0a195d60-a0b1-474a-b138-a5a2bf3a78b3", "comment": "Malware payload (Heodo)", "value": "88e42badd317f04e003b3caf7a942875e62d751f7e48efbb234bb54f617af22d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888598, "uuid": "8753b7f2-e02d-49e1-998a-ec8d3347f2cb", "comment": "Malware payload (Heodo)", "value": "3c7a4671c9b575bfbe046c3c42aaa1bf29013e0b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888598, "uuid": "cf7841e2-cea8-4356-ae6e-19843ea0129e", "comment": "Malware payload (Heodo)", "value": "b74013e703730dada087ffe92f7c2d5e0a60eeb05cbaa4b896164db63cdbd18a9df9e2344d3ddb89b0f72db1bc9867b0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888598, "uuid": "a4a5358a-54d6-468b-b67f-5d870c8c4555", "value": "T1B554E007A2E940FBE9678278DC570B06D3B2B81257659B9F0371476A2F1B3A14D3EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888598, "uuid": "d9d2b9cf-b4cc-4b0c-ab53-f14da059f9b5", "value": "8814d1a94d80f9b49a103ad2cb419460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888598, "uuid": "53a5fe51-e034-4b06-8764-bfe6a72f9e42", "value": "6144:yRjSsk3AzLPQWTgbZJpDphv4MOTRqhTAK3yUil5FCsCfHG72:ojVhTQWUblv4RqFAKiNL4tm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652888598, "uuid": "0307566e-5deb-46ce-a33a-080d423846d1", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652888598, "uuid": "f2f6e56e-831d-4fe1-87b0-ff1a6933b0ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888598, "uuid": "4708acd9-6ca2-4037-a01b-e669c6fd28df", "value": "8fb7bbf74577cd08d29c2fd6835bb402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef30eb30-d680-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652860979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860979, "uuid": "a4adbda0-b9f2-4166-b7b9-701d36331237", "comment": "Malware payload (Formbook)", "value": "7f54aaaec4192b6fd8a7af6a02ff96f2", "object_relation": "md5", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860979, "uuid": "75cca77a-e972-43d2-a750-0c87df30f572", "comment": "Malware payload (Formbook)", "value": "8936f46a29987f1f364c7800a441fa9b9b2ca46792506d96e2445920d7099bbd", "object_relation": "sha256", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860979, "uuid": "a58c882d-dd30-4acb-b0aa-d2fb0a0fb8a6", "comment": "Malware payload (Formbook)", "value": "3fab2f7e57bbc071252391abc980a00d717f5b3d", "object_relation": "sha1", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860979, "uuid": "e12d5e59-4cff-4bf5-a508-62af0acb950f", "comment": "Malware payload (Formbook)", "value": "a68bdebb1859f6544d6012bb7345ba3055c9e3fd7611a7d0bef49a8755fc4e2949b79661e51b5d90c7df1b370155b79c", "object_relation": "sha3-384", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860979, "uuid": "63234925-b813-46ad-8976-c4fa9209105f", "value": "T14684F16AAF474219EC681A778AF2A710BF0167A140BBE32F5DD714AED85AFC53CC10D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860979, "uuid": "af04eea5-6bf6-47ab-9047-13c3dfefc6cb", "value": "6144:aHB4fuqlaqMfD7w/79khCD1gPjxJrUoDG4fm8z6zGDDEbz6OupUYRYIgUU9d8uzx:aH22qla5w/yXbxqR4+w6zGDobz6OuyzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652860979, "uuid": "927e339c-2630-4394-8334-4b12e6563546", "value": 391168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652860979, "uuid": "2bf79d12-d499-43a9-bac4-e3193d6c2d5e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860979, "uuid": "c9a9d180-bae1-4c74-9a0d-0a8ebd7652a5", "value": "Oruvdtzs_Hdxjtbiy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4acdc43-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908958, "uuid": "16deb194-be26-4e8d-ab6f-d109770b05f6", "comment": "Malware payload", "value": "b250555da8ceb46eff09404d7433d3bc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908958, "uuid": "34db9474-77a4-41d4-a63f-f9fd86648cb7", "comment": "Malware payload", "value": "89a2e5d2c11cb8236a6057ca46203bd8d73dd9b3d83b6db5f004a8300528110a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908958, "uuid": "9b7cfdfb-de3e-4f12-9f18-1c61e9659026", "comment": "Malware payload", "value": "24b74c8e4ab0189149d9f5c4c611887f815c4db8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908958, "uuid": "ec688b19-27de-456e-bb91-fe9937c48d77", "comment": "Malware payload", "value": "d69ef1331366e7305741d8397acd2876e854fcbf1398e7d1ef7cc62370293ccc2ff5372dbd690e6e6fa0afaf84b042bd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908958, "uuid": "14d607d3-c488-409b-aabd-f2398948a336", "value": "T1BAA1E850112C1AB17246597AD26FFA52B50EC81B09777B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908958, "uuid": "967e8c33-1193-433f-8dbd-77e31db9c239", "value": "96:zRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:zRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908958, "uuid": "0de32b99-f3f4-4b2c-87e3-0d8848f826df", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908958, "uuid": "be94a88e-89bf-48ea-8d2f-379eb47ef222", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908958, "uuid": "d1b2263e-0aed-48ab-a1d5-3d2ec62e0fde", "value": "89a2e5d2c11cb8236a6057ca46203bd8d73dd9b3d83b6db5f004a8300528110a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bebf80b-d6dd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652900729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900729, "uuid": "575adea5-d935-4868-b812-bfa981cc5e49", "comment": "Malware payload (Mirai)", "value": "b5a7911739581b5935e303f564f7b157", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900729, "uuid": "2a821434-a089-4496-b219-8d29df6a5297", "comment": "Malware payload (Mirai)", "value": "8a02b9a5ac5f0c3c444bf3fb4f56bfda9d3926e76c5e1f6b94aa4a5dc0524f5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900729, "uuid": "2a50da22-3486-4efc-9c70-144ef5aa18f1", "comment": "Malware payload (Mirai)", "value": "c27f93300ad67beb6d2da51fd2f106b8305528a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900729, "uuid": "072f70f2-6895-4881-9a47-b415d0ad6414", "comment": "Malware payload (Mirai)", "value": "37879d8baafc7cf418705901730fc5bfcf14a5de731e43a0757543b8351e9d16d2228cea87ab6c482173cde5fc58dde9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900729, "uuid": "816ce50c-53d7-4a2d-8de1-585df2b909b9", "value": "T16303F784B8868A07C6D4537BFE1E42DD3B297388F2DE3313DE166F51368A92B0D6B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900729, "uuid": "c02ff61a-07a6-4d4a-9e50-a558f2dfdebf", "value": "768:lLzqA2WRg5eo40oNCoeS1h3StWBMY/07J1bdWdW:tzq8jyW8tWBJc7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652900729, "uuid": "e577ee0e-6071-4773-8714-f9deae7398c8", "value": 37884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652900729, "uuid": "f68bcedb-c4a6-4566-9839-31847774a5fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900729, "uuid": "02cf13cf-b603-4fb5-8db0-383d54a10820", "value": "b5a7911739581b5935e303f564f7b157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18cb574-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909087, "uuid": "2a211633-9560-4916-90c8-ae0166c4705d", "comment": "Malware payload", "value": "b3fb69323009c8b2705b83685fb2a5e9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909087, "uuid": "a6c22eff-ccaa-4087-98b3-afe6c38d04b4", "comment": "Malware payload", "value": "8a18156dcb9164a97abc8c1054143fc44a2b9375e73297e7a673d676d5612493", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909087, "uuid": "66be3e21-3443-4165-b347-ffb6c525180d", "comment": "Malware payload", "value": "b2b588eeb5aaae67288d74a96c84f633799cd1f5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909087, "uuid": "792f0613-525d-4316-b942-8ac7e46c5af6", "comment": "Malware payload", "value": "94ee0f62cb1065a5ec154e632e4193680083504b82143c82aad9596ed115e658ab3697e74ac93222a9af0c883d64832e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909087, "uuid": "5263afde-d6f4-42de-a9a6-ff6897a7de1b", "value": "T1E7A1E850112C1AB17246597AD26FFB52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909087, "uuid": "b2417576-1a89-45b6-802a-80f7c7bbeab4", "value": "96:pDRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:lRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909087, "uuid": "0309c75f-cdee-4218-9af5-bd6d8f27ba2f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909087, "uuid": "83f66625-5088-4921-8dbd-75d6e232904c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909087, "uuid": "2a9c7508-9f97-4b5e-be4c-b4f15e9a04c7", "value": "8a18156dcb9164a97abc8c1054143fc44a2b9375e73297e7a673d676d5612493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6d28c4-d660-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652847254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847254, "uuid": "fbdc44cb-accc-4b87-90ce-d9384f783ec2", "comment": "Malware payload (Mirai)", "value": "e8517cff2ff5f952c4a0911207ccbe6a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847254, "uuid": "8879c7d9-1439-466d-b851-ff1639f5643c", "comment": "Malware payload (Mirai)", "value": "8a882a68581e68244bac432b79de26f432e0d8c68bde49525793882463782f18", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847254, "uuid": "955497f5-2bb6-4fe6-9ddb-e1d535788019", "comment": "Malware payload (Mirai)", "value": "d5700fc7d0880ea66d2d95d84534afeac4430f84", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847254, "uuid": "4ae54406-fa9b-483c-979a-56bada0e2bbb", "comment": "Malware payload (Mirai)", "value": "beade485dc3855644115c641111caf641ee29ab7822c5f629ba27d559fbc51984cd9be8e29cc21f441940b6ee1dbf508", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847254, "uuid": "80de237b-fc38-489d-9d99-fa117d7d67b5", "value": "T123633A57B58181FCC199C178477BB63AC573357E0239F2AA27C8FE162D86E701E6D884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847254, "uuid": "6469977e-6a99-4b95-b54a-58018733b5f1", "value": "1536:AmWZONxvbOTfntpGnaMMm9u9kivz60MWq0CV3FkKG8/kI:FWZ8vbaftsaMMm9uLXMWiVVkKR/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652847254, "uuid": "e6aff031-c096-4b2c-a24d-e65ff5dc4ca7", "value": 67520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652847254, "uuid": "87ab5f4c-cac7-44d0-9e59-2c83be03384a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847254, "uuid": "2e032baa-ff96-43cd-9954-ea1e78aea5be", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724df7e7-d646-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652835859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835859, "uuid": "b2ca3073-454a-471a-ad33-e3ef17ec8021", "comment": "Malware payload (Heodo)", "value": "dfb73fff741c53732f03eaa286844f48", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835859, "uuid": "1089eaea-06bc-4ddc-bab3-18574654ee20", "comment": "Malware payload (Heodo)", "value": "8aa5af0e739a48a04363d85de1a07ecb7de90bd290ddc53ed30712600a4ed4da", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835859, "uuid": "e16dedaf-e1bb-41c3-8a8f-df0ebdab79f2", "comment": "Malware payload (Heodo)", "value": "eedfcdcb36020df22f03d494d77be93441a4e28d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652835859, "uuid": "2fe78d28-5ecf-4375-adbd-79f824cf523d", "comment": "Malware payload (Heodo)", "value": "5cb34953190c90a2fa885646cef2f90079276ca588f2a11fc937014170d9b22d67e7b09477f6386b361ac3fde4519a48", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835859, "uuid": "563dbf73-0f6f-44f9-991a-134f9f08b90c", "value": "T1E194CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835859, "uuid": "9d472099-08da-4cc7-a68c-ff2dc635e4c7", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835859, "uuid": "c922f92a-7928-4284-90f8-661e72430531", "value": "12288:M3hV6Pw4aT23s2o8d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ji3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652835859, "uuid": "920a5975-75d4-41e7-94e0-ab670b8fb292", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652835859, "uuid": "d2f021e2-1ce5-489c-af07-2f25114cf58f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652835859, "uuid": "96479013-1caa-4ff1-b9c0-a54d059a3d29", "value": "dfb73fff741c53732f03eaa286844f48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1e5815-d658-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652843742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843742, "uuid": "1de3e1a3-7022-4bc5-93cd-9eb11c409850", "comment": "Malware payload (Heodo)", "value": "35b6e402fa1c0fa63f711f6968eff9ce", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843742, "uuid": "b4517e69-7490-4cf5-8189-fbc19d6b9a58", "comment": "Malware payload (Heodo)", "value": "8ac65406b39d30f5f58872a4bd3449042df6d7306bfa821916d46f797f966078", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843742, "uuid": "f45d9aa9-3d1b-496b-b681-329ffa640090", "comment": "Malware payload (Heodo)", "value": "b0c34e77afec7b990bc130eb11e41e89e1a4a2b8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843742, "uuid": "a8742a36-5e34-47ec-8065-6be54dcffc9f", "comment": "Malware payload (Heodo)", "value": "46fab1a7c33ee43668b43dec3fbda239eab91378dcc2e6a9ba13c3bdaf611c816716b9ad1c332745434ddc31acd82858", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843742, "uuid": "c9ab1c0e-31d1-47fa-aea4-37f12bb06f17", "value": "T16194CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843742, "uuid": "6a2e1176-ead9-4ac6-bea9-118046f3d53f", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843742, "uuid": "b0bfd927-b09a-42bb-84b0-6f3183c817f4", "value": "12288:M3hV6Pw4aT23s2oWd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ni3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652843742, "uuid": "89ee26ae-3d63-470a-a94e-486cd638c655", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652843742, "uuid": "973190b8-cdf2-4d5b-89a2-de47b76af92d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843742, "uuid": "e873f591-3040-41be-8155-7c6a95529112", "value": "35b6e402fa1c0fa63f711f6968eff9ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03cbc41-d695-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652869920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869920, "uuid": "970c6f1f-99bc-4904-9485-4188440271fd", "comment": "Malware payload (Heodo)", "value": "254215fa71f3e467566c4995b80aee80", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869920, "uuid": "0a7d8bfe-aeca-4992-a7f9-f2790905f481", "comment": "Malware payload (Heodo)", "value": "8b3a6e84816a8767a7e12d087e257b8226c345fa07e9b811d527934c9e15d568", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869920, "uuid": "11ec107e-bf8f-4f1f-a3bd-1fe0b48f82b0", "comment": "Malware payload (Heodo)", "value": "010ed85c5b1aee4976deade85bd2c788342c1556", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869920, "uuid": "0fa81c09-550a-4466-937f-ef2c17fbfed8", "comment": "Malware payload (Heodo)", "value": "038dc588de33e38e28d6d4771528705bfd79b191ebaa423b48ab7e2ed1d4ac1c966edecd94dd6313418768369d874336", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869920, "uuid": "8f8564bb-1ac9-4150-b5b5-e9412fa50ff8", "value": "T14B94CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869920, "uuid": "228af67d-689e-4ae7-9db7-d7218cd60c11", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869920, "uuid": "943a979f-fbe6-4362-8a16-b284d0d4026b", "value": "12288:43hV6Pw4aT23GuoBv91Wuwf07EIvH3+38+:sb6Pw4R3GuSWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652869920, "uuid": "7220144a-3d6d-4c1d-b52f-c3ac634bb982", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652869920, "uuid": "e55057c8-a08e-4edc-9326-5b5aad7f20f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869920, "uuid": "adc13313-7da7-416d-b5db-339f223bb0d3", "value": "254215fa71f3e467566c4995b80aee80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf95f73e-d6ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652906453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906453, "uuid": "0239d6f0-02a3-48b3-b11e-2d74fd106ceb", "comment": "Malware payload", "value": "de17637e6d2ad45664b2353c5fd5f699", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906453, "uuid": "426ccc31-6f39-40eb-8d0e-2df13d757350", "comment": "Malware payload", "value": "8b52027cd37308ed21535fd02c5c2754879e2a6045479fdee71411c6ae14b697", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906453, "uuid": "983b100a-cb89-4280-921b-6df27c0d440a", "comment": "Malware payload", "value": "30052aeb62e759f67e46d119b9a61df0e0893cbe", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906453, "uuid": "d96a66c8-a81f-4abc-a78f-06c509897ea7", "comment": "Malware payload", "value": "5379a4ff0673922077cf432c3f653ef2a8405d9680a59349582cac25ef374c99d859b3768ff2466e3e2bb83f76231203", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906453, "uuid": "38181159-19f9-4d0b-8a0a-252f2a253c0e", "value": "T13A951226FCDFE11BE883D17CD2B5A89B548E1124990CF2671BE0E14C8DEED485786F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906453, "uuid": "da5d971f-df25-4828-991b-68b1558eaa91", "value": "49152:YcoYrKAwjTVUG6O1Ehy87g1nGkRPj+bzZBZudgRiSojR4TttYkudbX3lQ:H1KbTVqiEv7+nl+BjegklQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652906453, "uuid": "05263503-db72-4f2f-8d74-1b65f5ba817f", "value": 1924218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652906453, "uuid": "2c18431f-1382-4c63-8b0c-0e69ee86bdfb", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906453, "uuid": "0cc69890-df13-459e-b26b-49f8fae8a016", "value": "sana.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f11976-d65a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652844482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844482, "uuid": "12f7abc5-84aa-49ba-a9e5-e659fe0785f7", "comment": "Malware payload (Heodo)", "value": "ee0494cdc95228430235e8ee75d5fec5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844482, "uuid": "8ee51dbe-7951-4e02-9a29-93d3a4146247", "comment": "Malware payload (Heodo)", "value": "8bec83adf9c36637f05a4582f5b1757336cb3b4233dffd0bae309205e1cdfbf9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844482, "uuid": "af47eb7e-839b-46a4-9ec3-a3084ea70faa", "comment": "Malware payload (Heodo)", "value": "bce41ff5a3b6c5a0093f93464bd18e6f1bc33bf1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844482, "uuid": "4fc8158a-b904-41de-ae7d-1270ac5322b9", "comment": "Malware payload (Heodo)", "value": "cf618e746fa068800919a94326ad02c02583f24dbcd7ed7a0968dc10e4328a8d54453e9a1ce5ace7f34de4472bd6ae0d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844482, "uuid": "b61173aa-927f-4f9a-9313-d15307e723d2", "value": "T18E94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844482, "uuid": "aa871945-1d9d-4bc7-a088-f079bdf6d833", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844482, "uuid": "cd0a647a-1715-415d-b95a-2966caeb3f69", "value": "12288:M3hV6Pw4aT23s2o2d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ti3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652844482, "uuid": "dd36a794-425b-42f1-9095-8ce4b5af5aa5", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652844482, "uuid": "d427533e-6750-4dce-a033-9b4244418d15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844482, "uuid": "5759b4d6-9a2b-4b3d-b09a-920a4152227e", "value": "ee0494cdc95228430235e8ee75d5fec5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7b5f68-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908941, "uuid": "08c93dbe-ec4e-415a-9667-d4fcce3fb9fd", "comment": "Malware payload", "value": "407aeb5e06cf25555b271e6de9346a48", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908941, "uuid": "0901e1d4-99f0-49f4-9a6a-b9fcf90fa6ab", "comment": "Malware payload", "value": "8bf9e93511d2d3da09d08c2e763b611abf5a72d51b3ebeab6515cc9a5fee7a8b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908941, "uuid": "51830cc3-3b6e-41c7-b51c-bd4bdbfe147b", "comment": "Malware payload", "value": "cecbfe4cc88350f52405466d213294dc6daa47a5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908941, "uuid": "94e7476e-010a-430d-a2b8-5b63ec6ddc16", "comment": "Malware payload", "value": "fe1dd27bb4a430bdd4ffadd876dec95ee4ad337a538849d218f9d0670873288a749cd4b7c2e5553c083ae5611d27d3d2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908941, "uuid": "ed98bd99-a09b-4e85-898c-24cfd2cdb8d4", "value": "T14F21B6CB32B269766CB4E92F73FA891078D4B58A51CA1F8828DC39F8748DE057010AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908941, "uuid": "ecd221c2-813e-450f-9164-febd21ccbbda", "value": "12:q0Fumv0FA40FkOdfX0F8Oe9vkX0FBCOn0F0z1Is5i0FJ05s0FOVsQo0F51yC0FN9:vumUAZkOaZqss/8i53J6l7QJ+XN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908941, "uuid": "f11b20be-43a6-4d1b-a076-36f2494b2b0a", "value": 1322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908941, "uuid": "2709db31-7530-40e5-8730-0e43d8bd7b83", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908941, "uuid": "ea0ddfb4-3a10-46cf-a650-6ad80f9649ad", "value": "8bf9e93511d2d3da09d08c2e763b611abf5a72d51b3ebeab6515cc9a5fee7a8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc6616a-d688-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652864384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864384, "uuid": "d0ebe05e-1fb2-4ce2-9d7a-4638ffc3fa58", "comment": "Malware payload", "value": "c7d35aebf4b4523124d2d18925bae944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864384, "uuid": "78b2c7d3-7e28-4658-aea4-320773b28701", "comment": "Malware payload", "value": "8c3dde3fcc0e4d97023b3e0295a9604b34bb045755f4678d65577430ef919628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864384, "uuid": "ce9f48b1-f8dd-42ad-9398-9f7deda7b582", "comment": "Malware payload", "value": "cee696f187115af13a0ab97225e17f0362276184", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864384, "uuid": "d6afeecc-9438-4e33-a714-48be86bae7a9", "comment": "Malware payload", "value": "6f520dbd9791643344a75799406399c041acdf072b2d2be5109143fac9cf2b1d3be405c67ec74f8c36dd7daff75ec6cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864384, "uuid": "5783907b-7b24-45e8-9cb1-a3651a7aea9c", "value": "T18B453B9C321071DEE86BD676D9A81C68EAD0787B831B4103A02796ED9E4C9B7DF140F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864384, "uuid": "21c24caa-43cf-403a-b3f6-00583c171e78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864384, "uuid": "6b3ad98a-d5d1-4835-93d3-fc64bc8c6a85", "value": "24576:bdBcaWZS4EeEbmuCgZt6zFRE+CaLSCH4:bGZ/l6t6hRrECH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652864384, "uuid": "f307d455-eff3-492a-afb5-bd10dc21a509", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652864384, "uuid": "b4d54352-f289-404f-8327-368de09543c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864384, "uuid": "eaa5f623-88d7-4388-a9ca-364e4ea549ad", "value": "HnzOq4wWuArhH2W.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad179d0d-d698-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652871176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871176, "uuid": "f65d0065-97e1-4027-9633-847015765f8b", "comment": "Malware payload (Formbook)", "value": "a22a5aed80e550b180786dca81a2edc1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871176, "uuid": "bc3294f4-8cd8-4e69-b587-fbe36e9dfcf7", "comment": "Malware payload (Formbook)", "value": "8c851f5b9bd735177ff1dc22cbaddb5278720743a14ac1a2515d279edc8724c6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871176, "uuid": "a19983b9-3a2a-4acc-8436-dc8a2f93c15d", "comment": "Malware payload (Formbook)", "value": "af0d6fe7fa9c69095bfa8293fafb3d5f32a89cc8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871176, "uuid": "bc64441e-e0f9-4920-86c2-6238f693dc83", "comment": "Malware payload (Formbook)", "value": "32d0218e1206279e101e53ff0ed453bdd715c0902ac465ce832d6e6776eb4b0b81f930ee1597ad1af0dedb21ceac6d6a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871176, "uuid": "efff22ef-b453-48d6-8496-76985f61146b", "value": "T13FE423A847C4018AB0034B7297F3769BB3DABC6060F2D8731A9F71D4258CAE54B15FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871176, "uuid": "e29fd43b-375f-450c-862a-c94b54b0c85d", "value": "12288:tu+rf8hYSmTO30qMSamBgCKnerAFUmE9g7aNNrIaNDEUkUxaWRDIN:/z8CO30qWmBgjerApISaNlIaNDEuaWRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652871176, "uuid": "0fc42aeb-d32b-437d-aa18-7ee55b808b8c", "value": 704314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652871176, "uuid": "34e07ad5-5357-4c04-ad41-1c4b5914b553", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871176, "uuid": "ad371261-a17b-40a7-a59b-029c7e7579d6", "value": "ORDINE 56432_pdf.BZ2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141a09b6-d6fc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652913869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913869, "uuid": "0552602e-034e-49ba-9b9a-bbbcefad81fa", "comment": "Malware payload", "value": "44f0293481dd825cba0a1afd138f3458", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913869, "uuid": "853cbb47-217f-4ac7-933e-ec696d92f8e1", "comment": "Malware payload", "value": "8c8f19dbb4a6ad4a637fd1b086dca827e46fa9bd3882688fd5e2efaa88460070", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913869, "uuid": "be524f1d-550f-489a-8644-92a64768ed0e", "comment": "Malware payload", "value": "6d8b27b2ae83212e285bb65c1b84265e090d769d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913869, "uuid": "6ee1f5cd-fb4f-4815-aea9-7e43cfb2039e", "comment": "Malware payload", "value": "7025c932bd784e53434537a4d516812c41ac84ad477f777a853176e3326794d2995bf74742eb21b0cff5b8be691e4cfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913869, "uuid": "0957ea01-4266-4dd5-87b0-603233947fc8", "value": "T13705273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913869, "uuid": "631e8db4-7f8b-4a18-9e18-5bebe0732a3e", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913869, "uuid": "1bd42f4b-51a0-4abc-b2fb-62fff8f8d3ba", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oJaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7VUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652913869, "uuid": "eb7aaf8a-b136-48cd-a75e-dc470cde07db", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652913869, "uuid": "e50cb818-46fc-429c-8d7b-29d65470deb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913869, "uuid": "c8314dc6-ed5d-4dd8-b63b-2eccaf6d0d57", "value": "44f0293481dd825cba0a1afd138f3458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107cb0c9-d67c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652858888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858888, "uuid": "468b8736-4ab9-44e5-ba4f-6755c6e9767f", "comment": "Malware payload (SnakeKeylogger)", "value": "046f3a785753f4b171623fe51a3614d4", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858888, "uuid": "4184cae2-7c51-47b7-85d4-051cac7d65bd", "comment": "Malware payload (SnakeKeylogger)", "value": "8caa035f4ccb620d5d10aee5762b38ca885e756fd57307bb15b212aa655d952d", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858888, "uuid": "8ff1ac63-dd69-49f5-bc94-48b103875085", "comment": "Malware payload (SnakeKeylogger)", "value": "670bb43880c4982721424f3e022528b62fcacd76", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858888, "uuid": "f9e258fd-3aad-455e-ac12-ca594ff02213", "comment": "Malware payload (SnakeKeylogger)", "value": "67d077e91adbff88685dd386cfe0ee011daf84e26e5ff6e3d108dbb055ab5f4e3759267919553e2559239492f91d19dd", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858888, "uuid": "4e63d422-8d56-4f85-8fc6-9f8213aca901", "value": "T158B423336ED8C614A705AEFF349824E31047E82167F897CDE2DB2D9EFAB44890C1255B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858888, "uuid": "a4a42da3-4156-4ffd-b0bd-e88535078b05", "value": "12288:FpZKN+ig+EFJhqSbELKSOdeU+XdIvn86jfU0hv5v2rjwcjCS8dn13QLemF:UeRFGLKSjh0jfU01t2fwCCSk23F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858888, "uuid": "61baa107-8a7d-4612-ba3a-71be80a2b32b", "value": 520910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858888, "uuid": "be86aaf3-fa5a-4791-bd1a-18325a2f8d83", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858888, "uuid": "7462f5b8-771a-483b-b9d7-869ff9f0c8d7", "value": "INQRY-80164-S2-1163651.pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0641513f-d6e8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652905256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905256, "uuid": "88fd09a3-ad7c-4b8d-ad75-5126be6329d8", "comment": "Malware payload", "value": "09960f5a62f87656b505b19960cf21dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905256, "uuid": "74bc95b8-f80d-4db2-99c3-b219e04f8a5c", "comment": "Malware payload", "value": "8cf1894f804c5ff33fba64df63dce774087183bffeee5b474d650368a90caa4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905256, "uuid": "167e3b04-885b-4029-9f01-5df7e61f0a6e", "comment": "Malware payload", "value": "9d2c2548abf5e8b0ea28e3bd3bbdcdc60a8bba75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905256, "uuid": "668ddfd9-d5c0-4640-9e24-8b00ae2973a1", "comment": "Malware payload", "value": "16428229d8c941db1e74053c0e012f91985a0e2c67c3843f94f60ab99bd8f017c81af3bdbab7c7fa59bd723b7b8f5f2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905256, "uuid": "c3067836-bb99-40cc-b3fe-12c5dbc1c6c6", "value": "T12805283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905256, "uuid": "eddb5945-6838-490d-9cc7-ccd0f8a53430", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905256, "uuid": "2c639558-ff68-4fee-916c-4919be6e56d0", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7rmpE3:BTg9UXRD2SeqfZZi3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652905256, "uuid": "be2a8f91-4132-4ea4-a574-96934f3285e7", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652905256, "uuid": "d78f9bc4-dff5-46f7-b006-0c0c6c1fae89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905256, "uuid": "d84ccc4f-1c99-4c05-a140-8dc33a7d1131", "value": "09960f5a62f87656b505b19960cf21dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a179aa-d647-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836261, "uuid": "c4d3ba72-cafa-408f-ae29-98b3f0b9f7f4", "comment": "Malware payload (Heodo)", "value": "a23f9b37a0d7c7deb4435447e17a4350", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836261, "uuid": "90972a37-6574-4af4-8caf-532551fd3f42", "comment": "Malware payload (Heodo)", "value": "8cfcb3ac16d660a36e5c6116e7fc8ead5e0308a41c60161839232f095be642e2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836261, "uuid": "857921be-d9da-4625-a348-63f5cd0d2598", "comment": "Malware payload (Heodo)", "value": "72d21ec93a9090200bcf170dd2d673206d88e8c6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836261, "uuid": "cf3afe45-19e1-44a2-94ca-e419de0d8f1c", "comment": "Malware payload (Heodo)", "value": "b150206e066290df24e360844eda373d0a9cef9e3961bb39fdb747422a5369fde85a22bf38abf299a7984baf8feb972b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836261, "uuid": "d4f95846-a105-4339-a9fe-7205783a0627", "value": "T10A94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836261, "uuid": "fbffd22a-9142-4690-b1a2-4d2b323584f3", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836261, "uuid": "6418dd9b-7da6-47f7-8c01-b942ec951091", "value": "12288:M3hV6Pw4aT23s2o3d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2yi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836261, "uuid": "90498015-8139-4e61-bd1a-9bcb0a7fda49", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836261, "uuid": "279e8635-54e8-432a-95b9-c597bbe29f55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836261, "uuid": "2ca4ac4c-70c8-4df3-9e0d-9fc483d54c67", "value": "a23f9b37a0d7c7deb4435447e17a4350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1fff45-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652858718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858718, "uuid": "704e2c80-da05-443a-950d-0e0bf240122a", "comment": "Malware payload (Heodo)", "value": "1b1cb72f272b15dae7d8e9d19ddab4c8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858718, "uuid": "64c19bbc-7a1a-43b3-a964-ffcbe0cd2bf6", "comment": "Malware payload (Heodo)", "value": "8d0bcf25a924664b75ce7124cce6bb4e151804316f6c8fa6e361c10dffee2a53", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858718, "uuid": "b2def2ba-fd1f-48fd-81a9-33dbf7f3ffd9", "comment": "Malware payload (Heodo)", "value": "1d1c06698f15cc2d37a6047d1ae4b82b5956ff7a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858718, "uuid": "e4eb96bc-48c8-4d93-b9e4-ffaa6f6de0f7", "comment": "Malware payload (Heodo)", "value": "821ff8a2ed1de0e9c9894c3d9898044eac75fa15c104ab58b71cedb6ffa88d697727b62de58f8e112b1e34e9d87cdcc2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858718, "uuid": "ee4f2d6b-cb21-4d47-a4e4-ee4739e2d288", "value": "T14B94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858718, "uuid": "1418b27f-83ce-430c-9874-561cc4d5ed93", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858718, "uuid": "04dbcc24-af3d-4efb-8cb6-9fa318d369bf", "value": "12288:M3hV6Pw4aT23s2opd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ei3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858718, "uuid": "9c80dc9b-9ccf-474a-99c3-f583eb77d1c9", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858718, "uuid": "2bb6a373-33ee-449d-bfd4-8844d9d578ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858718, "uuid": "92be53fb-1ff2-437c-ba41-35ee5d22b0c2", "value": "1b1cb72f272b15dae7d8e9d19ddab4c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8cfb0b0-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908965, "uuid": "f50aaa60-7636-473b-a9d1-c1355d435410", "comment": "Malware payload", "value": "c57fb80b329090f4691ff4ab6d8dfadc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908965, "uuid": "669f0dc6-0dea-43e6-bb58-a093445aba06", "comment": "Malware payload", "value": "8d7fb90d867b55a0af87150e77316e02da7d0eceec8121db1e89ef3e2c338a73", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908965, "uuid": "c7b6134b-9d3e-446a-9c96-1b2d777f9488", "comment": "Malware payload", "value": "a7dd699684148720048bd9c1ba9aa807f66a965f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908965, "uuid": "a8123e2b-5bc8-4933-84b7-1a4ef01af14b", "comment": "Malware payload", "value": "9b5a3a41edc5021e98de79d0155f0d435de0ac9b83764bbd59aebdcb786a06b47d2815249dd33b893607c656619f95ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908965, "uuid": "170c108b-7e94-4cef-a699-370fd1ef5a70", "value": "T1C1A1E750112C1AB17246697ED26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908965, "uuid": "d9a13427-32bb-4072-b5f2-d90be631b5e6", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908965, "uuid": "ae61dc87-fb7b-4371-9612-7a880eff0d6d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908965, "uuid": "dd3a3823-f820-4d64-870f-b2b4519824bc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908965, "uuid": "14c83641-883f-4a90-828e-c91b4ead1f01", "value": "8d7fb90d867b55a0af87150e77316e02da7d0eceec8121db1e89ef3e2c338a73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3596e07c-d641-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652833610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652833610, "uuid": "cc3f4c73-d04e-4c6e-8cb7-f0c25cf3ca47", "comment": "Malware payload (Mirai)", "value": "3fd0e53efe4e0d99679e72f8931822f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652833610, "uuid": "1bf90167-702e-4ce3-ae5d-b7eb19646cb0", "comment": "Malware payload (Mirai)", "value": "8da75c1f2866a2fe0ff7f76324a605da4aa90d0169c156cd953b98ddc574f582", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652833610, "uuid": "9ff49ab8-621d-4f78-8121-001538c24333", "comment": "Malware payload (Mirai)", "value": "d832bac2a18029c299abc16cfeba6e6d4741e1cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652833610, "uuid": "3f7f4e57-bb22-4660-ab53-995dcae82e9a", "comment": "Malware payload (Mirai)", "value": "a1733e08c51fc6353a015413e1f9115dfeee415f05bfa79fc06b0a967e10a5dca5776d3d2a28d0f2a562f213d328f87d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652833610, "uuid": "30792fcf-74ba-4965-9933-a8c70a774934", "value": "T1D5F2F1A1F872E101CE3566F01CF6BF4B0117D82DB055888F28CAA525DDDBFA95068FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652833610, "uuid": "8b5a0013-a5b3-47dc-9bdd-66de12f2e21c", "value": "768:B0zTwKmbXi49KJHMpYcW3Hpwgqada2qMSFKZrg34g1oAuqnbcuyD7UHQRjB:Bmw3LLwJHK+KgRk2nSFKZr2uqnouy8HC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652833610, "uuid": "5d71ceda-1d0f-41a7-9449-40826762e1a9", "value": 36112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652833610, "uuid": "e2c4fb12-f15f-4c9f-bb7a-ab9644975ab5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652833610, "uuid": "87b520a4-39ba-450f-ba49-893995446196", "value": "3fd0e53efe4e0d99679e72f8931822f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dfe78e-d6db-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1652899878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899878, "uuid": "852b60db-f0c6-489d-a35a-17dc30152b70", "comment": "Malware payload (DCRat)", "value": "fafeda0367d2722bd1427dd54851f3f4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899878, "uuid": "b12acf6c-7676-4ba5-b097-a34cfc05ba0d", "comment": "Malware payload (DCRat)", "value": "8de91a0a553b5e674bef172e43b59bd57bb14f80bf172a3869cb6e20b439fb9f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899878, "uuid": "6a2decec-4caf-4bd3-b85a-8b3896949b85", "comment": "Malware payload (DCRat)", "value": "5558a02e0618f6cd572af30a392215f13158de84", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899878, "uuid": "53e34371-33fd-4129-b130-00ba0aeab1c9", "comment": "Malware payload (DCRat)", "value": "4c527ac1c93e469de0e22c81a56e9bed969cde8471f6f34673b6713caecd8bf853206e4234e7e249c961ec4fa5b6906d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899878, "uuid": "182eb6e0-c050-427d-baf6-829541c523e9", "value": "T121859D027E448A11F0191673C2EF450847B4EC116BA6E71B7EBA776E5832393BD1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899878, "uuid": "5ce400fe-f906-4812-802e-4af0a3aca5ab", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899878, "uuid": "0958b21a-11ce-40e4-b587-5cd06e335f68", "value": "24576:P2G/nvxW3WuR0cKN74hlysemVpDpclE45/jEDjnSXPh2vjT3H/ffb4oT4yywr:PbA3iJaLV9XUjRSjLH94y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652899878, "uuid": "76cc5005-b816-4618-bf91-a733441e48cb", "value": 1799838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652899878, "uuid": "952afd87-2f33-40d2-b89b-f4fa4de3671e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899878, "uuid": "4109edbe-4576-45a3-84f4-84c53f19265c", "value": "Excel File.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b0c681-d6af-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652880928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880928, "uuid": "1d6bfa81-9b4c-41b8-81cc-c88500b6f74c", "comment": "Malware payload", "value": "23793c70761ae8f4699d9221b2a7b97f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880928, "uuid": "bd7bd680-9d98-4b73-88f3-e135fd0f4fcf", "comment": "Malware payload", "value": "8df6327e5286ac9ab43d0a23c405d3ba54e8344e506e7abca00bb894772a1f35", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880928, "uuid": "18b70c91-4699-4136-b7cc-6d5c0bf94bf1", "comment": "Malware payload", "value": "337838ac10d966a9513e623fed73127e611d6216", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880928, "uuid": "fa998db8-1253-44c3-9691-506911d187ad", "comment": "Malware payload", "value": "b487dfe3114f4b1a885d6925b91c163c1ca7cb1c227a0d624b848cf8f11ee03689e28c87613a185dcbc5c6b9ba344ff4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880928, "uuid": "e9f6168c-73e9-4057-8783-db87eaff095d", "value": "T14691C8C27511D513C240663118EFC8B53565EC239E06DD1374DEBB2F9AB6BE06A83166", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880928, "uuid": "2c036c1b-1458-4fe5-981b-c62ab7726177", "value": "48:r2uPHWK3JgdXdxF3urr+0dFrHaVbJTiJNr318j4+OP3w7ALczcd//me5FV:yuvWK2dXt+3dF7afiJt318j1AIIdmev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652880928, "uuid": "26aad40f-8384-463d-b425-f379ae6deb67", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652880928, "uuid": "1a066d65-b5d9-4ef0-846d-b9c365ffbb80", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880928, "uuid": "051be912-aa29-4b9f-a146-7e33243ec4d8", "value": "SecuriteInfo.com.Exploit.ShellCode.69.20095.407", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6edb7ebe-d65a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652844443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844443, "uuid": "d83bec50-4846-41a7-848d-59b0f1f5cf9f", "comment": "Malware payload (Heodo)", "value": "edc3bdd0cd52bd31b763a5eb45aff2e8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844443, "uuid": "3e97a49a-880d-4129-94b6-cd1db0e89c7c", "comment": "Malware payload (Heodo)", "value": "8e1899f71ffe7a94c91a46315bdfb1d90109757709bd7bd74a1539b7394f2607", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844443, "uuid": "956659db-f7f9-42a3-9386-f10f2bd28b20", "comment": "Malware payload (Heodo)", "value": "9c1c533bb5b1ae5a6d1eb0b48f6a738d29e554fd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844443, "uuid": "07441406-210d-45d8-a4d1-2df97eebf71e", "comment": "Malware payload (Heodo)", "value": "c4ae0fdc95bdd6cb251b32b1a365ebfa453942fef8feffac842dd40a006e8fd1049029999a9e8511647a4b0ee2749dd3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844443, "uuid": "264a8455-6c02-481c-bd86-3959539e30aa", "value": "T12CA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844443, "uuid": "0943f728-5069-41e4-96c6-0a99d494526a", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844443, "uuid": "e956af1e-542c-4d80-bda3-9c209afb7097", "value": "12288:uS4BnAed8BK2o0ata5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKoa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652844443, "uuid": "0dc49618-3c10-4431-ad7a-db2dbd59f1ae", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652844443, "uuid": "979dba81-9834-4526-80af-4915770785cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844443, "uuid": "e82e6827-df4f-4506-b284-f68393093c27", "value": "edc3bdd0cd52bd31b763a5eb45aff2e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c0335f-d650-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652840220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840220, "uuid": "03cbbc4c-6130-4404-be95-d305a0c2f9ed", "comment": "Malware payload (Heodo)", "value": "c25f76027747050092e58326b110cbfe", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840220, "uuid": "ddcfe5c3-e81b-42e6-9495-bb8d89d4f79b", "comment": "Malware payload (Heodo)", "value": "8e6f2939d2dc3f8dcd33bd523437e73e7525e20c30f830b7a58bb743e93d3f68", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840220, "uuid": "0bc69446-6bf6-43e7-9891-53d9561fee6d", "comment": "Malware payload (Heodo)", "value": "20586444a98a1a7de7a470f685bbf3e750b8e912", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652840220, "uuid": "c5512416-88a8-4f95-9d62-2015e9a2d541", "comment": "Malware payload (Heodo)", "value": "aa308ad848f9c953f5590fa1a76fbbc02b41700a5171bf62b42c9257c598dd643016bf5027893713300bcc923fd4192e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840220, "uuid": "b967b36c-df94-435d-93e2-723c6d7090a7", "value": "T1C894CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840220, "uuid": "47fbb838-0235-4fd3-927e-6102e8e6009c", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840220, "uuid": "6b1cd6b0-4bdb-4cd0-9c75-ab6f43d96f5c", "value": "12288:M3hV6Pw4aT23s2oUd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ri3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652840220, "uuid": "56bc85d1-9bf6-479a-95e5-530d1a2193de", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652840220, "uuid": "b88c336f-e861-4bcc-9602-e8de55fdc73d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652840220, "uuid": "d89f03e2-4f99-4973-8985-560ef4473f59", "value": "c25f76027747050092e58326b110cbfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3957efb-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908956, "uuid": "10eac71c-0290-40a5-affd-93b8201dea5f", "comment": "Malware payload", "value": "a56d5550106312e465a310e5e46c5e67", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908956, "uuid": "1ab227e1-7e17-442e-848a-32f0320cdc57", "comment": "Malware payload", "value": "9078c15a980ae79cefbc7b2e86025d698efce069fca742786c8f0fae712df6e1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908956, "uuid": "e2ad9f55-90d0-4399-baf9-579709352f1a", "comment": "Malware payload", "value": "865390d343cced1c2b886dd1bc887bf8a63bd80f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908956, "uuid": "094305ce-9dde-4552-8b33-b1f9c816bde6", "comment": "Malware payload", "value": "39e19b33fde9849b2daccc02404ef3da61654976c0bdd2fd4ee068cf1c1fc58f9dbb408d151976a212053e62de197fd0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908956, "uuid": "103e683c-017d-4a08-9928-e53359e7fbc9", "value": "T1F0A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908956, "uuid": "87578fbd-aaa7-4725-99ee-2adfa1e47e71", "value": "96:sRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:sRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908956, "uuid": "18db6b1c-5364-4da4-a62c-f66d35f1cd20", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908956, "uuid": "ae99e9e7-73c3-450b-aa0b-91f5f56592c2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908956, "uuid": "cdda63d6-963c-4b4e-ac45-a7ac04c7583d", "value": "9078c15a980ae79cefbc7b2e86025d698efce069fca742786c8f0fae712df6e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea1e04f-d6c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652888627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888627, "uuid": "267c19de-f662-4d3e-872b-daba8b26bbcb", "comment": "Malware payload (Heodo)", "value": "1ad38cc2f2036a6c355c18f531c40280", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888627, "uuid": "2b9f8e72-d450-4407-9177-9e4a8e735d89", "comment": "Malware payload (Heodo)", "value": "909147b9b8ce5770f56656e97e0c77c1d5d8fef9631eeb71f4e6f2cb1892198f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888627, "uuid": "08a640dd-7f7b-48f8-b9d7-c50a68021a33", "comment": "Malware payload (Heodo)", "value": "f89efbc7dda3a95737332c031a82e1563228fa40", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888627, "uuid": "cac9f301-17dd-4db6-83b4-c41db4d8f0e6", "comment": "Malware payload (Heodo)", "value": "ab811200c2a527b0b62d506ef9416e76090fc243f981f6a87f1a53c4a76aa8381afad1ccddd04a924c44b7f565d22409", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888627, "uuid": "bb7a563f-54a5-4672-80c5-e07841c378a2", "value": "T17B54E007A2E940FBE9678278DC570B06D3B2B81257659B9F0371476A2F1B3A14D3EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888627, "uuid": "fc02c54b-dbe5-4efd-a91a-487ab7fa861a", "value": "8814d1a94d80f9b49a103ad2cb419460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888627, "uuid": "7481ca92-ca6e-4519-b949-916f6396f8bd", "value": "6144:yRjSsk3AzLPQWdgbZJpDphv4MOTRqhTAK3yUil5FCsCfHG72:ojVhTQWyblv4RqFAKiNL4tm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652888627, "uuid": "8320fc1e-5e7a-43b2-b0ef-9502c98ff737", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652888627, "uuid": "212f1b86-2be4-4367-b6a1-d6c3a00ea218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888627, "uuid": "b96e2523-4ab9-40a4-851e-f443d3580841", "value": "1ad38cc2f2036a6c355c18f531c40280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298a437b-d688-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652864084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864084, "uuid": "bb6c7ca8-d358-40f3-9486-c7081eb8b358", "comment": "Malware payload", "value": "65efd14a3f1559b896cd81f05cdcd332", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864084, "uuid": "ead92622-7759-406f-b277-80f435801d7c", "comment": "Malware payload", "value": "90a9e8eb33d79136818beab31555919750b7c7edbd54cff0f1da89ac916043e4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864084, "uuid": "335b6bb0-a12d-493e-9caa-d69d62c1936c", "comment": "Malware payload", "value": "34b834812cd0c347e9557ab748f3c974d9d13a3d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864084, "uuid": "36257415-67e0-4de9-8a86-a383c8e124b5", "comment": "Malware payload", "value": "37258844857041e8fe31c559498942eae58972b5ed11ab9fb1f53af36c0ab8ab463fab32f2a45ffb4fe50c9743b52f08", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864084, "uuid": "965874ec-d6f2-4621-8cc4-feb41d3d8fef", "value": "T189515F183DEB5119F5F3AF717EE975C6CD6A75B2A906599F0081024B0811A40ED92E3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864084, "uuid": "799fdf9e-61b4-4165-982d-15a7d643e14f", "value": "48:8mHYIxweDFM3zQFhZ0Y2dt6BM3vxjBHZx84ab:8mHYmwgFaqhd2Hy2NBv84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652864084, "uuid": "e0174aa4-2b7a-4ede-b5dd-f96fa1316741", "value": 2592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652864084, "uuid": "2d012d8f-7aca-45fe-8aa3-9848612b6085", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864084, "uuid": "0dc05399-cc56-47d6-b981-b438b0e18ab2", "value": "Form - May 17, 2022.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339448c5-d6c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652888582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888582, "uuid": "a638aa6a-8b73-43f0-9976-0a051bbf8ce7", "comment": "Malware payload (Heodo)", "value": "2ec5e922312667823238941e5a08e10d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888582, "uuid": "820d58c2-e1b8-4aaa-ac49-616293b018a9", "comment": "Malware payload (Heodo)", "value": "90c2582f6c428c8c79190bd20e87b8cff17380f4dcdeaa60adf2a157644d74bc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888582, "uuid": "d7316fd5-9f59-4aef-9d16-9dc97fd35d00", "comment": "Malware payload (Heodo)", "value": "5e1dcbb797ee61b2ec1bb7de3f3973771296bb23", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888582, "uuid": "ad8e4d56-d1c5-480b-a228-8dbc6ef2a00f", "comment": "Malware payload (Heodo)", "value": "4a28a7ca1826fe3c5b02bf73845bf141179fe3e6d45112ebd3197b76ce7020dfa96903677d112d8ccda35bc30e761b97", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888582, "uuid": "0b395939-4294-4820-bf16-793b4feec3b1", "value": "T1D554E007A2E940FBE9678278DC570B06D3B2B81257659B9F0371476A2F1B3A14D3EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888582, "uuid": "7e3b92bf-1ea0-498b-b701-42e3b015af80", "value": "8814d1a94d80f9b49a103ad2cb419460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888582, "uuid": "d787b143-0123-4eb1-ae87-1eec55226e46", "value": "6144:yRjSsk3AzLPQW/gbZJpDphv4MOTRqhTAK3yUil5FCsCfHG72:ojVhTQWoblv4RqFAKiNL4tm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652888582, "uuid": "43bb93d3-bd1b-4f14-a0da-707afd76dd46", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652888582, "uuid": "7eb48610-303a-48c5-9a00-1c9707aac614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888582, "uuid": "2040370d-1bdb-48ee-b411-66ef73bdbe29", "value": "2ec5e922312667823238941e5a08e10d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f597af-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909071, "uuid": "82ebb47c-a971-4d53-a94e-0d096508afaf", "comment": "Malware payload", "value": "827ff36f1bd39840a1eff1d2e002faa2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909071, "uuid": "aa8fdaf4-d288-4d14-af3f-556dd525e74b", "comment": "Malware payload", "value": "90c85a101bef3acd3a5947d5c22f4b880af7ec5b54aae807fe8558cd9c0c9537", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909071, "uuid": "26917627-dd86-4981-af12-edcac4bbee21", "comment": "Malware payload", "value": "8504fd6ac7455579c872c2dc951466cf3c11b1f9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909071, "uuid": "c6aef938-13c3-4e12-914c-ad45bfd39b38", "comment": "Malware payload", "value": "b7360d9fa251d2c1087d8559f60d521d299ecf1e562d05c912e84682b8f17bf9ff6491183633a66fcc08717bd6ad215e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909071, "uuid": "37772e69-ea87-40a8-9701-f16659796394", "value": "T1384185C9B31087357FF26EA6B1B4C514B680E06AAEC09E91D7ED74E98C4DF083460753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909071, "uuid": "b612adf1-061e-42d3-afeb-0b1e0cbc1c2f", "value": "24:vmOSZaIOS0TxkaUoOS5oOSXOSWjOS1OSBOSqOSAeOl:vmR1RgzR5oRXRsR1RBRqRFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909071, "uuid": "0409e0ce-780e-4314-a9cd-58e87bf01876", "value": 1913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909071, "uuid": "fca3495d-5ea9-40bb-8e92-4e0b369468cb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909071, "uuid": "c5e143bd-eb09-4281-8d93-188bede45197", "value": "90c85a101bef3acd3a5947d5c22f4b880af7ec5b54aae807fe8558cd9c0c9537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66742a6d-d6af-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652880936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880936, "uuid": "16b43d4b-db59-49fe-9036-ed91415564d3", "comment": "Malware payload", "value": "5e06d5a5fa390d3dabd7346ffc53385e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880936, "uuid": "d7461282-a107-487b-aac2-a72806ee7bac", "comment": "Malware payload", "value": "9146d1635d9550a72d70e5a1748b48e4edd325f8f715139fa871e26292299cb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880936, "uuid": "33e4f504-6dd4-4920-b498-3256a290e224", "comment": "Malware payload", "value": "8958478673c35f505794fc36eaf51362885a1b28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880936, "uuid": "20eba609-e266-4a0f-826c-9a9f97a1a813", "comment": "Malware payload", "value": "f5811b6e016a803fda81ccaaeca1ebdb27fd1256c0c06c485ed7102391c82009e2a3ff51ac4b9306bde74bb7b25d95f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880936, "uuid": "879f0110-0817-4ed2-83b6-e719d288fe2f", "value": "T1F6F4012922A8DE60E9A943FAD06206F407B16E17E511F74FCE947CD93D327C1831BA5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880936, "uuid": "47d81319-adb4-49c4-8c29-35cc802dd6e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880936, "uuid": "db3f88fc-920f-453e-a93f-25fe09d99107", "value": "12288:VezPaqDX19vlC6OLyWRPnEvV9ni/FynRj2ELyZiUnZiWn9lJ6L:wLaIltlC6OL/Si2j4ZhiCL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652880936, "uuid": "5af2446e-3723-4c96-98c5-c72670104141", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652880936, "uuid": "40a0679d-788b-4527-8ded-bb6576883742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880936, "uuid": "7f529f2b-837e-42e7-8785-0fae1f1e0551", "value": "SecuriteInfo.com.W32.AIDetectNet.01.11634.32493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbaff920-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909023, "uuid": "bab2409f-96b8-4397-ad5d-11dd814264c7", "comment": "Malware payload", "value": "c0248ec3a7230aabb0053485b99b407e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909023, "uuid": "6dcf8e01-ffb4-4d42-be7b-7db6baf5265c", "comment": "Malware payload", "value": "92111afb086b24b230e131976b0ade6ca0bc8b43e8fe94bfe08a33fb830e3aa6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909023, "uuid": "c5e71fa6-aeb7-49a8-94fe-35fb94b6b510", "comment": "Malware payload", "value": "0b87cd02ba2bac3d766f000168dcc08e899e657b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909023, "uuid": "24dfb21f-afd3-4bfd-847e-e9c1685feaf7", "comment": "Malware payload", "value": "6f3846ee7e43479e669878c505a2140812446698f28c579fc295a17993e89192da3b8e17f0cac74b5532660abccadf4e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909023, "uuid": "087f1e0d-6f2f-43ac-88a0-c20a07e17740", "value": "T1A2A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909023, "uuid": "a37313ae-6e26-497a-be5d-473d87a5c01f", "value": "96:WRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:WRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909023, "uuid": "7a9ee1c0-f8c4-4434-8855-ab0d7323e491", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909023, "uuid": "f2b4176a-891e-43b4-a1f8-47254baab86c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909023, "uuid": "fa1bd198-c17d-488e-aa77-7b5994beb92a", "value": "92111afb086b24b230e131976b0ade6ca0bc8b43e8fe94bfe08a33fb830e3aa6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf95c58-d688-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652864088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864088, "uuid": "928767da-5530-472e-826d-0e959aa0de7c", "comment": "Malware payload", "value": "eecc7a222fc6995211616ec97c097834", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864088, "uuid": "70ad945e-bd31-47ed-8857-70a54aea5754", "comment": "Malware payload", "value": "9280c6ff83d17d218cd4e45e9a7d231e8b90cf4eaaa8cf6575ec9e4b7810415f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864088, "uuid": "5db5df28-ab5f-43ff-aa12-3e1935089774", "comment": "Malware payload", "value": "28bdcdb7411b3e6af21ebcbef4d67e552aed80af", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864088, "uuid": "1fd29a4c-df96-41fb-a98e-e3b89ebf8f35", "comment": "Malware payload", "value": "09f5d0e3dc167ba7978c67ebf3061bb132e6543deab0f25098052a5ff2996e0d00b9999295f552a606b81517c017a323", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864088, "uuid": "11756f0f-67f5-4ca8-8266-5bb57294dc77", "value": "T1E151F11829EA6104F5F3EFB16EE87995CFA6F57378124D9E004243078942640FC92F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864088, "uuid": "6193548b-1a2e-49d3-b16f-e1d4d466b3fc", "value": "48:8mNgLV7a77vzXcx34gCViRdqlQBUosz98OqH24h4ab:8mcRaPzAylQsz9xy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652864088, "uuid": "ca9c52be-d297-4787-b40a-d80511e4d5db", "value": 2638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652864088, "uuid": "cabe2c05-6538-4d1c-81ce-8957933ea8ca", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864088, "uuid": "b3853b2c-813d-4644-a2b9-9220f5e3a767", "value": "MedWin.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d30b3d7-d653-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841273, "uuid": "ff8af945-4fec-44bb-854a-703d6de286a8", "comment": "Malware payload (Heodo)", "value": "558a04f8b1905dde7315bfb3c01dd052", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841273, "uuid": "906a97b4-ed13-4fdb-ba9e-b019eec40aaf", "comment": "Malware payload (Heodo)", "value": "92a1345238f414233474ce0b3c174515caaeb1d4ac375f7b4210efc401521050", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841273, "uuid": "4db5c6e8-015a-4b7a-835f-864789822c34", "comment": "Malware payload (Heodo)", "value": "d921cf97931e0c10087a2e4ef4b20e1ddc3f08e3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841273, "uuid": "b7e67b6d-ae14-4a0e-a6db-3fdce2a9b597", "comment": "Malware payload (Heodo)", "value": "67390f4b76874cd75559dd63e7cce2dbb22257418a9dcb86da4365461581c4012a08ddf7a068c18127e7f67d55e01431", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841273, "uuid": "38911123-638a-4402-85d5-ac5c0e4551a1", "value": "T1BBA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841273, "uuid": "4477b3a6-13d8-4795-b0a1-3b1286830bc6", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841273, "uuid": "fa50c396-6126-42e0-a7c9-9fda7abdd8ce", "value": "12288:uS4BnAed8BK2o0aIa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKba34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841273, "uuid": "c1753d39-fce3-48bb-be78-3b3904c211e9", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841273, "uuid": "235fcdeb-2742-4758-b189-321d6184b35e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841273, "uuid": "8baef204-f9ac-414f-be76-03ab5f227216", "value": "558a04f8b1905dde7315bfb3c01dd052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d607d1-d690-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652867515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867515, "uuid": "af21e71a-9ada-4ae6-8c5d-53c4e6b15305", "comment": "Malware payload (Heodo)", "value": "a5c07f46d7c39f70d4dfa8735241d4f0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867515, "uuid": "55d1c579-5d72-4c08-a0c2-f05de587dc5e", "comment": "Malware payload (Heodo)", "value": "92bc1245ac1cbe43e76822e873c8a6586b8c3ef0441137409d0b9670ea27c0ac", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867515, "uuid": "b909052e-d8ba-40f1-8478-b0396b478ece", "comment": "Malware payload (Heodo)", "value": "0ee3f9d71d05fb05ac6da4862b8390a4e034c029", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867515, "uuid": "264a8588-07e4-4664-8b7b-d827878a76fa", "comment": "Malware payload (Heodo)", "value": "ec1271327b40295c4b7c7fdafe0667665fa13c843302cd565b79d0c63afb915096a2e2d85f8a448e11d6ac345b18a93c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867515, "uuid": "51477eaa-7991-413e-a07f-5cf63ea7c00d", "value": "T16694CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867515, "uuid": "641842de-9925-448b-903f-660e00d35a27", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867515, "uuid": "23712a8a-753d-4828-b0ab-fa09b10ffbf3", "value": "12288:43hV6Pw4aT23Guobv91Wuwf07EIvH3+38+:sb6Pw4R3GuoWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652867515, "uuid": "3772657f-5892-470b-bad5-6b4bad7b879d", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652867515, "uuid": "fe0fa0fd-0282-4d1e-b06b-f773d6cba876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867515, "uuid": "01b75be3-d4cb-4c05-b710-64f05d7dd8bb", "value": "a5c07f46d7c39f70d4dfa8735241d4f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc8154c-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908973, "uuid": "35d52da8-fc43-4fbc-a9a3-5cb7f58bdbe8", "comment": "Malware payload", "value": "75a21d9fe76a7f58a46cbffff0e2503a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908973, "uuid": "8444f7f4-1e50-41e3-aead-7f1a9436360b", "comment": "Malware payload", "value": "92d1ce7b5845454132cf413e749a7fc0c573d36641429812f99344fd7b850e15", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908973, "uuid": "fb272b5a-627a-41e5-aa66-545873b84a97", "comment": "Malware payload", "value": "67c8cae288caa72ce83f3769646cb2fcb758cea3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908973, "uuid": "7be26740-30f5-4e46-a4e5-39efdedf5ce4", "comment": "Malware payload", "value": "5847b919a9c8cb538e91f69894784deab45a6ca6908f7aec7205be442d23b65626d89d30867eb6261d7c73d8cf27c074", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908973, "uuid": "5ae56db6-0c22-41a1-9b9c-1027da6e63d0", "value": "T17AA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908973, "uuid": "4b6196d7-b1e1-4e21-a56c-9d877a9c6d54", "value": "96:9RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:9RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908973, "uuid": "d2810386-149c-492a-9c11-8bd47466baf2", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908973, "uuid": "3446a885-4222-4c11-a886-0a23e8896e8c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908973, "uuid": "c495bf64-30f7-44de-8d43-ba5567459796", "value": "92d1ce7b5845454132cf413e749a7fc0c573d36641429812f99344fd7b850e15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c712ef2a-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909016, "uuid": "0fb491b3-bddb-4620-9a48-cf9ac32ee575", "comment": "Malware payload", "value": "e242c8de8727c346d2c3e814b9136919", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909016, "uuid": "6d0b4b88-6180-42c9-8f92-501f91f6c48c", "comment": "Malware payload", "value": "92f90fa4382864a727b05cd257d3b09afeee54698e2bcbc81b752886433c2bd0", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909016, "uuid": "6b4badee-2b70-44b8-bb2e-5b58f96f388a", "comment": "Malware payload", "value": "c68e52f0db3b4e92ed887de37534c67be7a43b9b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909016, "uuid": "9f529016-563f-4808-91ed-5ac9fd01b02b", "comment": "Malware payload", "value": "10c62e18b1b52deebfa7a215d23a2779498116d0e31df229c5da89730deec551f127da2592012ed4174a6ad836a511f7", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909016, "uuid": "57a92d86-101a-4fea-b848-a93b01c50e31", "value": "T18DA533016AC007C9E594DD172F8C9936147AEBC63874F9D353E2DAE2204EFC5E9A3978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909016, "uuid": "a2e0f3e0-0000-4ac4-9db8-0911f9c01ca2", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeSL:G1wwAjzIQOMK2GNKslgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909016, "uuid": "37b7be46-6ee2-4d9f-81b8-16cdad4cf305", "value": 2179072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909016, "uuid": "a5c5c5e8-dc81-43d2-ab99-5cf8d6c855af", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909016, "uuid": "4a020991-aaae-40bd-a0af-f5f23c20f33d", "value": "92f90fa4382864a727b05cd257d3b09afeee54698e2bcbc81b752886433c2bd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0e3c45-d656-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652842590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842590, "uuid": "e88d8815-47ee-4f5f-abe8-011b9110a9a1", "comment": "Malware payload (Heodo)", "value": "212f477b2291000b66e492f9c116c6a4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842590, "uuid": "71422574-5715-444d-bf84-3be1a646b9b7", "comment": "Malware payload (Heodo)", "value": "93f3eea132da5e25372ce48f1bd21e27da74340f77db63354d1c6833c794aa28", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842590, "uuid": "220aff91-dd2b-4fe8-9283-243e703f200b", "comment": "Malware payload (Heodo)", "value": "5968ad6a1a7be49c99a93fda02c8e9e0e2fac012", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842590, "uuid": "aa886bee-f186-4aa7-85e8-123b719c280a", "comment": "Malware payload (Heodo)", "value": "bdf6ba6167807ab36205a1cc233e63805b2b3880becc1614e0c0d532eed51ee61f304b67f60fc6d9f959c26830ee1719", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842590, "uuid": "bf0172d8-c813-4b84-be08-86d9f2df356b", "value": "T1AEA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842590, "uuid": "fb29b4ff-0c6a-49a7-a59a-afe0ca86b0d1", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842590, "uuid": "4a354437-9bd0-40e7-9a62-208afc37060a", "value": "12288:uS4BnAed8BK2o0aCa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKRa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652842590, "uuid": "1aa1338e-81a2-4d91-81e7-0fcf06e9adf4", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652842590, "uuid": "b9aab6ad-15f3-4638-830d-b3daac4a1def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842590, "uuid": "0b7ce38a-8764-457c-a76a-8d3a3052d0d9", "value": "212f477b2291000b66e492f9c116c6a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f890415a-d6c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1652891489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891489, "uuid": "6111856f-f60c-4be1-aaf9-bb140a2b953e", "comment": "Malware payload (AZORult)", "value": "3ba388cdf2e1ee661d5339bc1c7e0ef6", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891489, "uuid": "f486a78b-cd48-47a1-8438-0f5e9b202d9b", "comment": "Malware payload (AZORult)", "value": "9466caa2cf60fdc7ed95a3eb5e5165b1527ca9352195caa355c58099e519e616", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891489, "uuid": "269d0f1a-8bce-44ba-9167-70db1fdb16fd", "comment": "Malware payload (AZORult)", "value": "516f99e2c29836b8092a6a33ad90dfec3c528879", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891489, "uuid": "9337c0c2-5bbf-4a4b-b93b-caf4f98e3bea", "comment": "Malware payload (AZORult)", "value": "130c236ae149f2f6a69c19d76f14d0915b1e5c7faf8f1b5241a7dee78d3d56140e485e9f61b28cd5368af72f82495902", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891489, "uuid": "3759c900-0c91-4d97-80df-d338659a8b5f", "value": "T146763302FDA059B3D9250D31016DA265D5BE7EE01F6A8F4BBB54894C9E701E0CB38BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891489, "uuid": "127fad45-cc5e-46cb-b96f-f8930d0e97c9", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891489, "uuid": "a2b7f7e5-bd06-431f-a025-3633fb0cd4df", "value": "196608:rQATbv8oN+IY6a9ahXCVNjo3+8NIsZq+BMFoQxF7:rQw72HvaQ/E3DI2QxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652891489, "uuid": "6ec7a124-b0d9-4d4e-ab0a-79a05f62b549", "value": 7215664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652891489, "uuid": "4e6940f9-f556-4c67-9d4b-cedf6b52f14a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891489, "uuid": "352d1798-10e5-42c0-9cc4-aced83ffa498", "value": "3ba388cdf2e1ee661d5339bc1c7e0ef6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ab936f-d6c0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652888483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888483, "uuid": "174a2cbc-b445-4ee7-a63c-d528b9653ea3", "comment": "Malware payload", "value": "090cc79d6103e927525a2d04f7842754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888483, "uuid": "b1c6547e-0b95-46d5-b762-8ab2b15f8836", "comment": "Malware payload", "value": "94d7fce6ecf653656840a9a99c029cde847b02ac3e69ac45d3d53c9c80432621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888483, "uuid": "eb881109-eb39-4ce6-a129-74209b4115b7", "comment": "Malware payload", "value": "93f5bb082b78ca4b9f01c836a8ea16fadfd8fe2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888483, "uuid": "c09d48a5-3ec5-4339-9597-52ad2f7c639e", "comment": "Malware payload", "value": "622c8d46020a8ce3d17571f1411674fa3c766ebe485d4e87be6e92f59018ef228984c47903dd91709f3b1e8aac5526d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888483, "uuid": "4bd4c36e-ed64-43b1-8ff0-8b86987abd6c", "value": "T11491608F59501EB2D10FD2FD2903884C825B40524B7042F78D6A4C8C6EFA7DBBA7155D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888483, "uuid": "5b4cec1d-45fe-4f41-9215-5826f59bfbc0", "value": "cfcbd25ddafc9f2da1969effc63f90d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888483, "uuid": "a31c6429-3718-492e-aab0-6366ce2ac173", "value": "48:vpgTAH3olQsnWl0Ff3frVQ56VbC956VbCkblIew1r1lpCgyx:B9H3oqmFvju6VG36VGkblRwPjCgyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652888483, "uuid": "2780524d-d0cd-47e3-919d-a2717cacdb86", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652888483, "uuid": "4e3a0da3-907c-4a6f-96a2-a0dd052738ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888483, "uuid": "b4aa5bad-efe3-40bd-bf5e-77ccb9c9b499", "value": "SecuriteInfo.com.Trojan.GenericKDZ.87784.11660.17705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d736c54-d688-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652864090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864090, "uuid": "4d468409-c9d4-4353-a0ab-2450612f78dc", "comment": "Malware payload", "value": "c968e043d5e614a8651d72c18dfcdcff", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864090, "uuid": "83a18592-725e-4149-a545-c82deee70048", "comment": "Malware payload", "value": "955d985837d168cb7e06ac8d499932dac6cdb7f69f69d9d4ee41fb20d439203f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864090, "uuid": "13d185be-4992-4472-9067-f91fdaf3ea09", "comment": "Malware payload", "value": "0c54d888acc5f7b6ba853302060090360488cfe9", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864090, "uuid": "d70450f7-277f-4ead-abec-8d2ffad4545e", "comment": "Malware payload", "value": "2ae5583110bd39a597ca1db89e3030aec78425f0c21b4bbe92eff4a94d5304655b8f47c1a823a8ff1e91642f3eed11af", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864090, "uuid": "38281a74-957e-4233-8cc3-d16ae32cbfaa", "value": "T19A518F387DE91128F1F3EF71BCDD76D6CEAAB5A3B9514D8D008103494811A40ED92E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864090, "uuid": "37f2e1c5-d41b-49c0-b44b-ef7d6b39611f", "value": "48:8mUgd54ILCXbo51B6GfU47VBB8HQ3mI2qfcIEAeNC4ab:8mg3M5vf77VBGpZrI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652864090, "uuid": "7ef6aed0-f706-4600-b04f-50a5ce5848f4", "value": 2626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652864090, "uuid": "a1f6db68-8097-4a89-93aa-b4cf0f0c9eb5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864090, "uuid": "73fe9f67-09d9-43ae-80ec-eaa40b8f7588", "value": "ommegaonline.org.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9a580f-d67a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652858430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858430, "uuid": "a5168eca-6430-4747-8136-c1f00e757fd2", "comment": "Malware payload (Formbook)", "value": "6541b74581e139a19b8b7304740714a4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858430, "uuid": "7647d04c-b422-4ca1-981a-36ae829bb024", "comment": "Malware payload (Formbook)", "value": "957c73e0b2de1d003edccb395392eebdb9d9e644fa24a92051e42b6ad050de03", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858430, "uuid": "518f5960-bec3-458b-a7e4-70a0dea60cb4", "comment": "Malware payload (Formbook)", "value": "c9e2938dacb1bf061f52142382add9292c7a3819", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858430, "uuid": "3d2abdd4-7e63-4124-a606-58cb9ab91677", "comment": "Malware payload (Formbook)", "value": "3840b38b2f749f0e343704614743ecc28219bf2619dd9f57eec08cf3de9aae2e088190550c0d63b5c7ad1788d04ab172", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858430, "uuid": "b68fa6f8-8a45-4309-9c08-ed43ef24d892", "value": "T1E1142320BE817EDF5DFBAED1E31CC1A15092DCC2EEE9CB42317A386D463E364251516A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858430, "uuid": "ea5cda1f-b963-4230-ab6a-a4e7229f897d", "value": "6144:2crPyCZ6ldH+17jB4s232C1kI3wayK5eYeR4SYS7s:lPwldH+B6s232CGpf4eYeTYYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858430, "uuid": "efd3ecba-f160-4d11-a7c2-365c6ff55c01", "value": 198022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858430, "uuid": "f87c0d23-4cc2-4e98-9767-818a10e948e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858430, "uuid": "680d4df3-b40f-41b1-97fd-9be9dc874601", "value": "SOA 58097213.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af934da-d6a6-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1652876944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876944, "uuid": "10c723ea-2676-42e7-a369-566333b39ed5", "comment": "Malware payload (CoinMiner)", "value": "754e0e0ec46423f236a49b8eb26392c7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876944, "uuid": "be6b935c-a7d2-4688-9b9c-c69236b06f93", "comment": "Malware payload (CoinMiner)", "value": "9615c75e7d76b72791b269a588dcfb657e745d945e3f6ce8f5eb8e125b32e9e5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876944, "uuid": "625e9e31-e055-4203-bb68-f2101f7832d4", "comment": "Malware payload (CoinMiner)", "value": "47252528ad7a9fea977b4bc8cc3c9884e17d5a14", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876944, "uuid": "78665918-09d2-439e-ba4c-dddc15ec5e4d", "comment": "Malware payload (CoinMiner)", "value": "20e1626181abbd113009191b642cf469054d8119d091c586c11db71e22258974b3dc1132cc8f37fea89d564864ec8c11", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876944, "uuid": "53b705ea-e944-4671-8990-ee354f85ff38", "value": "T197C63352A19C8C29FB59723F1A2C46879FB2B620D8104D7BA3EB3E707EB7E424754075", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876944, "uuid": "e3651567-8d29-4cc1-b1c0-b7f73d8fafdf", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876944, "uuid": "40ed3a61-510e-4575-a7ab-7442ca25a83e", "value": "196608:RZ/2c9rPJqJti/Tm4c+JRuzWNojCFeM0ptbNIrp/gy:RZu8AJtibcKuzNCD0pRNIrpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652876944, "uuid": "4bb13207-b68d-4a43-9b87-486d9e2d6dd8", "value": 12594688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652876944, "uuid": "860f51e9-2a8f-47a7-81aa-1283bfa553ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876944, "uuid": "2109dc06-55c8-4db0-840d-60f74284ac20", "value": "AuroraFree.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fc36a6-d658-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652843700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843700, "uuid": "67bee6bb-a828-4f29-836b-984cf8f56255", "comment": "Malware payload (Heodo)", "value": "4f0564b3d9af9a3261700f8f3cf10ee3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843700, "uuid": "29f60733-7ee4-41c9-97df-9c442eb71df6", "comment": "Malware payload (Heodo)", "value": "9652f8e07782d9da88d7ae84e1ee627c1ec2bdcae818b8d134cc8169daca6e81", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843700, "uuid": "cefb8a0b-cb00-4eb6-a0b1-715ac0a382ae", "comment": "Malware payload (Heodo)", "value": "d90a9bf83f0a40ae3b11cf7127962cd737b6e2b1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843700, "uuid": "e703441b-62b2-4238-868f-40a5001bfb88", "comment": "Malware payload (Heodo)", "value": "bc0c59974d305eb970d29c01fea7ef43a700985bf9bbcb0fe2c95e7be09e07b8fad647f7a0e8f8b99c45b1b75d2ac8db", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843700, "uuid": "a51cbc1c-9d19-468b-a902-031c1569bdb1", "value": "T1D494CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843700, "uuid": "67d95649-659f-4c91-9385-b715dae203a3", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843700, "uuid": "eed550f4-42ab-4ddb-93ce-9ab5aa0ae2b3", "value": "12288:M3hV6Pw4aT23s2oFd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ii3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652843700, "uuid": "466c123d-1fbb-4c5d-a3cd-0fef33f21cec", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652843700, "uuid": "a9c18687-730b-463d-8648-2bd9afce9a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843700, "uuid": "b44b7eeb-82a7-4653-861e-ece73f751945", "value": "4f0564b3d9af9a3261700f8f3cf10ee3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a79bae-d6ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652906463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906463, "uuid": "beb2b563-4a20-4f62-b65b-746b73ba555a", "comment": "Malware payload", "value": "df5544d134ede2707bce9686164bd2ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906463, "uuid": "fc93f9c4-5233-4cc7-8ea2-990c4825f78e", "comment": "Malware payload", "value": "96d1c39203f69048746dc216218f5e3edcde0d0422483486496d01a24dd3bdbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906463, "uuid": "8cf99139-0c71-47e8-856d-153e034154d2", "comment": "Malware payload", "value": "8bc5f42573104ed98ba60746a850275d18348c7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906463, "uuid": "65a4d4c2-dfdb-4744-842a-2fab6efe95eb", "comment": "Malware payload", "value": "84f6c9b1e24049e01346bc9f3bc37c9125fbabf15111c7fbd981292e72531dc9ac37f0aff511ad44a851b7aac3d116ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906463, "uuid": "bc19512e-8b6f-48b9-b08f-a96518a0ea0d", "value": "T140C46E2C3B455EA2FF0F997448410B34BBA6BF537280AA8397DB15CB8B5F1676D05C88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906463, "uuid": "724d0c31-c4ba-4709-b916-32f04397e514", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906463, "uuid": "aae10468-62e8-4f3c-b803-ac0e48f23c5c", "value": "6144:z6p2pX4TStsnTrjSxFSzY2OkKnCq2qAKJbWNyAZikgANvoVJVH:zJoTjQSH3KIVZi+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652906463, "uuid": "632e5af9-92d6-4031-af8a-1346ecc059e0", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652906463, "uuid": "32f90568-6436-4eea-af99-cf48d4d4fbac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906463, "uuid": "49aca567-d8be-4782-9c96-6ad2c30d27ab", "value": "SecuriteInfo.com.W32.AIDetectNet.01.19177.15483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a5f684-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909020, "uuid": "c65d22ff-2306-4de1-818a-0f35de11c38a", "comment": "Malware payload", "value": "79353e64acdd8febda1f5cb1b33cf1b4", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909020, "uuid": "3c9a6e97-cea9-4a64-a433-3d650325cdaf", "comment": "Malware payload", "value": "97b9aadb8fc0e0d0686d10d12712dea53eb2c373f102d91b949ec82d4155e709", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909020, "uuid": "3f5d136e-bf83-4fdc-b862-f77146cd0c3a", "comment": "Malware payload", "value": "164bd0df6dd2f84c7f63290c081792aa132e6c55", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909020, "uuid": "4513fa8e-00c1-429b-9123-8c68b3fd2aa6", "comment": "Malware payload", "value": "dc041ef130d0445d0135e95318b3216595329ba3f8bfb100de0541ac4873fa08c862214579ad2833f8ab356ef50c12a2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909020, "uuid": "5d63539d-a8e5-42ba-bac7-98d865f0c647", "value": "T14FA533229D3BB5C7847A0514A45397B396B1BEDC1816F409F3BAEACC15CA4F6B0C2D72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909020, "uuid": "26d35a12-2f61-48cf-b848-03ec63741624", "value": "49152:DJMych6OZaIU6M9yZ29jsE4dKi4qi7/RhQrM+mvsx562dQ10LIKR7aq:DJmAJI9M9yZqQEmKlqi7REM+mvb2TEKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909020, "uuid": "026be4e0-8362-456a-9991-2e7f5ddd22c2", "value": 2265088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909020, "uuid": "e8e99a35-f7b7-4266-8518-766362823779", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909020, "uuid": "f0b7f800-d9cf-423f-9a82-2854d3040b5a", "value": "97b9aadb8fc0e0d0686d10d12712dea53eb2c373f102d91b949ec82d4155e709", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6616c04-d6ea-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652906464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906464, "uuid": "06233dd1-9a08-45e3-9fa8-a677ce066933", "comment": "Malware payload (Formbook)", "value": "459727c330075b66dfa34dec2104e6d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906464, "uuid": "7c621130-aadf-48f7-b225-1e215326c410", "comment": "Malware payload (Formbook)", "value": "987f9a62a75e9bfd9f6a89902c1b0b5fae877dea74f04511ea7c89d5a14859ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906464, "uuid": "154c3314-4faa-48ee-ba8a-1725ff67ea5c", "comment": "Malware payload (Formbook)", "value": "411234fdddf66df340605dec43eb935e4e543353", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652906464, "uuid": "54c7bc6c-a0b9-4547-ab41-7905099ff4c7", "comment": "Malware payload (Formbook)", "value": "dcb4d7caaf2cb354cecfc4cb3bca4f30c77843f4caa5389c74fe5ea02eeed2b2a6243b27fcc336fcd7ce1fe6039306ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906464, "uuid": "74e87a90-f813-46d5-8171-d7b43ef50453", "value": "T1EB45592D3EB18588C738B8F58EC127A8D1B05D9E83595F022EBF395A35324A3CDE255D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906464, "uuid": "01167ecb-df8a-40bd-8048-c8b18dfbca87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906464, "uuid": "e95387b2-7f9f-499d-84c0-7fe441c80661", "value": "24576:cc2O+WGKbim8dnaj9l90d0FmdmW45dv+:v5xPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652906464, "uuid": "2d6c0ed5-982e-4c72-9cd0-1fd7d7c6caf9", "value": 1182208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652906464, "uuid": "01a5e9d7-53a9-411d-8fdf-63caecf7ebaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652906464, "uuid": "57d7521a-fa62-413c-a8e5-41760bb25d68", "value": "SecuriteInfo.com.Variant.Strictor.270431.29794.27338", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c3afe4-d64b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652837876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837876, "uuid": "a1402523-e058-4e1a-98ce-4632d34b5876", "comment": "Malware payload (Heodo)", "value": "8a7699dde505d9ef24735f4bfc0ab1fc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837876, "uuid": "6fc7f2f0-b193-4108-863c-1360606d2b30", "comment": "Malware payload (Heodo)", "value": "98b96fe033cf93bcbfc657991a706569f7b621567820076889bac4c33aa3e1c0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837876, "uuid": "adeabac4-ebd4-43ee-b974-69fd7b7defe3", "comment": "Malware payload (Heodo)", "value": "53d625dcf3a4c6674ff77b5ceb2661e908418d2d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837876, "uuid": "232f5b0e-986b-4956-bcdb-a956a1e7deca", "comment": "Malware payload (Heodo)", "value": "2595354a1cbf31b787d58b333e9d4eb99cc0bfe4f339f09a219ff5076c8bfae5c08d8d7c54814c9d7b9f1934dd75d16e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837876, "uuid": "92861168-8406-4d35-9620-6ce56ed9d769", "value": "T16094CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837876, "uuid": "eb5cfd44-abde-4247-accf-a7de5f419047", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837876, "uuid": "4ecfd7cb-eea0-4230-9dda-f398a05eca2f", "value": "12288:M3hV6Pw4aT23s2oZd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ei3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837876, "uuid": "a4373119-9fa2-4fc6-80d1-a639f3f7626f", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837876, "uuid": "442c3b46-5cdc-486f-b655-9ee73900457e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837876, "uuid": "aad371a6-0e23-40ac-93f1-a58c27750bd5", "value": "8a7699dde505d9ef24735f4bfc0ab1fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbfa38f-d698-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652871181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871181, "uuid": "21166b85-08ed-4ce9-9a21-67ddd144c665", "comment": "Malware payload (Formbook)", "value": "9334f045a8de0436a7080b6620c66741", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871181, "uuid": "08589bf9-d0e2-42f2-b29c-8f29a34e51f8", "comment": "Malware payload (Formbook)", "value": "9997ae9723bd215339367807584c52f6e7c99910d5d155f10294b7a8ac55ba1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871181, "uuid": "deb48f37-a808-4e9f-842c-3d6c76af3efc", "comment": "Malware payload (Formbook)", "value": "e6de012d95788220ab1c50dc9d1a5cd48234d18a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871181, "uuid": "fa5fa8ef-6ef2-4a1d-a4fc-d230a26ffca8", "comment": "Malware payload (Formbook)", "value": "76fed4fb488d5ee45d25ac30fa40d1439c2f1e5fa461ce287c6d5e72d6f2da418ca976794cc97ecd911a9467f5e752dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871181, "uuid": "0a7c50fa-c0e2-428e-97e4-66593f3244c9", "value": "T11715BE5D3A50F99FC51B8E36C8640DA0A760AC669707D307A44739ACAD3E7DBDE102B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871181, "uuid": "a588bef8-d5ee-49d7-8964-33c63c0dd3ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871181, "uuid": "5753de83-f099-4af8-b42b-99ed1800fc22", "value": "12288:/ub9bD11zxwzLXSJ5Mr+fea1jL9/6MWCOAKIhwwJ68Wk1EXsfQEd3LLc+kCbU6bo:/w1gXgYRa1f9/6KwwfAsN3nc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652871181, "uuid": "3cbcfc71-3d5e-4af2-8c03-c5470d8498bb", "value": 908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652871181, "uuid": "634c31ab-3ebe-4f4d-8b5f-ca21c412942c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871181, "uuid": "dd8e5153-93eb-4731-b0a6-11476fb86eb6", "value": "ORDINE 56432_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eeca3ed-d6e1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652902345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902345, "uuid": "ffefcd7c-9c80-4cea-aca1-e360de5c2f13", "comment": "Malware payload", "value": "8984688802cdb61919e5534390eaf8c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902345, "uuid": "074aa718-9514-4a49-95be-95b061aec893", "comment": "Malware payload", "value": "999e76a94bd7398d378e694457723ee08bf14a7801120c5755961ca5deda053f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902345, "uuid": "eac5f44f-6902-4214-a515-53e0da83472c", "comment": "Malware payload", "value": "24e8dfe48a4cf137dbc66d4720be7bbb3525daed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902345, "uuid": "60e46ee5-1cdb-4e60-b745-e71b3751f1ce", "comment": "Malware payload", "value": "279c6585e80ff3d687bc623432f81ef4ed97453cd4860806d8ef90f526ce73cc72c3bb1103639c1c717c0372598fdcfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902345, "uuid": "456e9919-65fc-4c97-84f4-7b268d60be4e", "value": "T10305273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902345, "uuid": "dd5031d7-2996-4031-85bb-8e9adf9d210f", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902345, "uuid": "68a43e74-ebdf-461b-b9c5-ae0c348d2d9c", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oFaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy79Ust", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652902345, "uuid": "56ab96b4-659d-46b8-9998-b4767e9c3459", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652902345, "uuid": "45f48a9d-cb9b-48b8-a094-cf8611ac45b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902345, "uuid": "b657380e-fb4e-4ecc-8a60-544a587e64e5", "value": "8984688802cdb61919e5534390eaf8c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf6fa47-d694-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652869594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869594, "uuid": "f0017035-ca84-434d-a4c0-6b9a66cc0128", "comment": "Malware payload (RedLineStealer)", "value": "af7391e25706a2d8eefa5d60c15fc752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869594, "uuid": "188ca628-bee0-42bf-8687-d6e65f716184", "comment": "Malware payload (RedLineStealer)", "value": "99b0b69656c3fd1bc3f71d0241bbb90d7667380d3b6a125bd4fb41a4d7910093", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869594, "uuid": "560f5701-63a5-4cf3-aecf-cc8deb445073", "comment": "Malware payload (RedLineStealer)", "value": "54a6c98bf8f987a7ec33b0a938f63d8871e7945c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869594, "uuid": "4badf6e8-c241-4e48-ace2-9e4ee57cc3ce", "comment": "Malware payload (RedLineStealer)", "value": "333b78f76def6647961ee580adffe2bd4bee8113dad841904960cd18c0a079c907e905996a1a75480cfedc0433490a6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869594, "uuid": "44bb0b7b-4fa2-4c0c-9aeb-8d887dfc03e8", "value": "T199C5332074406703D49B833B45EBE9B82B677B4520EC29AB93F1C5B2972EF54B716C1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869594, "uuid": "1267dc5f-fb01-4873-96a6-fce82d12c6f2", "value": "628925b48660ed26c2cabb5f5325b82b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869594, "uuid": "b638c6ca-e8d5-4fc2-9398-1ffd8601f3b8", "value": "49152:ok5ORXdhPhr95wicxTme8q83+EzQh/VA827Ujm2i+Tm8Awzb7vMrYY2o57Ux1P:ok5ORXdhPhr90lmeJM+EzQA8CUBFTmpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652869594, "uuid": "418dc868-9eba-48f5-83bd-8d7a97d3d56a", "value": 2518928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652869594, "uuid": "d559e4a2-3928-449d-a8ca-8a39685785ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869594, "uuid": "d32c90cf-82f3-467f-875a-32088d60d547", "value": "file1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fade8fcf-d690-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652867871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867871, "uuid": "4f06494b-704b-4bb5-8c78-61a55a8e7e2b", "comment": "Malware payload (Mirai)", "value": "ddd1e301d1bc45e7ec09d7c255b7a635", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867871, "uuid": "32cb73dc-8e14-4e00-8b2f-72a1358398f3", "comment": "Malware payload (Mirai)", "value": "99dbdca0e192e439cd0163f8b5eef4472a810510b182eb8c29d20d91c4750c09", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867871, "uuid": "4ed4e52c-1a55-4641-aeed-260845a26c37", "comment": "Malware payload (Mirai)", "value": "a18c72de52c56a3fd111645d2ea86dde89f9e9cb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867871, "uuid": "51250e0d-c442-41b1-a670-2b451813a5a0", "comment": "Malware payload (Mirai)", "value": "dcbe6a4395216ebc4a7ce0f9731288109ded99634ec6bfe69a4d9d78ba957d34a29fd340479b3c311a4932239a17d77a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867871, "uuid": "42349274-2a71-45b4-a2f0-6bda08239b6e", "value": "T1B8130101D06EFAB0D2F9117B9ABB9489B7C757BDF29C5491B081C0E87608C8A47F61CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867871, "uuid": "1b287b79-ae27-4621-af4e-5eb4eb467749", "value": "768:b4J52cJQzXPs6J+/QszjKaoUhIUklMdKUGXz09+rA9P6JlMQkcn1cEs3Uoza:ZcJ0EO+4sPKfUldKnXz09tP6J6Rauza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652867871, "uuid": "c3095ee0-033f-4edd-8216-3e0eb4ff2fb2", "value": 44008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652867871, "uuid": "39cb98d0-db2b-48c2-909f-f2c3f916c9d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867871, "uuid": "8dab1ae9-4895-41f9-82fe-2982145c9eec", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d22205a-d6e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652902932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902932, "uuid": "31aa82f4-e727-4788-8f4e-862eaa089ec6", "comment": "Malware payload", "value": "5a3fe4e47ce96e798e459de100e07a4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902932, "uuid": "fb6c2267-1142-4ecb-9ed5-eea22cf10a5f", "comment": "Malware payload", "value": "99fa16d84daa0bd2e94e7cc337bee54b4e423a226509404cd8fccc6817046c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902932, "uuid": "bd9d05f0-f378-4713-8691-b042cab27c4a", "comment": "Malware payload", "value": "791a39d026213076ac60d50d34f5dfe37cda8880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902932, "uuid": "47098207-dc42-4bf4-b5c2-573cb2f4be76", "comment": "Malware payload", "value": "0b6a5e6caa3b4dc4e37b0b0a7b4b07a72e9b05ffd985baca4fbc029391c156d23e86445fa22c66dcb03e69eada2f94a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902932, "uuid": "3aa6f505-c516-41d0-b505-d7145ef76f0f", "value": "T18605283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902932, "uuid": "bc296698-afa5-431b-b95f-4d258418f93a", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902932, "uuid": "3ce39008-8aac-4b4f-be8b-3c085374a914", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7RmpE3:BTg9UXRD2SeqfZZilm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652902932, "uuid": "b166234b-e86d-4608-a805-6d5f0afe2edb", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652902932, "uuid": "d247810a-8bd0-4c21-b8ad-a7c241b7e7cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902932, "uuid": "4c8a959b-9916-44a2-97a5-71fdfc9bc57b", "value": "5a3fe4e47ce96e798e459de100e07a4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ae898a-d6fc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652913904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913904, "uuid": "cc6e79e8-27a4-4da7-90f8-aa71e63bba10", "comment": "Malware payload", "value": "72989b08b064a1d49fd220f5e04409dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913904, "uuid": "d76bbc40-041d-47aa-9299-f83f41dab6b1", "comment": "Malware payload", "value": "9a10bba54a9549b461feec64be0eb7297ead41982d43699c4bf0c7e20106ae78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913904, "uuid": "6091c541-262f-4998-a1bb-59407037c548", "comment": "Malware payload", "value": "31eb1135648cdaa2194286fa7858d57864123b8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913904, "uuid": "a3e55ddd-f63c-4d9f-bca0-db8e6f03d13f", "comment": "Malware payload", "value": "8e761fc827b681409d7571aab41c2f8fa860724449fb68f5b94ae14bccac807d4531e10a6b733a42ea81d3a38cabb552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913904, "uuid": "8be7ce8c-ff31-4f29-b224-b6d15a4868a1", "value": "T1CB05273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913904, "uuid": "193503c7-aee8-45e3-9808-2544bff2a19a", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913904, "uuid": "e5371d2a-aa5a-4086-aad7-a867d2e68a3e", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7o9aIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7FUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652913904, "uuid": "6a9e20a2-43f3-4e6b-b419-a81859edc09d", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652913904, "uuid": "c3b6303e-30f5-4a66-baf5-692ea3d4e826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913904, "uuid": "8c6411e8-11ac-4b16-8192-6048761823ae", "value": "72989b08b064a1d49fd220f5e04409dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babaa00b-d6d0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652895251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652895251, "uuid": "b296ca21-ea9d-402e-a74c-213b2447ec56", "comment": "Malware payload (Mirai)", "value": "c1fb15087cc63b91872a9b5b0e13b0c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652895251, "uuid": "eb741a9a-d2a1-4b5f-bd15-e01f547143b3", "comment": "Malware payload (Mirai)", "value": "9a591a89dfde897f66d4025cd0f0fc3cebc38b02e09dde2ac57360b2dd8d3e93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652895251, "uuid": "1a6b5051-dcf3-4731-916c-4e3745144ca9", "comment": "Malware payload (Mirai)", "value": "2cb423f07a0d7231ed7fbb696c98af9ec5deac38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652895251, "uuid": "14366cd1-f9f8-4a81-aaac-77758f97c4c2", "comment": "Malware payload (Mirai)", "value": "e8ea5bd58fd1e37578d0ccbbad446df4663da73d9cf0d45d2d98cc049d32c2bfc9249710d506ecdb6bfbdc65b37008ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652895251, "uuid": "f1ae7b48-4dc8-4cca-acb8-3053272b9f85", "value": "T122734DD5F4024E3CF98BD6BD54160E05BD2063D967970F2BA6AAFCE36C73154BA02E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652895251, "uuid": "e18df40f-cf78-4b1f-a868-ccf5143c4b24", "value": "768:kecpzykJYFi123gx60bW4DilBjXsF9AB7Xum8ohklg3sjorTNc1TK9yfp:k+G23gxq4824+m8ohXsjorRc1eAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652895251, "uuid": "7b595ab9-f9dc-4078-a528-a71fae5f878a", "value": 75924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652895251, "uuid": "e6ff6e44-beac-45c0-8145-ea447db209bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652895251, "uuid": "14f7e3ab-7652-4617-a94d-1858a82de031", "value": "c1fb15087cc63b91872a9b5b0e13b0c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b83eece-d654-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841941, "uuid": "29a82232-bfc3-4f99-a48e-db44fae579a4", "comment": "Malware payload (Heodo)", "value": "09732288f2da543967f222339a7be51b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841941, "uuid": "ba1214a2-0026-4d40-acf5-c0b787bec9f8", "comment": "Malware payload (Heodo)", "value": "9a87fd9d12773a1b8b6b5b1ccfb35e3f24f8a078d9e81a400c60e4bd14f1e613", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841941, "uuid": "179b6cde-53c1-4703-9e25-ed9f52811ee3", "comment": "Malware payload (Heodo)", "value": "827a428f09413f0406629ef2dbe9c6a5bbd40fcf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841941, "uuid": "c38d13d5-6b19-43cb-9dcc-7db852eb606b", "comment": "Malware payload (Heodo)", "value": "b0c781e5ffd2f1085c9e2c01e38180cf57bab05ac4952c919f66c34a8852b0fcf31f996b16fe6ff604da658c28b747b5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841941, "uuid": "86b3e076-9d74-4729-a21b-d40cd53584e6", "value": "T19594CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841941, "uuid": "b6a22e2b-14b5-475c-b750-29aa54529a0b", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841941, "uuid": "9fc56c57-48a3-413b-99d4-6d9dd6a25ae6", "value": "12288:M3hV6Pw4aT23s2oCd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2hi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841941, "uuid": "9d6e1f32-42d3-4de3-ac59-4523776ff94b", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841941, "uuid": "a787a684-8905-4f59-891d-d6619d6d2399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841941, "uuid": "e91ef6df-c05a-4f91-8754-776c3f4ec7b8", "value": "09732288f2da543967f222339a7be51b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a38de41-d697-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652870581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870581, "uuid": "094ba7ac-83bb-461b-a2c9-86be027af57f", "comment": "Malware payload (Heodo)", "value": "f12537a051e9ce156a54fa4c415df4ba", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870581, "uuid": "e2bab4a4-f053-400c-804b-968a3238d633", "comment": "Malware payload (Heodo)", "value": "9aa629bdcd571757b46ffa19d23bbc8950e57b715906f12c2cdf8b55771970e0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870581, "uuid": "daef444b-c823-415e-ab37-c78e356ae011", "comment": "Malware payload (Heodo)", "value": "5529dcb2fef6201ab2e80eea408ded63b04842fb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870581, "uuid": "1d720768-03ad-4296-b393-aeb258ad1d77", "comment": "Malware payload (Heodo)", "value": "183797b14449ded9f1361225491d9114f83e7cb011d3ad3a17c0c61c134cf7d3bf792b868d8fc64d78c6cb86b2b07f81", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870581, "uuid": "b29f10ff-22b6-4069-8f5f-0b2bd12d7b38", "value": "T14294CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870581, "uuid": "156553d0-51e3-41fc-8384-574a39061234", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870581, "uuid": "0aab0a94-6730-494e-aae9-9005cb27d53b", "value": "12288:M3hV6Pw4aT23s2o5d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2si3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652870581, "uuid": "41dcdcd9-3aeb-4164-a70a-6c23ffd3654e", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652870581, "uuid": "8f682970-c60b-494d-842c-efb91b4a458a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870581, "uuid": "5013e65f-5d16-4973-aafe-f554f9b26800", "value": "f12537a051e9ce156a54fa4c415df4ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675a9347-d705-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652917875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917875, "uuid": "43c4d606-dbf3-4aec-8bb9-cde4380edd5a", "comment": "Malware payload", "value": "5f6b4d0883947467a5edf21d82a00ab5", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917875, "uuid": "4fc531a5-c66b-49b2-aa87-473e555f4b6e", "comment": "Malware payload", "value": "9ae7d957cb5ebbc8d9a8a6b242d4d1336025136a9cc0b01444a916bb828c86d2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917875, "uuid": "6655bb2f-057a-408e-bb15-6312caac18d3", "comment": "Malware payload", "value": "456767b953384074801a2ebca5ade5bb94e55fc8", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917875, "uuid": "3e1dedde-62d8-4f9d-b47f-143982358558", "comment": "Malware payload", "value": "79f6a1499e9bfd7d6c28eb814c8b810134db0474fcd16c06d5cd7a61ef5b5fe2746f16f896ee85e63f999068d166f59d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917875, "uuid": "6c9bde8f-771f-4398-add9-97b001f0e150", "value": "T194836B4AB69AC95CF521C7394AA783A9B323FC110F6B0747350AF3613FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917875, "uuid": "0e95df8c-3ba8-40f7-9ea0-a5d2b9274f56", "value": "1536:g8nKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2YAezwrMCtvJecvRtbkWwDs:hKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652917875, "uuid": "c4a75d0f-2e7c-4881-883f-ca2df456b601", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652917875, "uuid": "bdd3f184-0be1-4569-bcc5-3d7e84b93806", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917875, "uuid": "5547e1d2-7dd1-42ac-ad69-54e4d3d99d5d", "value": "SecuriteInfo.com.Exploit.Siggen3.32401.11843.2650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6da866-d67a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652858210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858210, "uuid": "0b688203-037a-452d-b989-950b927ae609", "comment": "Malware payload (Formbook)", "value": "f3080136e6cec934533cc70c0865c368", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858210, "uuid": "74b5ff7b-e8f5-4e44-b742-7f64cbbd98d0", "comment": "Malware payload (Formbook)", "value": "9af7966457a612505ab014eabf6eb8e96a09bdc6b248816506271fc554473197", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858210, "uuid": "d2cd592c-c935-403f-856a-c014a1a7ce62", "comment": "Malware payload (Formbook)", "value": "9db7a4bbc3ecdf24e11a68df2b61567804ecc744", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858210, "uuid": "2965629a-4774-44f2-b079-f651c86acb1a", "comment": "Malware payload (Formbook)", "value": "d91eb56135a3a7f17be36ac5e0956cf6b27d04453efb6efa1382b9ee65c0315013529c6461c608a88d730e36170be41b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858210, "uuid": "60c94b83-36ef-4187-bcdc-9cb3a161d173", "value": "T1ADF412093A59CA3EC48406B5CDA7C3346675BC556E924B0372CEFFAF3BB56C4AA04748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858210, "uuid": "89be0ae2-e17c-411b-8a46-cfe6fedbcdac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858210, "uuid": "dfaa9507-a3fc-4c29-99ec-943794d80594", "value": "12288:0b4jkCYTisZky2Oi0dzoKo/x1tembXMCRcLH9ZX:/YrTDkxOiaz1CxxcVDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858210, "uuid": "fffbad26-0a57-42a4-97f2-76a4b917b8fe", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858210, "uuid": "46393bc9-a5cc-4a59-a88b-4a9513c1296c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858210, "uuid": "c9a72128-74c6-47db-a4a3-f71d652786ab", "value": "f3080136e6cec934533cc70c0865c368", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeaa1324-d6d3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652896627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896627, "uuid": "5fd21358-ce19-4a6f-a754-5781c6e1ff93", "comment": "Malware payload", "value": "8571bb69b9d2382c90658478757e3d11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896627, "uuid": "4ab4ebe2-4133-4a2d-aba9-c49d13908ab2", "comment": "Malware payload", "value": "9afec74f3099dcc9355c8feede34cf21cf07487c60b3bdb5566fe74671437249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896627, "uuid": "f9ded44b-405c-4787-95ae-3239e6879440", "comment": "Malware payload", "value": "14cd0482a29dfa17c8ad5063fda3f51f7fc8228f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896627, "uuid": "4f9b0980-b39d-4e58-889f-04d6b79fb0c8", "comment": "Malware payload", "value": "9d70b7a4344419ed37e4a05f51a2f6ffba4f4194049f6bc9d129b70187a5a56979fed5756fdee89892425318caf0351c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896627, "uuid": "80016980-ff9e-4eb9-9212-846d6dc2ff44", "value": "T1E805273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896627, "uuid": "2cd4825c-294a-4a8c-8676-aacfdf63db11", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896627, "uuid": "baa1334f-53dd-46fb-a6ee-60e2bdbd3e66", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oPaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7bUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896627, "uuid": "e2c73181-76fd-41ed-8e1e-bc268bc36873", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896627, "uuid": "4ac19b2e-9748-43c8-b78b-7533d10daeff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896627, "uuid": "a2931692-1a7f-4518-92b1-39ff6a6e2abb", "value": "8571bb69b9d2382c90658478757e3d11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6830ce6-d67a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652858334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858334, "uuid": "7abd18c0-ec55-43b1-bee3-0cab5e5646a6", "comment": "Malware payload (AveMariaRAT)", "value": "9d1349d8821123a3e7d8946549c11b0c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858334, "uuid": "91ba8567-9e0d-4537-a8fd-6ed58359305a", "comment": "Malware payload (AveMariaRAT)", "value": "9b7ffb58891b06322524ffa855988d004d05894ffa43549c9d6e4ea09cfcc2bf", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858334, "uuid": "1a474016-e958-405d-8e39-69ab549c3705", "comment": "Malware payload (AveMariaRAT)", "value": "5f87adb70c9500e022faf2d3684b35f12974eda8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858334, "uuid": "aff289c7-8740-4746-a08b-4bb838f74923", "comment": "Malware payload (AveMariaRAT)", "value": "68911a909d2427d7b04bedf66005b87db965a218d693537a03522232bfca005d540935c9712fde31abdf699ffad5b878", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858334, "uuid": "b77698d6-37e2-4587-9ea7-8e8d201dff08", "value": "T1F4B4233E66F257F37F89C1F89A9516D8F566896056470A8DE3BEB3DDC20D8E04918C30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858334, "uuid": "de57c042-b557-4b3a-a1c3-ff4f19e78eed", "value": "12288:X94+YjIVA5t/uufpN6soCC6ElS1KsVq70R5P5aKsB1hJU:XT1VA+j76ElS4sVnH5+BlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858334, "uuid": "5b102646-7930-4e6f-b102-59850fa707f3", "value": 530446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858334, "uuid": "5914f035-5681-473e-a5c0-d568aafe98a8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858334, "uuid": "6b3d8b35-4f5e-4221-97ea-ae6e3e721d59", "value": "RFQ-18Y213-SRK (568 KB)PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39a70fb-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909037, "uuid": "ad2e6ec8-bd04-497c-8440-3d73760cd4e6", "comment": "Malware payload", "value": "b5e05c94b3369e0b0b89f44a819d24e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909037, "uuid": "c5801015-2811-45b8-9519-e7e0778200b4", "comment": "Malware payload", "value": "9c102308def697f6f247cb0de75775e8157919c5484df96117304c0f7774a328", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909037, "uuid": "696f7c12-54cc-4a31-a36e-9cbfd0b54abb", "comment": "Malware payload", "value": "03ee6c203c6a6746d6dc7c56f5708d0683bc6e39", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909037, "uuid": "07b012b0-8314-433a-a91b-c784b1319dee", "comment": "Malware payload", "value": "1c123a679726580d73cff424b705228e9d507bd8e1756fc50ed43419b8fcfe251e17ebe0eed68cc4834fd3d1ae5a8a7c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909037, "uuid": "1dc3e090-b96c-4852-a9fd-3d82f60223e5", "value": "T151A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909037, "uuid": "5d7d78b5-edc1-478e-91d4-eb8acc0a3219", "value": "96:/RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:/RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909037, "uuid": "0e8deb4a-dcfc-4e0c-9657-fecf2268fea3", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909037, "uuid": "318ae6d6-8bd9-4b01-ac5d-47193af80e9e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909037, "uuid": "8d01c5f6-7d0f-46f4-8fd3-05ea1de8d73b", "value": "9c102308def697f6f247cb0de75775e8157919c5484df96117304c0f7774a328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab279e43-d674-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652855711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855711, "uuid": "096f008f-454f-47b5-82eb-03f9fa257a68", "comment": "Malware payload (Heodo)", "value": "22434d276248a2aa968134e6290c732c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855711, "uuid": "dd333f75-74ae-4c20-b98b-14d7985b4673", "comment": "Malware payload (Heodo)", "value": "9c52c8799c6788287ee4e94544356872cbbd8f241c678ad78550fef2b6fa7efd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855711, "uuid": "248fed97-8701-46a0-85e2-983b82ac686e", "comment": "Malware payload (Heodo)", "value": "728c5ceee31846dc360d22ef4d261c58ef284653", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855711, "uuid": "581e9efe-f2ff-48aa-a092-a6b0ee157a33", "comment": "Malware payload (Heodo)", "value": "5131a31f5eac4fa695f9b18cdcc99f8518d737157cb885dec0bed22f68e30cec239041d95078bc97ae2c7eca70e4fab3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855711, "uuid": "f1edc897-8796-451b-ac23-097625c8490f", "value": "T199A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855711, "uuid": "2247ac80-eca9-4d15-82b8-02d63d795ea3", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855711, "uuid": "72f82f77-5821-49a7-9190-553f95b3930a", "value": "12288:uS4BnAed8BK2o0a2a5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKBa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652855711, "uuid": "3c97c098-6f92-4e24-bf43-d69b97a4d7c3", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652855711, "uuid": "3630f9d2-c7a5-4133-abfa-5a78ae0750f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855711, "uuid": "3bbfdd1b-17d1-431b-8153-f5703973e672", "value": "22434d276248a2aa968134e6290c732c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774ffa66-d654-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841880, "uuid": "efb693e3-2dc9-4405-8845-344ee2947b7a", "comment": "Malware payload (Heodo)", "value": "89cdc235969ca8efa70682a0fb562ff6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841880, "uuid": "7c8e8c18-403f-4b97-80b7-71e49d32bb2b", "comment": "Malware payload (Heodo)", "value": "9c85d5e738f49a792f53715c3f7751bf10f0a461a244df2256216e27548b1cbf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841880, "uuid": "669834cb-9ad2-4b8f-90ef-ac6d97594d5e", "comment": "Malware payload (Heodo)", "value": "034bc1229186da3cbc4d242b534eb17faadf9d83", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841880, "uuid": "f46ec1fd-d475-4cda-9e7a-961b45338e3c", "comment": "Malware payload (Heodo)", "value": "e4b81b515f0259cea34635a5b4859a7e1cc8a8db9515efca795eb9ba6e0bca7b5c017eda0aa5ebc369c212616f24b84b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841880, "uuid": "7212caab-c3f8-4787-a541-b800299ab68d", "value": "T167A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841880, "uuid": "175e1573-cfc9-4f12-8ccc-6481482d2048", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841880, "uuid": "fa66fecf-5ec7-4eef-9e8e-33378072dc0c", "value": "12288:uS4BnAed8BK2o0aTa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKCa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841880, "uuid": "053d6307-5b4e-4f48-b0f1-77e10bc46f5e", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841880, "uuid": "dd1430ff-025d-474c-9770-7c234195141b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841880, "uuid": "1e36d1a1-c7f4-44bc-801b-08c85da4d5b6", "value": "89cdc235969ca8efa70682a0fb562ff6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9d7668-d697-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652870744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870744, "uuid": "a7c45f61-8837-431b-b9be-cfe6efcae7ce", "comment": "Malware payload", "value": "cdfd0a2c96267b8f1913302ab90e6db4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870744, "uuid": "6baccb07-dc33-43d3-84ae-4c07ad7f5184", "comment": "Malware payload", "value": "9d398da98603fb52e9b25dd7ccaa052dd886858d6caa46b64e8e0cfd4f41e991", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870744, "uuid": "80f79edf-2181-4f9f-be04-653896ad2f79", "comment": "Malware payload", "value": "b04ceccccf9a685b7306c9ccff76fc2f5f832b12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870744, "uuid": "2f77a24c-2086-4942-a066-0a4827560bec", "comment": "Malware payload", "value": "52d170f39f97f57b73814c04f163614e0cfcdea918f0f680584141758df928c91497ab1f07390c34facb7b322c73f3f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870744, "uuid": "0c9361d9-f57c-42ac-bcc0-09588623f7da", "value": "T128237FA21DEF60C9F2B78B7647C9F9F64517E1A15C2FB0B026818E484B70D859873AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870744, "uuid": "ef5f2570-3bb2-4151-ae06-1d3c26e3a565", "value": "768:9DyFxm2YKXvZ9pXe/JmNIER3BIihm0dwUflZi9ypBkOko5mcgWR0w5f5fbxG84RH:9gaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652870744, "uuid": "4a7b03ca-0162-4c95-a22b-4ece031ff5ef", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652870744, "uuid": "08df2c4b-399b-41d2-a2d3-e0eacd21d439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870744, "uuid": "35ed27bc-5a3f-4d6f-8921-2cd8a78b66c6", "value": "9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8bbbcd-d688-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652864089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864089, "uuid": "ef82f989-c77b-4857-8807-8f661c988336", "comment": "Malware payload", "value": "cdd59826634e9d67070291eae7bb125d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864089, "uuid": "bad34f01-49c4-48f1-bcfb-a564bb450b1a", "comment": "Malware payload", "value": "9d4bb704d245eadd3b4da7a64f1847d0878df462aef6ea9d74cf86b0aac8b090", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864089, "uuid": "1f88521f-4c77-4e7a-b9ee-fec60caacef2", "comment": "Malware payload", "value": "14c4b6f0d31907064e834891743a32ed0a62fb73", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864089, "uuid": "2410a41f-e33f-46aa-8f25-74e79f47be0c", "comment": "Malware payload", "value": "0bac91ef183d4d4fdfd703a6718a65816a430a2ed0315625ef65a5937ac8916566ed0ef29889ffcc45547844c91efc1e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864089, "uuid": "8774b9f3-a352-4349-96fd-1d6b3368caf7", "value": "T1F551C02429E96118F5B3EFB16EEC6595CFA6F5737812499E004243074952640FC91F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864089, "uuid": "c71050c5-dff3-4bd2-8baa-371a248fbed2", "value": "48:8mdLSm77vzXcx34gCViRdqlQBUosz98OqH24h4ab:8mdhPzAylQsz9xy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652864089, "uuid": "bf9fba6a-546e-46f0-a032-6fba30ce48e1", "value": 2638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652864089, "uuid": "6048c7af-f882-4a5d-8e87-e44fbdd82b53", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864089, "uuid": "b9e40973-5eca-41b9-8a8a-244bbc1097a3", "value": "Medwin Publishers.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5debf480-d69b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652872332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872332, "uuid": "522b98da-dea7-4e67-be52-80b54394c1a6", "comment": "Malware payload (Heodo)", "value": "f63a41e071b3a3213f6104174577c880", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872332, "uuid": "7b5a8c43-ef9d-4c74-98c6-9991319d7e2a", "comment": "Malware payload (Heodo)", "value": "9d59d9868d641342f933811691ab4a5ed4a198f42c8801c49dff510e12e9c1e9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872332, "uuid": "abe22b8d-b343-4f41-a4d9-3d997afa6eaa", "comment": "Malware payload (Heodo)", "value": "0c8f10b14f04a48c7107b5d6188b3a4a4dbf2a83", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652872332, "uuid": "4a2acf9c-8e83-49c7-83d7-793e29d2cbf1", "comment": "Malware payload (Heodo)", "value": "a1ccaed50d5075b74a729fdb9587459355a388850f22b22ff37cc319fbf6db6d49e7b1eff5a9a390b9ddba8f28697e72", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872332, "uuid": "76d7659e-ab93-4f00-b23b-aede8827db9a", "value": "T19794CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872332, "uuid": "311cdb17-2e1a-425b-b227-9d4c931f5c6b", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872332, "uuid": "c6046531-6bb7-4181-89c1-33524298b903", "value": "12288:43hV6Pw4aT23GuoIv91Wuwf07EIvH3+38+:sb6Pw4R3GuFWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652872332, "uuid": "8829edaa-018e-40de-9fcc-6082be181bab", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652872332, "uuid": "935d5154-c9a3-40d9-9bfd-06cdc69d561b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652872332, "uuid": "687e0890-13ad-4d9a-8e7e-b40154ab53c0", "value": "f63a41e071b3a3213f6104174577c880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22590c4-d693-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652869145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869145, "uuid": "f8c1a2b1-26c2-40c6-adff-70fd4e036ffe", "comment": "Malware payload", "value": "909ca4b00e981383354cfe5e6b3879e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869145, "uuid": "134cfe0c-5e9f-42da-8ae1-2ddc599d24bf", "comment": "Malware payload", "value": "9d8312736ecb6519779bf744c37b8b730523935d473f88818a24e6d263f9a41a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869145, "uuid": "b4dbcbe7-94c9-4b7c-b8c4-14dfddbfda1a", "comment": "Malware payload", "value": "9c629dfef26efb2d618c7edd3bb7b18186f67d2a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869145, "uuid": "821358c9-4e0b-481d-b26d-0faddeb0c74e", "comment": "Malware payload", "value": "22b6f60db5008a1ecea28cf31dab130c8ab6d1c70ea83409d1948edff7ebf32adadcababe8d55fc27c9c031796a7e113", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869145, "uuid": "b03743a6-d5e6-4fd6-98df-71db6ee0ca57", "value": "T15EA37E12B5C1D871F676193118B4DEA18A3EF8201F615EAB3788177A1F342C1DE35EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869145, "uuid": "754945df-8da3-4b54-8f42-2922381c1f42", "value": "f9d72f57d6d4ab5b73a370c5e255475d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869145, "uuid": "eb17dd6d-6d86-4c47-b56c-606808ba332a", "value": "1536:dJq6qaDS8yRpEUS1RLX6gKMctJhHKz3RTiLwczMHr38Yc6NNDu0TsWucdPXj7HU9:Bq7hRkqKctjtLwczML8uDLFPXj7HOdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652869145, "uuid": "d04571a1-e32b-4983-b7a3-2d2bac9e4c96", "value": 98672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652869145, "uuid": "6fa149c4-4443-441f-835b-919cd5b66810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869145, "uuid": "fe035088-f22f-4614-9d92-2d11352f51cd", "value": "QMCommon.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb152c5e-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909022, "uuid": "3ff76185-a303-402e-a33e-6b1f34cd819e", "comment": "Malware payload", "value": "a19fa14dbc6895e8d5e94e936d137948", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909022, "uuid": "02a0b874-1bef-4a1a-bcc0-711d3145d68d", "comment": "Malware payload", "value": "9dbd54d7aa85c9a0fca610a63c2ea140af95df268079931a31c176e9a1f57e3e", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909022, "uuid": "489e4a43-36f7-4cab-8ee0-30a9fd9ec834", "comment": "Malware payload", "value": "ef23cbb134016580edd636621bb1430e8b3053b8", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909022, "uuid": "7edcbf13-53c4-4e69-bae3-63b47f7a1fc7", "comment": "Malware payload", "value": "090bbfadcf43116d2bb84ef6ff11b8d409a5e59a41c1a62886753ed32373048232057750a516f667c5514bf73da565a2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909022, "uuid": "a4cb5489-282f-4dc9-b829-f1df2f5129a5", "value": "T15B953374F6DA31BD99A8A577ABFFC938302F91CDA0514BB06DA911CE1406431DAE4F2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909022, "uuid": "f681930f-0657-44b2-899c-1a2e673228b0", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruND:tos909Qg6ecEZH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909022, "uuid": "815f483c-1dc9-4396-b28f-921fbb3bdf6d", "value": 1900544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909022, "uuid": "e3b1bf60-da65-4093-a429-7ac5d80c1bc1", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909022, "uuid": "adb3bab5-79e2-4451-bc3e-4e057dd20195", "value": "9dbd54d7aa85c9a0fca610a63c2ea140af95df268079931a31c176e9a1f57e3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f83aa07-d6ed-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652907446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652907446, "uuid": "a51565de-90bc-4931-b085-af22278f411f", "comment": "Malware payload", "value": "537ef5b9e2d93c621e6795b728e9718b", "object_relation": "md5", "Tag": [ { "name": "1805r", "colour": "#02D305", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652907446, "uuid": "bbe18773-e983-481e-a1b8-4016cbc175b4", "comment": "Malware payload", "value": "9dbf6631860379e2f3ce06366fce2bbe13647fe0c580099c5755bbf01dba30b2", "object_relation": "sha256", "Tag": [ { "name": "1805r", "colour": "#02D305", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652907446, "uuid": "a45eb9be-6869-4550-9498-a142e79d0cee", "comment": "Malware payload", "value": "0290d7367d1105e9f3faa334b431ba591eb28ad9", "object_relation": "sha1", "Tag": [ { "name": "1805r", "colour": "#02D305", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652907446, "uuid": "a0fbea06-e28e-4545-9b89-a58a45e3a39c", "comment": "Malware payload", "value": "18a0b12da28827bcc07dbc6313b497e2a4ed53b0626ab51f940bc1bd8a382937cbfdfea25439d6c60aba02294dec2f29", "object_relation": "sha3-384", "Tag": [ { "name": "1805r", "colour": "#02D305", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652907446, "uuid": "301f9312-852b-4495-8a12-cd4b83c57490", "value": "T124B50102E7911905D9274E7714132939C2F6B841CF949E6F9BDD863A9AFBB402B38327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652907446, "uuid": "7b549fe2-f6ec-4c69-a470-e768680bb2b7", "value": "24576:+dGP5hlGMPwvMtp0SMDWMifqrFzs2G3Z:+8zkMYxDWnyr6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652907446, "uuid": "c88b04f6-3586-470a-8312-9260052fcddd", "value": 2490368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652907446, "uuid": "32a5fa01-8e7f-4c2a-82c9-adf6f0763d87", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652907446, "uuid": "b99e50ca-07b3-4607-b4d6-71513888a574", "value": "Request_05-18-2022_24.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad12ab06-d6ef-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652908543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908543, "uuid": "b8f5fc70-6e2f-4fa2-9b68-f9204cecabae", "comment": "Malware payload (RedLineStealer)", "value": "97379f63b13103fb3b92608325513af5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908543, "uuid": "c8efbb92-ce34-4030-8232-c3ff01c5e280", "comment": "Malware payload (RedLineStealer)", "value": "9efee10ec726a7a076a74ac5fa84159805adfce8a45d2d906a5fa9bcf67a152e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908543, "uuid": "04f7c1f5-4df2-4371-a2fe-9c64c7232ad5", "comment": "Malware payload (RedLineStealer)", "value": "52d14fa4e7a09d6ae1f0a32eb3ec8171ac9a5698", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908543, "uuid": "8fca744f-0ad8-4390-afcf-6a90f3a3f475", "comment": "Malware payload (RedLineStealer)", "value": "fbaeb6e34e1fee60b59702d7b63212392b959cfad189991552dc1729a65f5a28deeb786bbc434eab7551be3a57aa0350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908543, "uuid": "cbf3a04a-9d4f-42b8-9a22-3f5c55a362c9", "value": "T13694E001FB91E875E0121D3494B4DBF14B3BB86229748547E7909B6F1EB3390AAB731B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908543, "uuid": "72c4765a-bfd4-486e-86a3-add1c380297b", "value": "6bf4d50d0d6cbd671de7b8039290ecde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908543, "uuid": "88aac8e6-17c7-4444-94f8-c38f5a187ad3", "value": "6144:8QvgaM5tZqPir9sVieoGKeAjUc8dn6eMlDakiga3wVf:JgaMUir9sVLj0oQaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908543, "uuid": "43e57398-b2d9-4ae8-a2e7-e8c54dfad5a0", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908543, "uuid": "61c44a20-e4b3-464e-aff2-41c1f18d85bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908543, "uuid": "863e3ea7-4d3b-494b-b07e-ac30a2b30d20", "value": "97379f63b13103fb3b92608325513af5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28dec21-d6b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652881923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881923, "uuid": "83f0bf43-c40c-4010-8614-89aea358140e", "comment": "Malware payload (Formbook)", "value": "ed9c16720462e8381b5048cd57be1532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881923, "uuid": "91207e82-5a56-45f9-be2d-6a4b739e9b23", "comment": "Malware payload (Formbook)", "value": "9f296a8fdf6e2d93248719c87156bb0410a3171d24ffce0382a0eda207deafe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881923, "uuid": "e89f8df9-6bad-4a94-bf6c-4dbea0a17e18", "comment": "Malware payload (Formbook)", "value": "720b029984f6cd94bee7fdc6b2501783aac84549", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881923, "uuid": "a1a394e0-73ff-4b74-8363-b37fcf443fba", "comment": "Malware payload (Formbook)", "value": "bbc20eebea799c857d6ec5801294ebc1ad3e582def8791b8bb2febe9ef8aef428d288c739c28003247d9e41c55d21fc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881923, "uuid": "2e511a9c-5d9f-4995-806a-aaf49a7a43ee", "value": "T10E1412482AFCC5B7E8A31BB19E7A052777B5E62128A8931F5750161DFE312D2C44EB33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881923, "uuid": "7eb19b6e-6983-4c45-96aa-50ea176fd4f7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881923, "uuid": "a40f89cf-767f-4554-a93a-ddc83c01a554", "value": "6144:ZYa6VBiSJCB4O3STGo+qYMTkyEw7CLIbf0WM76NyePZuI:ZYDLO3KjqMTkZz76AePZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652881923, "uuid": "299f9a3c-0c79-448f-9f50-28c02e36cdfe", "value": 204180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652881923, "uuid": "0ad74f57-4321-4283-9094-82518ed65b7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881923, "uuid": "836b614b-7306-401a-87cb-6e85cc01fd82", "value": "PO4550358074.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830516fc-d6b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1652884420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884420, "uuid": "0faae0f5-f24c-474f-af4c-86f80593036c", "comment": "Malware payload (CoinMiner)", "value": "28dae970f45e4fc9fcc642014241f3f2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884420, "uuid": "a9bc4137-a40a-4457-ab44-05f6144e38b3", "comment": "Malware payload (CoinMiner)", "value": "9f50baab0e40a774a0df4f11f72416950b15eccb239d731dd16315d8f3c001d0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884420, "uuid": "ec600ab2-68ae-451a-9466-7406b37eb9b9", "comment": "Malware payload (CoinMiner)", "value": "7b97b713fa2d7508740a85a43d35e486cf5700f8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884420, "uuid": "98fddd1a-eebc-46e7-8f18-8dd4ff049b51", "comment": "Malware payload (CoinMiner)", "value": "04baabe652f3064a57471e18f92a881a7662a41ffa6b481eaa89e09ecdcf26674318ee8c32a0322605d1323479e2171c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884420, "uuid": "25f56872-98ba-480b-9c6e-f0df1f5a42fe", "value": "T10686337FA2B43C4DC24C01747F6159A2CC59C8A124D7F3928762265E8CFEC499BAE739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884420, "uuid": "e9af685a-7a20-440e-b1f3-8ee29aa4c308", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884420, "uuid": "a9f3e443-3a02-4afa-9901-2c744b8f42e0", "value": "98304:BmFiRuUaZlP59JC7McqW+Wr3s+HTitjaGiTapsOmNllInzV+WszDO0rqZbfy+I:BmmWNC7McNN8+HmtjazAmNll4OO0rQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652884420, "uuid": "1145b9c1-7f2d-4676-9bc8-b95e019d4ec3", "value": 8174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652884420, "uuid": "b52198a7-ae9b-4606-ae22-0531ae0e0959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884420, "uuid": "9daf32c1-bec8-481f-a990-7a323e72cffb", "value": "Osiris.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202dd4d1-d6b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652882107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882107, "uuid": "1abcc6a9-cb69-4a82-a5d8-883b6da63b6a", "comment": "Malware payload (Formbook)", "value": "89a356776ccb3e052108b1906e97fb4d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882107, "uuid": "70490bbc-6986-44d5-af45-3f4d0da08090", "comment": "Malware payload (Formbook)", "value": "a03371c0ffc63a6acb4b6db3d5523e013c0b59691b38fbda1e4541f02347928e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882107, "uuid": "d7a9c910-fb0b-4689-acc3-abd1c841b133", "comment": "Malware payload (Formbook)", "value": "b4ca4546ddb02bcaa72de1debf8b4c84283f7a5a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652882107, "uuid": "8d5160d2-7ab4-4d74-b749-1ce219e424ac", "comment": "Malware payload (Formbook)", "value": "ade17d82a4ee2e8f1d9dc2d618df13ea9516b6828e20e2746760c191642c3ad350f684422505c0283e5f0d84d147313f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652882107, "uuid": "1c021c12-bc16-4e4a-9125-5dc0da601aab", "value": "T1AC24120DE1E2B53C388F89F18474B9DD3B9663E94C1694A98E711EB9CB44E62C81235F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652882107, "uuid": "f26e1aa9-d232-4e6b-a1d5-a79db96b2875", "value": "6144:tBaUzJrwo45PxMB9ieA19uAZ2OooHSvGXl7:tl8Pu3A19XfooHS+X1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652882107, "uuid": "7cbd7364-1129-4b75-8e12-40a49b00e305", "value": 214724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652882107, "uuid": "9f357c3a-7493-44cd-86da-f2f85f2b116b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652882107, "uuid": "088bc6a6-ec01-4f18-a80b-40d94d4042db", "value": "Payment Advice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f48ee2-d697-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652870517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870517, "uuid": "71049d46-df26-4efa-93db-f8969b03cc17", "comment": "Malware payload (Loki)", "value": "3b4f60e40cbc73233846824c36fcbb11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870517, "uuid": "59693824-6485-46d2-8407-f09bcfe8b84e", "comment": "Malware payload (Loki)", "value": "a0700d30e2b75a5b5e1439696f6f6c2ee99b11bfc17155af132a51b81b4a9680", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870517, "uuid": "7201ce97-9a64-46a3-a623-e907e7a907ec", "comment": "Malware payload (Loki)", "value": "09629101179e07e3b968e4e0d000779f8064044b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870517, "uuid": "d29d5807-a9d5-4064-85b3-e2d620b39670", "comment": "Malware payload (Loki)", "value": "85f4ddfa7dfeff92930a48f6263d588fa597bd0fef7cb69729cb5c83ef9c7cf9e686a7de24d6b1ab3f0205f5e9510e51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870517, "uuid": "29a31745-1e06-407f-b0cb-58cccfdd77b4", "value": "T1B9746C00BB50E034F1B716F4497A866A752E7EE15B2491CBE3E43AEE56355E0EDB030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870517, "uuid": "acd58d33-bb53-4cc7-99d6-0129f8f56b1d", "value": "1f8c4cf685a1da89700dff1891ed4f70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870517, "uuid": "24ef133a-287b-4129-ad33-bc7b1dfa1c04", "value": "6144:xTNakDGyXv/V0X5ucllyWFaokepflg7QC4MQ9emxNw2Zo:xTB/90JucllzMepNkr4MQ9LNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652870517, "uuid": "2c90d735-008c-4391-b5f2-b8859d55014f", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652870517, "uuid": "14abae2d-ac3e-46fc-bd6a-760aaa8c806b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870517, "uuid": "9681878e-d76f-4e3c-a249-b0481dbb7697", "value": "3b4f60e40cbc73233846824c36fcbb11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1698d465-d6d5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652897123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897123, "uuid": "e8c7b8ca-5afd-4f90-ab1f-351ab78b6ba6", "comment": "Malware payload", "value": "5163d334cdd1a55b19385ed4ad0f1d3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897123, "uuid": "06ac947d-6a0b-4690-8abc-e97597855198", "comment": "Malware payload", "value": "a08235a80cc3f974f9bb3df7a5cf7ec805e2cdafaed97afa2d25429d68a96d55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897123, "uuid": "091cf862-6767-4b58-96bb-eb28446c661c", "comment": "Malware payload", "value": "3257e8eccf36b67ae7f753232601e15e9acd69a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897123, "uuid": "df623ffd-ac78-4a47-b1b0-0f4fea04c51c", "comment": "Malware payload", "value": "852d7bd88b4c755bd7b59b7549fb2293049c065b594092c838b40a48241a5f425d5c025618a3c73c27d2b1d2c65774f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897123, "uuid": "60cbb38d-793c-464a-8e82-51e6f5d67f78", "value": "T12864C001F791D871E1632E3044B4E7B19B3BB8265234544FFB945B6E1EB33909ABB31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897123, "uuid": "3a0a3269-6c8d-4a32-b6be-d306c32b8459", "value": "772437747c205badf1dd67f2dee75de8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897123, "uuid": "3ad8b29a-c7c4-449c-a313-9e229f05ef9d", "value": "3072:G3G7NRWV230a9JN9hgri0yUFq+lzoZaf/fsxkgaBChUpZa9uD6Vdyhkdp:owRWV2302Jjye0yUZsZgsiga3wVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652897123, "uuid": "aeff9824-4294-4f61-9a68-6fef6ce6871d", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652897123, "uuid": "69f08f54-78f0-4a07-9e10-fa8c68d55cc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897123, "uuid": "ab7d7529-7f85-42e9-9923-974e271f4dc1", "value": "5163d334cdd1a55b19385ed4ad0f1d3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3c227f-d656-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652842556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842556, "uuid": "fc19d8a6-4e9c-4694-88b7-352c450c044c", "comment": "Malware payload (Heodo)", "value": "64a237ea75d8bfa81027128e4bca3550", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842556, "uuid": "55e2d308-1796-4441-b818-54f0d13b95d7", "comment": "Malware payload (Heodo)", "value": "a1553fa9210e8a7f4b0ebc51df4bb1fcdd880052281596285fb941eef75ea7c5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842556, "uuid": "b04f846a-0fe0-4b56-97fa-cd997cbb2309", "comment": "Malware payload (Heodo)", "value": "f6807a1ef557ddbe58f51c6efb856183b3f08599", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842556, "uuid": "24667c67-f7e5-4897-8ee3-946bd86eebf5", "comment": "Malware payload (Heodo)", "value": "da6a2896cb0525b1f1da915372bb585db35c74a01a3c93d723a9b49f393ee02b3a997cfea9b8efe92a22a6b4b7199828", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842556, "uuid": "f082a708-2f74-42af-876e-634679822776", "value": "T1D394CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842556, "uuid": "039d6923-abb3-4fea-830c-3b249e2e7bc5", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842556, "uuid": "6ee16567-061a-4079-b7da-c4c4fa767cee", "value": "12288:M3hV6Pw4aT23s2ord9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ii3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652842556, "uuid": "f99620fd-d5ac-46fd-bb01-ee6a16222f93", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652842556, "uuid": "5d3a7ece-cdf4-4154-8bc3-5785385e71b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842556, "uuid": "de722aa9-442b-4c9f-b3ff-795f1c6a55f8", "value": "64a237ea75d8bfa81027128e4bca3550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935c02fe-d685-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652862973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652862973, "uuid": "fb391242-e824-4a7b-ba6c-675958c5125b", "comment": "Malware payload (AgentTesla)", "value": "79387d39c6fce78e73cf9e23eac3aaf6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMPACET", "colour": "#AFE4CB", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652862973, "uuid": "d4ad6036-2d19-4b75-941d-8ae8ddc64ea2", "comment": "Malware payload (AgentTesla)", "value": "a1e43eb969c8ca1a93f4b646ead0db1abf8ae2fdf7ae37ae8e61a23178bb0506", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMPACET", "colour": "#AFE4CB", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652862973, "uuid": "22e158a7-0b38-436e-9521-ec83c34f9a6f", "comment": "Malware payload (AgentTesla)", "value": "daac9951cb915cb51cc4630489a3528151ff5e8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMPACET", "colour": "#AFE4CB", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652862973, "uuid": "6a1dcebc-eacb-47a0-b96f-5f87ee5bcfc5", "comment": "Malware payload (AgentTesla)", "value": "a2341fc6e81383a904ed34e871798f1678d2e46ffdc6d7f49d0d5a12970968f2aaa0750c74f50f460b4658666d35c6ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMPACET", "colour": "#AFE4CB", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652862973, "uuid": "bf0e7e59-586b-470f-b889-e71db7febe5f", "value": "T1F3558D931BB8BD12C13D263065507C90E3F6D0CDDAB9A648386471E67FB2781BBD26B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652862973, "uuid": "f3b72b9b-9357-49c1-b321-64a68943b970", "value": "12288:kqVZk3Gg0zmU9DZBxxdq5w3p8lP8Gb5ff3tJjM:RVZQGg0fFxEemk8bM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652862973, "uuid": "2055c336-c2ca-41ae-8750-a97d9297d7d2", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652862973, "uuid": "8c920b79-f146-44ba-9c0b-bc60390a38f3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652862973, "uuid": "094e68bb-83c0-43b0-a3be-31e3d31ca230", "value": "AMPACET_1805183.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adedcb4f-d6c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652891364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891364, "uuid": "4af5ce87-9797-42ec-acb8-0839d92e27c4", "comment": "Malware payload (Mirai)", "value": "d5931420b2426a9ebf4b58e50c4740f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891364, "uuid": "59e7bacf-c8a8-4fd6-a9c2-0a6b7bd01389", "comment": "Malware payload (Mirai)", "value": "a295e68f80852dca118274abdf4e25f1ef508e50f247a6889ef4988c1c0e0870", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891364, "uuid": "ce0504fe-4adf-4266-97c4-42b47ded8214", "comment": "Malware payload (Mirai)", "value": "b10473cc7477fb4e0715ba356be98f40949af977", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891364, "uuid": "00461382-fae9-4356-903c-c4b805117718", "comment": "Malware payload (Mirai)", "value": "8cb2683f2bfd197d87512ae1c3c1001b463123fb3dd3a79a2133c0fe0da230826dce9c428d26f1679752605e0f538a5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891364, "uuid": "7dfeb2ae-addd-42a7-8522-6ffc79832586", "value": "T111332B8D68121D2CDAD358FD50729F0E9E552211A0A3070FA7ABFEC33D33269EF55989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891364, "uuid": "8215dbf0-9225-436d-9abb-50defbf242ce", "value": "768:mouzcCsm4ru2IGh6HHaihHHeIXXdauZj0CGeWxCyVBXtM7edUo+f1prwGk0Qexba:moqcCyrBIC6HHaiFu/eJ7edJg1pkDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652891364, "uuid": "9d8f1d9f-bb79-4851-b7cf-93f79c48b872", "value": 54336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652891364, "uuid": "c3bf2f8c-b56a-4505-9d65-c615e17927a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891364, "uuid": "726c96fe-53d8-4dea-a72b-3266ce486f11", "value": "d5931420b2426a9ebf4b58e50c4740f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ea63b0-d647-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836246, "uuid": "4e0f67eb-c986-4964-b101-0a74093ace38", "comment": "Malware payload (Heodo)", "value": "aee40dc660691777630e438b0eec796f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836246, "uuid": "d0d97557-b7bc-4cd9-b177-564998000b26", "comment": "Malware payload (Heodo)", "value": "a2c791c978f0a00fbf59bd562d3089ddf279427a14db479e0211f29af5b4fd2e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836246, "uuid": "e61f0441-a7df-4a3b-ae15-1b558cce4519", "comment": "Malware payload (Heodo)", "value": "a613dcd6e4fd9a31ee9a55e549e7b717a96b9abc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836246, "uuid": "aa8bdff5-c80f-40e0-8e98-09a06b40bb06", "comment": "Malware payload (Heodo)", "value": "26caea5b3e36f9b3ef16a8d4359267bdca1a2ce441884d91e0cb5fcb351cf58063eb02ff295eabeb397b869e5a22eb69", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836246, "uuid": "fdeffd42-1c58-40e2-89e9-c14afa8ae320", "value": "T1F5A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836246, "uuid": "23ec95de-ca33-4ce5-ba68-2fe97923d230", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836246, "uuid": "838a8345-29b0-44fc-9597-fd9d61a70fa8", "value": "12288:uS4BnAed8BK2o0aUa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKHa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836246, "uuid": "1074ed2a-a801-497d-a4f7-cf0a3f911bf4", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836246, "uuid": "e0c04cb8-f7f6-4aff-abf7-cb2a10979193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836246, "uuid": "66379a72-422c-44d8-9331-fb0bc45d1cb5", "value": "aee40dc660691777630e438b0eec796f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e2cff7-d6a5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652876687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876687, "uuid": "1a40f270-21e5-4e0b-bb3b-60aceb574da8", "comment": "Malware payload", "value": "6aba13c238050ce2fa15e337402ccedc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876687, "uuid": "3aa6b13c-91f6-4a21-b77a-8d614c696ec6", "comment": "Malware payload", "value": "a2cc56c01ea90ed26936074a7d99e22259e5f432039d8f7b34d6eaa3dab57729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876687, "uuid": "b6c8b926-de00-41c2-80b0-ca1521640b7c", "comment": "Malware payload", "value": "ddf6841bcf182d77437cd7db912942d62d84151b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876687, "uuid": "cc7daaca-58e7-4bbd-a541-b86137b89c78", "comment": "Malware payload", "value": "6e026222137ac6dabf1281a8b5a629a82c53b39fe275b53acf94a341f3d9e25493488a731d5be6b6ededc5ff40876e42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876687, "uuid": "c2072a34-4f38-4ade-9cea-5ee2cfda901f", "value": "T17AB2721677E84325F3FF2F39683652440A7AFD57A831D60C1A991A0E1A32F618DA1F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876687, "uuid": "e336f0e8-bfdc-4ae0-add9-eff281569a85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876687, "uuid": "d871e60a-7d17-4801-96fb-0b806ee5ccdc", "value": "384:ayI4s9dlTLMkZ/qJp7ZLwgr3bkggP/quvkjmtGIIA6B6imMiMMR6kfo:av9PM6idZD3brnVmMiMMR6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652876687, "uuid": "5bd7c5a6-599c-41ab-91cb-be3cb3ce6092", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652876687, "uuid": "1b45c054-d108-46c5-94b3-c612e2df3bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876687, "uuid": "0c67081e-6223-4ce5-8415-1c2f2ed2a362", "value": "vape.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ecc1014-d697-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652870535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870535, "uuid": "8f88ecae-bb82-4a21-86b8-9e826861657d", "comment": "Malware payload (Loki)", "value": "e9b42d67c6b1d5f175f74e8cb2f6940e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870535, "uuid": "3c9c6d23-5943-4de5-a24e-3fcbb7fefa19", "comment": "Malware payload (Loki)", "value": "a2faed43fb596a2e59b9bedd0481bba0c289df4f8b1ee93b92dad3ca5dcee595", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870535, "uuid": "8511772e-efcd-4f77-a35e-30ebca62d554", "comment": "Malware payload (Loki)", "value": "76af37cabcb66997463e158ca245461f98e3f9b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870535, "uuid": "c4f3fa54-a650-4a3a-b731-32df561e0040", "comment": "Malware payload (Loki)", "value": "5aacc12737f1fc3549ab8459777c809209247637725ec49c7627a91f256463fedc78f3686b8ee5dae96e53055f5a5474", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870535, "uuid": "81c434ed-0ca1-4fcf-9edd-ffbfeb5d16f0", "value": "T1CE34BE2273A1D074E0AF1930447497B28A7A7823177489BB37941BBE1E707D1AE7936F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870535, "uuid": "1a3bb022-26cc-48fb-ae60-3999f0460e19", "value": "7571adbe544c88b5f4f231486e74f9e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870535, "uuid": "06df463f-2d80-42fd-a21e-68fcabf444c6", "value": "3072:wYvoKqtgvab/E+DSqZn4DkKAs0TrRLN//pGqMQ/Fe7U:DvrbSb/E+mqZn4DPt0nXiQ/YU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652870535, "uuid": "d10fb3a6-a599-439a-974f-69f12e13e312", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652870535, "uuid": "af428e68-163f-4396-8209-e578982ee409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870535, "uuid": "ce111dbc-0005-4390-89ae-dc243f77351f", "value": "e9b42d67c6b1d5f175f74e8cb2f6940e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58bbd3f-d6a1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652875110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875110, "uuid": "d7e9fafc-5db3-4dfb-8cd9-a66d4259e402", "comment": "Malware payload", "value": "9470b7c60f200376fbfbb74e587d8c51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875110, "uuid": "c390f010-163a-4d73-b83a-b3298d90950d", "comment": "Malware payload", "value": "a3137a5eb92a73b35bb269d973ad2f7354f33ce6992d67e9b550c3105d1b962c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875110, "uuid": "5d9d83f8-09b6-4205-aa8e-0468d660295b", "comment": "Malware payload", "value": "f86c90f8d03f2bc6ecf049aecf5ce24ae8022b86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875110, "uuid": "650072c0-74c3-4810-9d8e-f12f2d0df4d3", "comment": "Malware payload", "value": "deee74b9b616a43b4d7c74b4cacb905d9b6435a47d5476ec4ad3f3cb5f4fceaa13750f4f84e492996299d16e5978ccf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875110, "uuid": "37496cc3-144b-4d0b-800d-b2cfa5dad739", "value": "T1D8359E22B2908433D43327399D0B56A45A377F612F38997B2FF52D885F7A7913836287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875110, "uuid": "b942121a-3d76-45e6-9acf-b6bb7b699025", "value": "36c0ffdab89e265b5a748a59648230b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875110, "uuid": "41857626-5fec-4cd7-808d-afc17e7ffb51", "value": "12288:jSMISEM+cfxAv9DK/2HAU4NLBTDn3V4HCANc2v8vv1//Ei1Y94fh9IjP+d7WQsjc:jS9G85K/i4NLRGiVvn1Y9mbIyd73h5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652875110, "uuid": "92ccc0a3-fab1-4e82-943e-6672a282aee6", "value": 1137152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652875110, "uuid": "4d3d2bc9-c4ae-4223-a31b-c896334b11e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875110, "uuid": "a3b954fe-57bb-43a7-b2e7-48580f9e2981", "value": "SecuriteInfo.com.Trojan.DownLoader44.60226.4890.20245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1e6000-d697-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652870505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870505, "uuid": "fe9f3418-da67-4eb1-9098-1c6c673412dc", "comment": "Malware payload (Formbook)", "value": "9fef8755cf21e3579b88945398492bf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870505, "uuid": "781e1f0c-9b81-448c-a853-deb20696de33", "comment": "Malware payload (Formbook)", "value": "a342e8f2472ac316cab1017fc24f46d8206390f90448b91d62b9225aa3d2e229", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870505, "uuid": "55ae9a5d-306d-40a0-8cb5-fb4d451a7100", "comment": "Malware payload (Formbook)", "value": "99f6f10248473cda72a66f2dec5d0c968fd41ff3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870505, "uuid": "915ed80d-46cc-40ca-a44a-b1d348dddd52", "comment": "Malware payload (Formbook)", "value": "7d07a0b9a3c9df567db5d8f2840e5fc09cb2d9a16cdabd586b6c3035e01aa5ad20690f230c5079ada1a10d8e9eb1a352", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870505, "uuid": "e8712d86-18cc-48c0-885a-8262a606afb2", "value": "T172F412093A99CA3EC48406B5CDA7C3356635AC556E924B0373CEFFAF3BB56C4A904748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870505, "uuid": "c53d13c4-0dbf-48f0-a297-63f7d68ec453", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870505, "uuid": "1f03ee0b-e83b-4742-8b29-33e4af74700d", "value": "12288:64jkCYTisZky2Oi0dzoKo/x1tembXMCRcLH9ZX:ZYrTDkxOiaz1CxxcVDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652870505, "uuid": "7bd921cc-d771-4470-8791-6b26ce8b722e", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652870505, "uuid": "6101a108-7274-4f80-834f-4f60a90a4ebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870505, "uuid": "67924ada-e89e-43df-a809-73f8659e5ef3", "value": "9fef8755cf21e3579b88945398492bf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5273a45-d67a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652858359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858359, "uuid": "7e3475af-9c98-4393-ba66-d0030c9281b3", "comment": "Malware payload (AveMariaRAT)", "value": "06f1fd77f041ebccc52472e1c5ee19cc", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858359, "uuid": "d5ab1d65-096c-408c-9d2e-ba70f8d1adee", "comment": "Malware payload (AveMariaRAT)", "value": "a3cc989c66245e7f426489a1f29c978ff4a1d523cc2d813b4d1f65f3293b1745", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858359, "uuid": "351ae7d8-0915-42b3-bd3e-da4f54fdcb9d", "comment": "Malware payload (AveMariaRAT)", "value": "6729f79ec396ff602692262a7433a5cdcce4337a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858359, "uuid": "57bd2bb3-9f5a-49f1-87e7-0e1e1a413bf1", "comment": "Malware payload (AveMariaRAT)", "value": "11d8b62f51bf926678719eef3bf30f9c6494c7f5fca5917a56e9f3ff419fccbeabf6464fd381a86aface0beba6eee498", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858359, "uuid": "6213c0fc-d6fd-42c1-8dc9-dcdc143ca69e", "value": "T1A805D0013B98CB14D5AD773AD3DB651047B2B9D21A32C68DBF4D27A20522393AD1B72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858359, "uuid": "05fda33b-4fb8-4f01-9c01-119b90c0916b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858359, "uuid": "5113abd9-a204-4c3f-8a40-1d01cee18f4c", "value": "24576:nupog99m2N5JYjQDynQqa0p5AERDOSkMvLEYlirg8qs7Gv:nupog99m2N5JYjQDynQr2TZliks7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858359, "uuid": "04c0bf52-9c11-4733-b9e5-7ebacfdef781", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858359, "uuid": "cd2f6a79-4e06-407b-a6e0-ac416f4dd80e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858359, "uuid": "a60b1f04-25c7-43cc-b2c6-bf751b7b1321", "value": "RFQ-18Y213-SRK (568 KB)PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc70a28-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909079, "uuid": "a91f0f98-189f-44ac-8949-1713b94fa295", "comment": "Malware payload", "value": "b1a3bfbcc97c178bde32c10e8b9db3a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909079, "uuid": "e9a86a26-2214-4e0d-8b2c-a14cb4207217", "comment": "Malware payload", "value": "a3f5649552dc6e7cbb4ffdd6c9a59276f7a7cf2ff341bc91dbfeee95ffa688e3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909079, "uuid": "457ff151-0958-4fd5-90a8-909cba5b1fe9", "comment": "Malware payload", "value": "17e77d08c8195e1c1cb7d59771945e32b6544187", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909079, "uuid": "cff8b595-2cee-45ad-9f43-dedfabfcc467", "comment": "Malware payload", "value": "218853de95f26507045ef2d70ecb9250b6c624dcbecfd580080d33eaca5857818a1602ddff21c3ef04c9de1993ffe6b0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909079, "uuid": "e70cace5-5c4b-4aef-9389-6f92eae10c08", "value": "T131A1E850112C1AB17346597AD26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909079, "uuid": "60786a10-a100-4345-8063-cd8950a5c70c", "value": "96:mgRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ZRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909079, "uuid": "15c7382e-289f-402a-9efc-64d8ef474359", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909079, "uuid": "2fb1519f-705d-4060-8025-f0b86bf83450", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909079, "uuid": "b85ec26b-447b-43c6-946f-7067164d570f", "value": "a3f5649552dc6e7cbb4ffdd6c9a59276f7a7cf2ff341bc91dbfeee95ffa688e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfec979-d6fc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652914208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652914208, "uuid": "9e8842b4-c594-4a07-a606-78759444bd95", "comment": "Malware payload (Mirai)", "value": "9ff0bdd7b003153cb4d5e1c6996dc030", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652914208, "uuid": "4d8e9809-3d0c-43e1-b5e5-e5c605279431", "comment": "Malware payload (Mirai)", "value": "a46e7f9c08909bf8047744198f876899a0a8b2d63c972f478610d06774942088", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652914208, "uuid": "03526ee1-b005-462f-b692-81370da49e9a", "comment": "Malware payload (Mirai)", "value": "0af77d3a6a1ac191f1caafd9d551cd5d67f0e079", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652914208, "uuid": "3c3cc975-e8c9-46d9-bd8c-402b1fc30ee5", "comment": "Malware payload (Mirai)", "value": "b9e9548fe077d2e19ca8bd0b1122f193357277eb81f35072c397a297000cba89223b6a4a17b65f26f5ab486165c4e7fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652914208, "uuid": "68caa3c8-7936-4971-bbdc-78ac31067579", "value": "T1CE530747B44180FDC149D03447ABAA76C8237EBD1B3AF39637D4EE3A2C6AD221E59C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652914208, "uuid": "2464541c-a3f3-4230-879f-05a00b61b2b8", "value": "1536:anF9U0FferGtOW4/RWo4+z8kkRqw2hJOlQ5M7WR:0FK0UrUO3JWvnRqw2Olr7WR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652914208, "uuid": "cb69aed3-7796-46ca-901b-88727908f52b", "value": 62720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652914208, "uuid": "a8952d91-ba40-43a6-bf5d-1bca0525723e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652914208, "uuid": "80a3a3c7-3c7d-4380-8ae1-3d1f04d47111", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ca1825-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908960, "uuid": "8ca3ddc6-64ae-4c49-b3fa-8a3dd8b70666", "comment": "Malware payload", "value": "c9feeb40018090356221d9028bfdbe61", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908960, "uuid": "309e400e-1b14-4f6a-8847-08f909e2c9e7", "comment": "Malware payload", "value": "a51de14be319f76125ab9a6e488624cd03f6dbb53237783a72325172ff0b2967", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908960, "uuid": "ed9a9cc7-d01e-4be0-af68-d69e9c2e3a5a", "comment": "Malware payload", "value": "34c0228b2511cd520790992525a0df4cfa954375", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908960, "uuid": "a3d3df96-428b-4361-81bf-efe6ccf8e249", "comment": "Malware payload", "value": "be097d9049c1e4fe169c2c1741a66409e176a629142771e4ea0e04f8fb7a1e56934fb6b8dde498718a5620c9d6bfd360", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908960, "uuid": "d0899094-5ef5-4ac5-b84f-3af6554e03aa", "value": "T11536337CA0F87DFE43485865D2DFDF10706A49CEF0A1D752A59BD94F081A32278EE928", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908960, "uuid": "dee6b20e-1d31-47ca-a08c-6fb067ef4c75", "value": "98304:tos909Qg6ecEZHyEexmLaI9MY7bxTE8SSvEgP3N2v+KmFLBLRVD:td69Qg/JFeQ5x7bhE8SSdP8v+nVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908960, "uuid": "53510883-fe28-4a08-b825-216182f6f020", "value": 5304320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908960, "uuid": "1fa0a88a-6450-4685-a840-66155ee79641", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908960, "uuid": "4bea03f1-6703-40cb-848f-c01741f6ecf0", "value": "a51de14be319f76125ab9a6e488624cd03f6dbb53237783a72325172ff0b2967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172bcef3-d656-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652842578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842578, "uuid": "a6df4dd0-7029-4754-a9ae-ccadd542f8b6", "comment": "Malware payload (Heodo)", "value": "a69f97c4ba81e1bb9aaeb2efe8474d66", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842578, "uuid": "18b746ef-8119-4596-a166-2c8d550666ee", "comment": "Malware payload (Heodo)", "value": "a554bbc144ef08a57a74e3e07358ee55b4a0035ee61969a5b69be2efdd559ca9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842578, "uuid": "c47bdaad-5147-42bd-b977-11b50dac77fb", "comment": "Malware payload (Heodo)", "value": "2fd1ce37740d28899735a47bca4f2f8d1bb0b706", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842578, "uuid": "bf4afaf7-4109-4098-947a-0c3767f87fd3", "comment": "Malware payload (Heodo)", "value": "1bbf407ddefc3dd8d36d6d91884eca4ee4aee1141266ef9433260f53a9a5179503e07cb3ad04253f341d0c15e61d7e8a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842578, "uuid": "06703e39-d666-4b8f-afa4-af4357a44687", "value": "T16FA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842578, "uuid": "5e4b222e-aee1-4763-898a-3c4ab4b16c9c", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842578, "uuid": "9f5de42b-7fb9-4e5e-b645-3df7eb248cb8", "value": "12288:uS4BnAed8BK2o0aXa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANK+a34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652842578, "uuid": "699a0f5e-2c5f-477e-ba4f-170123244933", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652842578, "uuid": "a7a12fc4-fac7-4fea-9b7f-0eac3c9b2549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842578, "uuid": "32587678-0e83-491e-9e14-b616d4bea4f1", "value": "a69f97c4ba81e1bb9aaeb2efe8474d66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98379bd-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909047, "uuid": "81842581-f709-4c1d-b2c8-bf19328cda85", "comment": "Malware payload", "value": "a33a4e66c5685f196b2ba24ed366de25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909047, "uuid": "d19273f6-5a3c-477d-90db-648aca98e987", "comment": "Malware payload", "value": "a5d8d9c6c8dab9c608dab60389eebc2be602053ff0f8713f2530322f63418326", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909047, "uuid": "7c706f01-e395-433e-8068-fbdd43f2707d", "comment": "Malware payload", "value": "7452641feb3b3897fd75a754508ed6e84aa61fd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909047, "uuid": "2f571afa-3325-4f1b-afaf-c8b82b9a22a9", "comment": "Malware payload", "value": "204da2733786d4d4ad3c022ea7fba899d5fad09df2a5d8fe8a2891fce6e5f933c0f7dcf2c892601c27bdb31bb1911f9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909047, "uuid": "78419a9b-8a98-42cc-8613-b27b9e04e6b6", "value": "T19A21C76A97E3AD17CC540233DCEB7720E321AE44858EF613E30212111C2F21A5B21249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909047, "uuid": "183ce4b5-cf35-42fe-9b76-4df1df5fbba0", "value": "24:wB4llMJWqY3D5KjEoKGRh5rUlFSs0VzLCkIdZIZOIB0Nf+3:F//N3DMD5rkFSsCzLcIONW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909047, "uuid": "aadff823-18b0-41e6-aa25-e1cccbf87baf", "value": 1144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909047, "uuid": "90555596-e362-4696-9ee5-ca84b63860e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909047, "uuid": "fba5ecb6-a776-409b-a127-24f3bd9153f7", "value": "a5d8d9c6c8dab9c608dab60389eebc2be602053ff0f8713f2530322f63418326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50992ceb-d697-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652870592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870592, "uuid": "99650d59-a193-442f-9f52-b0b2fb361205", "comment": "Malware payload (Heodo)", "value": "93baad3950dfd08348db062a9bdaa7f6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870592, "uuid": "f678190d-6be5-4d9e-b271-4b4201e9e21c", "comment": "Malware payload (Heodo)", "value": "a627f4d9a6699c2db3cce3cdcb2350494958cd3279584225ae2daa78122c5615", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870592, "uuid": "7cec5698-bab5-40f7-9475-23c0c81c154f", "comment": "Malware payload (Heodo)", "value": "e5543421b06a5c535ef723bd61e30df0375b7120", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870592, "uuid": "8e76a46d-45e4-4cf7-bd77-55cbf9af6f47", "comment": "Malware payload (Heodo)", "value": "d96386722eaaa5c7ed41e5c96ace53b730dd63a9da6fe37ebcb540d8eaa17483aab67d330a5e3a726364b142abf7ee42", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870592, "uuid": "8a42c60d-b5dc-4e5e-9a6c-9f8416c99015", "value": "T17594CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870592, "uuid": "8de614d1-eff6-4169-9351-4ea06f3291a7", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870592, "uuid": "170041a0-a114-4dbf-8602-1e5b52e36d83", "value": "12288:43hV6Pw4aT23Guozv91Wuwf07EIvH3+38+:sb6Pw4R3GuQWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652870592, "uuid": "a415d77b-ce4b-4b33-a2e8-6aab6de14e62", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652870592, "uuid": "9ead5438-a909-462c-8689-5c7dc81bc285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870592, "uuid": "f0b4e94f-ea1f-4c8b-88cc-4d392c896894", "value": "93baad3950dfd08348db062a9bdaa7f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57c38b4-d6c7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652891431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891431, "uuid": "7035a9fb-8d05-4f58-a8ac-dcdcce240753", "comment": "Malware payload", "value": "affb5a402ee1755df3aed40d047d96c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891431, "uuid": "beb8306b-e791-4284-862d-ab31f7c3b69e", "comment": "Malware payload", "value": "a6395d5185cdef268831762d99a10b6f3a4458ddfd97f6faadf383265b195e95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891431, "uuid": "deef58f8-b21a-4dc7-9de5-e30d8f8670d3", "comment": "Malware payload", "value": "829a07cebe79bad02641ca94afaf092c89b6ef47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891431, "uuid": "f116d8ce-7db2-46ff-8911-9f250df05ac4", "comment": "Malware payload", "value": "55163bc79c6abc6d5cb28aa9d8d49a69471f590751045bf91a7be17a77da50e0438b3fbc2c4be25b86ba4e32aed2ad04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891431, "uuid": "adfef472-549e-447e-abaf-604b6db36d6f", "value": "T17194C04A73A50CB9EC7282798C574A01E672B8150771EA7F03E0875ADF2B3D1A93F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891431, "uuid": "ec1dec40-a8cf-47a6-8b3b-f0d355a5fe1a", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891431, "uuid": "a9b7ecc3-450e-405b-a8e0-5bade310745d", "value": "6144:GgIYnzcJxDpmJIyeV2vR3JDEohoEuRfoP1SKL0w+d7sWOQSH0E9cWdb3BHq:yKz+1pcIuvR3lEo2Eu+9T0Rd4Hr9H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652891431, "uuid": "266c2b01-73f5-4c60-80ef-b78730bd77de", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652891431, "uuid": "e8039c7a-8e73-4843-b279-1963b9d569ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891431, "uuid": "b71d5dfb-1a55-4ff2-a2ef-6dea6c6aeb8e", "value": "affb5a402ee1755df3aed40d047d96c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46157c6-d6ef-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908635, "uuid": "9d5c6e86-d6da-47af-b6f9-31d905c7328d", "comment": "Malware payload", "value": "b01dca69f088efdc7b432be9f1535d24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908635, "uuid": "2dcfc6df-ba1a-4fc8-a7af-2ad5d651b062", "comment": "Malware payload", "value": "a640bf3b0e65a8dd9e38cc786bd213338cecb8a2a179cd0906c2bf315e647912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908635, "uuid": "7404c648-b830-4d1e-a202-47faeef34483", "comment": "Malware payload", "value": "be0e775b610caff755863d499ea46c8873ac47e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908635, "uuid": "19316c5c-8d5d-4d03-9dcc-23cb4700a3cd", "comment": "Malware payload", "value": "f48172e0c7ee8fda6431371d6e6997eb1d23f1a40edb2a0f2d79cbb6aa150deed378ebabb9078af004fec10bbdf98fe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908635, "uuid": "60d4a575-e74a-4c4d-be97-c988d71c2bfa", "value": "T18C05273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908635, "uuid": "25d88816-2cfe-4895-b763-ec6ec0d222da", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908635, "uuid": "2c1a1a98-907d-4d62-be82-8980971a88e3", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oQaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7iUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908635, "uuid": "b08761ce-faa8-49f9-8946-8525d8fdd788", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908635, "uuid": "f97449c2-9144-445c-9c4d-04549f5567bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908635, "uuid": "c6a75ab7-1627-424e-95ef-4d0eb8f9bbbf", "value": "b01dca69f088efdc7b432be9f1535d24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6837526d-d705-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652917876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917876, "uuid": "7b682dc1-c9f1-4150-a032-b931d3e28070", "comment": "Malware payload (SnakeKeylogger)", "value": "6ee879bd4d737a7cfe48888a6706befa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917876, "uuid": "4454c327-e1a3-4505-9074-fb4af8109330", "comment": "Malware payload (SnakeKeylogger)", "value": "a66e4d7327aff7d03bb6dbcab79492b24851676319e957628ebf474073e1c4b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917876, "uuid": "a02f94e6-5222-4ac5-b3bc-7c3cf99a23ab", "comment": "Malware payload (SnakeKeylogger)", "value": "8744ce0414b6e18b66950840cb45d2e06d02306e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917876, "uuid": "d3226aed-59e6-4f3f-b026-7f80b9141b49", "comment": "Malware payload (SnakeKeylogger)", "value": "ed8a77fed9776e01c4f6f2fed21137bc825f2811c7ae92abb7c336c2a251a9bff1679592c128a92c83494003bf3d960a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917876, "uuid": "777798e5-9110-402d-b206-244254b9cdc9", "value": "T1ADB25D3193878165DDAECE37D82201BD46EDBE038866D67B24C0FF8E7971E42C6A1674", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917876, "uuid": "4cf9a8dd-0847-4635-b312-71c23086d818", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917876, "uuid": "7efd1a40-cbd5-45e8-a709-4a3079ac983b", "value": "192:7ZunsuDxYhiy96wa77XTtn5Uk6fffd0339xsvvuxSj6JH:7WdYhv6j77XTUk6fffCDxOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652917876, "uuid": "86d9e9ef-26bb-421b-beab-f715c8e25dad", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652917876, "uuid": "3b9c2f1c-37b4-49c0-8457-e3411fb17ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917876, "uuid": "59671dae-d2c9-41e2-9f90-9eab44bbd63e", "value": "SecuriteInfo.com.Trojan.Siggen17.52762.7083.4123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce76d136-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909028, "uuid": "6e3d5a23-c8e1-4fe7-9553-b6a048f90012", "comment": "Malware payload", "value": "9d6ba27e79cc839148f048df1cef042f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909028, "uuid": "0d4c1858-f525-4bd0-b403-2845ef4e5938", "comment": "Malware payload", "value": "a6c69136c7c475d34c2321cc6ef29ee882af4c8da14f4c65f4144222bfc083f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909028, "uuid": "5003a0c2-b5d3-4215-a7d6-8199d8aea1b9", "comment": "Malware payload", "value": "93f7c23ac8d8238c26602ddbaccab6995564da15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909028, "uuid": "7603d56c-8b06-4a46-a5e2-5ef5b79bb5a1", "comment": "Malware payload", "value": "d36180b7c6079b05098633e270160af7c2fe16e0d9a1369dc43372513bdda009a1bc90371ea0b1b8a8cd00c05df4db26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909028, "uuid": "5c964c92-333d-485f-bb70-55695832580c", "value": "T169665B73905664E8D1ADC974C51522137EE8384B673863CBBBC476F11BBABE49A38334", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909028, "uuid": "64a2bbed-6f0d-456e-88a2-3dccf3f516f2", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnao:sXyWSpV+Wu7rI3JE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909028, "uuid": "c23f5b4b-64a3-4c5c-b22d-5515099ed527", "value": 6914048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909028, "uuid": "b1b01c5e-0b54-4d0c-a5ab-fbd6293198a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909028, "uuid": "39667cb8-0469-4967-a4e0-5bf0a766bf01", "value": "a6c69136c7c475d34c2321cc6ef29ee882af4c8da14f4c65f4144222bfc083f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912d3e6b-d6ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652892604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892604, "uuid": "a5c88843-2c03-48d1-ba0d-cae1963ac129", "comment": "Malware payload (Mirai)", "value": "be88c4b4178e344e1fe6ff41c97030fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892604, "uuid": "22092c6f-d957-45b5-8dd4-ec0ca3baccae", "comment": "Malware payload (Mirai)", "value": "a70fd9dd78c38a8bd6055355149669f02cfcf106459d0b14d4335fe117216ed3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892604, "uuid": "282b1c08-100e-4b04-b428-71b861d01707", "comment": "Malware payload (Mirai)", "value": "2c2a048d579117f0e703acb0339946a4d4d585e3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892604, "uuid": "e7ec0dcd-7986-4cb2-8feb-2190ace8e0d6", "comment": "Malware payload (Mirai)", "value": "32e38e1354c52b1968d57157970665b9e6119ed51c859fc3d0f1b33246de08787e88e3444dc89bb348fe3e71b0381914", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892604, "uuid": "7fc7246a-5ead-4e4e-b66a-3572bf30910b", "value": "T17F733A45BCC19A13C6D113BBFA6E40CD371623A8E2EB7207CD156F11738A86F0EA7661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892604, "uuid": "f4fe194f-656e-40fa-a10c-cf151c334df8", "value": "1536:usO1+BkQ8yi6dT9ncsnxLs9ewNJ4HtGKe/NsAqXLH1iNODui9VAU1vi:usO1akQLc/yz7ViNi/pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652892604, "uuid": "2f3237d6-6a1a-4a7b-b16b-175225541898", "value": 75860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652892604, "uuid": "3431bd8e-d97a-4935-8f82-81b4e1182102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892604, "uuid": "5c79b621-2b1a-4876-84be-5f652567e02b", "value": "meerkat.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f5ecd7-d6e0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652902013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902013, "uuid": "9a5f16d8-bfd8-43d3-9bef-c9703f3d76bb", "comment": "Malware payload", "value": "cb3d2a0166336116d95141a49fce6069", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902013, "uuid": "6d273a8d-5fb4-40f0-8c8f-d7333274cd83", "comment": "Malware payload", "value": "a81fed9b110c177c41e31471aa4800a3d0ff6518147518f4041b388fb2822e32", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902013, "uuid": "f755b61d-9fa8-4bb5-87a1-2365cd7d488e", "comment": "Malware payload", "value": "ea6e5bde3b8d282f6dacfc3f3fa430dc8cd923e0", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902013, "uuid": "78cbdde3-2282-412e-b28a-e20c6f7c5a04", "comment": "Malware payload", "value": "47af0787750a93dfa5ef492a44ca97a594f0372beed265b6feaf7a4e6c3e99ec989d973058bc9ece2918ad80a41071d3", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902013, "uuid": "29a87e7f-d3d0-47c6-b5cf-767852f60db4", "value": "T160250203FB615942D9170D3B10571039C9B9BA45CE819E6FAB9CCA36EAFBF500F28617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902013, "uuid": "e75a0270-26ea-40d7-8c04-8769a8e17998", "value": "508a9041a3b093c4d4117cbf25e438cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902013, "uuid": "56bfe402-dbe4-4b79-b08f-fd195187a9c7", "value": "24576:S7/f2DKOm213xsR6D2Z8VnD7Lovcw1wbPVwbbeuposH:S7/fysQDsIH8vcw1wziFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652902013, "uuid": "dddb4efe-adff-4d35-a8fb-f29b4ae57ed1", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652902013, "uuid": "d4424672-d76a-4ed9-8197-7dbf4f972f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902013, "uuid": "1e8f20b1-91a0-4f2e-abc3-05974b188da8", "value": "spc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f799b79-d6dc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652900279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900279, "uuid": "64fa1bac-9bf6-44f6-820f-0227b51d3f71", "comment": "Malware payload", "value": "d89b6da97a14ea540174aeeb2bdb969a", "object_relation": "md5", "Tag": [ { "name": "1805a", "colour": "#0F5C8C", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900279, "uuid": "c9257032-07a4-46fd-a7d1-b1e059466e8b", "comment": "Malware payload", "value": "a87a5d47707581e0f6c122255ebb2af522a5f8b988e35bfde47f7b623fcba2c0", "object_relation": "sha256", "Tag": [ { "name": "1805a", "colour": "#0F5C8C", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900279, "uuid": "baba7870-29d4-40ab-9d04-c5c8a97d99ed", "comment": "Malware payload", "value": "fd5c07cd183d45df7d5eb5a1d5b5f98c3dca86ed", "object_relation": "sha1", "Tag": [ { "name": "1805a", "colour": "#0F5C8C", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900279, "uuid": "4fb3c118-8e3b-419c-bc3b-f9e79bf5f6a5", "comment": "Malware payload", "value": "dedca47d22a347c58d39edaf387f75141b875cf3e902378b97103f3e18b118d8f1d44140a7117162b32648e2728d6cb5", "object_relation": "sha3-384", "Tag": [ { "name": "1805a", "colour": "#0F5C8C", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900279, "uuid": "a08c73eb-d8d1-4000-a3d1-e78e7d47e4bf", "value": "T1FF25F103FB615942D9170D3B10571039C5BAB945CE919E6FBB8CCA3AABFBB500B28717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900279, "uuid": "676a20ab-ee35-4ee9-92b7-e1414abc09ae", "value": "24576:17/f2DKOm213xsR6D2Z8VnD7Lovcw1wbPVwbbeuposH:17/fysQDsIH8vcw1wziFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652900279, "uuid": "f7008542-f01f-462e-8873-e259fe784c6b", "value": 1052672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652900279, "uuid": "ee45fc7c-9d93-4b37-b755-ac378bea22e5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900279, "uuid": "cb2aa1d2-2abf-4d7a-831d-d61f0814d8d1", "value": "documents-2205203.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6810f621-d6bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652887811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887811, "uuid": "d480ce60-5f93-49b1-95ff-ecee8a12c838", "comment": "Malware payload (SnakeKeylogger)", "value": "28e1a924c78b7d76c0b7ea7323468398", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887811, "uuid": "68e1e264-3d8f-4c64-92df-854c479cdae0", "comment": "Malware payload (SnakeKeylogger)", "value": "a91c01cd252a97e5807ee969f0a645c1e9c4328fa8c83a562ab536d00a26f3b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887811, "uuid": "32c06617-f6aa-4b65-b0d3-80681708f655", "comment": "Malware payload (SnakeKeylogger)", "value": "d138e34c02b9ecb97890bac492f1579511462f60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887811, "uuid": "024ce4bf-87c1-4fdb-b90f-c3506de1cd9a", "comment": "Malware payload (SnakeKeylogger)", "value": "91e5d35dcb42139919833d9899bb3685a7c6cd0005a0d09e42794db9c0dafc2d778dc206bf4d59fa69afd13c0ea3b5a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887811, "uuid": "8649b1d5-0241-4532-9179-6fa1022f3a14", "value": "T13905B69C321075DEE86BD67AD9A81C68EAD0746B831B4103A02793ED9E4C9B7DF140F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887811, "uuid": "adc6adf3-da61-49cb-b416-67c340ffbb54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887811, "uuid": "329e70f8-5df9-4dc6-88af-42cf6d36d237", "value": "12288:R3WkaWWHKW4xjRMwwtlVCMDPJQj1cgoqAbdsFqoY2pv9hihEGnDbuN8xYMRN/ZmQ:R3WkaWmK/RMBt2WPJQBN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652887811, "uuid": "17cf50a3-5f32-48c4-aa7f-9a3c548f1c37", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652887811, "uuid": "e8f5f610-37da-4c51-ac85-42fe9590eea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887811, "uuid": "b2cfa57b-28a4-4634-ac85-c90947814f3a", "value": "PURCHASE LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47aaf9f3-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652858551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858551, "uuid": "dbc5bf42-1f07-4220-821d-b138e2a77487", "comment": "Malware payload (AgentTesla)", "value": "50d9db3b1ba68992a73b8bdc3395d0d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858551, "uuid": "1656ea87-87fa-4457-a9f9-ff5b2ed28ef6", "comment": "Malware payload (AgentTesla)", "value": "a96875a604f8e4c381ec3140b0f7a942272cc42eda74b2ebaa310e32703f18e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858551, "uuid": "74e1bef0-4eb0-40ca-83b2-811665fff879", "comment": "Malware payload (AgentTesla)", "value": "bb4e08edce6cccd1f2d0ba4972c4165c4bfc0aea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858551, "uuid": "8d1c3f6f-5392-4ef9-941f-1c1c5769a379", "comment": "Malware payload (AgentTesla)", "value": "10d2715af58e8d57c4f032658e741c9aa6105a42c71d143d5ec45c72ef5a4c725c19017ae2a53cfc3aa87bfd005c44de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858551, "uuid": "634ff98a-3e37-482a-baa9-0994d5b36f16", "value": "T1EAE4012563B8EE50E9A983BAC06251F807B52D16D912F74BCDA4BCD93D373C0471B62B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858551, "uuid": "cee314f3-5ee5-4eaf-9ecc-c509b036cb61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858551, "uuid": "ef3f3ab2-17c4-4c98-b189-36ae798432bc", "value": "12288:T71X8PxThXYXyhwDJSXfXpC+YEU9AuQGuVk6mLNCAysfTBg3Q9rm:PNaV5ytSXf52niGuaJNfuQ9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858551, "uuid": "1b8a9b42-8389-479c-b8b6-692923bd937a", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858551, "uuid": "716e06ac-65c3-4a72-bf29-7d80a9cfcb45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858551, "uuid": "042a2af8-1faa-4df4-bb4d-f9be4c3dc07e", "value": "RE Re RE Purchase Order for mid May 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a72430-d649-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652837368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837368, "uuid": "db3529b5-6767-459c-9921-693d2931d01d", "comment": "Malware payload (Heodo)", "value": "527296706580ec66a76f74aabb2442fa", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837368, "uuid": "ace19a9a-13c5-4e7d-ba82-642f3f5f7b7c", "comment": "Malware payload (Heodo)", "value": "a9a130385590df827e7c1297f5eb630a8b7cdba17f8d6b096ebded3be8358861", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837368, "uuid": "08205296-698e-4e35-8a49-d1c6dcc6b85e", "comment": "Malware payload (Heodo)", "value": "0a5bcbf66beaec63cc78ba2d0106365d80de43b9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837368, "uuid": "53f6382d-99c0-4792-94a3-5187c5cc0ed9", "comment": "Malware payload (Heodo)", "value": "087d4f62fadb74aeb3df7d32d48172358a3a9db522db2430aefe35867f0ecb500d038c3ef970d065c3c5818ff9e08a94", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837368, "uuid": "af6ea0ad-dc59-4b62-945a-b1f359172e84", "value": "T1BEA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837368, "uuid": "f6ad99e2-068b-4ac9-99d4-6b9d31d787d5", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837368, "uuid": "576c0780-e87d-4b80-b516-af43d0da5905", "value": "12288:uS4BnAed8BK2o0aca5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANK/a34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837368, "uuid": "bd28fadf-a08c-4ea6-b42d-0e0bf357f56d", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837368, "uuid": "5c92f1b7-f66e-4014-aa9d-e31c773686d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837368, "uuid": "eed663b6-ee5b-44f1-a193-2a5d7c81472c", "value": "527296706580ec66a76f74aabb2442fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9467865e-d681-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652861257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861257, "uuid": "a03db2d9-b4af-4883-94bc-69eac63c6439", "comment": "Malware payload (Heodo)", "value": "b01de80ec020deab81f44785b6b92ceb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861257, "uuid": "2946196b-2c49-4c56-b72e-89a53ed27d75", "comment": "Malware payload (Heodo)", "value": "a9ce091411764149af3ae8c02e32905be5a717aea44b9d13fc719c31c270559b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861257, "uuid": "d511f05b-ba71-41ab-a1de-34d365633e81", "comment": "Malware payload (Heodo)", "value": "0be72ef7a6e1e192b54795755122b3d890f9eb31", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861257, "uuid": "a7b9814d-e9fd-413c-869d-6cdf68d0e515", "comment": "Malware payload (Heodo)", "value": "ec45ad529f0e7c37956a73bb88ead373e582a28dab5700af14f0fab1b6346cf3eeb02029e9ce69878d2015ff358caca3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861257, "uuid": "bac540d1-fb0b-46e3-b635-c6d073607b20", "value": "T15694CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861257, "uuid": "315f6933-9d3a-48d0-a023-ba90e9e4ac9a", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861257, "uuid": "f097eaa1-3173-4d08-9b03-49acecc91576", "value": "12288:M3hV6Pw4aT23s2o0d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ti3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652861257, "uuid": "d1634ba4-f092-4c0d-b0d6-b9c4625651b0", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652861257, "uuid": "0afc91d6-07f5-47f2-9baf-db39bf188a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861257, "uuid": "108d6a10-010f-43b9-953a-664c4b091e22", "value": "b01de80ec020deab81f44785b6b92ceb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27fcf68-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908954, "uuid": "c1dabcb5-43b9-4208-b60f-d6984f8e8a48", "comment": "Malware payload", "value": "4a3c96582c6cb182fc5b7f630822d624", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908954, "uuid": "51400762-ff60-4ef2-b88b-cbe742d1323d", "comment": "Malware payload", "value": "a9e96215bb4520a1976fdc6dcc5f1945b9f238049cde878fedef0a91a394fa07", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908954, "uuid": "ac31d889-c5f1-4c43-a05c-45e9e14cf22d", "comment": "Malware payload", "value": "672e30e5980e94048b6d736d4b53c6e000d80b33", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908954, "uuid": "949277fb-5d1e-4f72-bae6-f04b2ec449d4", "comment": "Malware payload", "value": "261c4fe0299a9467e2355c1f5fd27778946139d1a8a4a50d1bc6b110b4d665e4de822c2004177c374ce8e661fe59c9cf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908954, "uuid": "dde1fd4c-1b54-49f0-be1b-4d14f926659e", "value": "T126A1E750112C1AB17346697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908954, "uuid": "c29269b5-659c-4599-870b-58c4362ffbdc", "value": "96:fRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:fRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908954, "uuid": "1961e692-1198-4a10-b0d2-6bbdd41e5652", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908954, "uuid": "02c6bfd7-336c-4e59-a7f6-49875e630dd8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908954, "uuid": "cfbba34f-373a-4a3b-b402-43afbc7df130", "value": "a9e96215bb4520a1976fdc6dcc5f1945b9f238049cde878fedef0a91a394fa07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4399cf65-d677-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652856826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652856826, "uuid": "aa78d512-764f-4f76-aa48-cee132390c98", "comment": "Malware payload", "value": "4c38ddf5d52d150a9152637071cf94e7", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652856826, "uuid": "45689c04-52bb-45e1-ac61-fcbb23ab01c8", "comment": "Malware payload", "value": "aa09c514fd2ae1ee845b1d961e721e7a2c5cbd398d46380aadef85dd98aace04", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652856826, "uuid": "a97a94e2-2276-44b2-845f-da8840470502", "comment": "Malware payload", "value": "32c535c39b279443065ecbe3fbe0cd2c1dc7252f", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652856826, "uuid": "36358c4d-4131-4309-9315-9a0baff50aaa", "comment": "Malware payload", "value": "eb9dc915c440179344b7a96fdad742272b2d84309b736757666adb4019fdf5388fff70e1b04ae18b7d7f80447060d7f3", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652856826, "uuid": "27d593bc-9b3f-4c6c-a8c8-c2b6e3fda1c7", "value": "T1EE31C91FADE71542CAE70A71E976F292010C5A7C0359D86C0F8314514E9E5F255578C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652856826, "uuid": "f01a7b67-58c9-445c-9d73-381c7c2eebe2", "value": "24:XgKSoH1fQBFYSZmuvD677A1q1K9tBypQESCxOzEPGDLzG4EyA+gfF3m6IgU1o3WC:Xgy19SZ5T9tUiNCxoDLS4n6f4gUaG6th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652856826, "uuid": "239d17cc-9de4-45ac-934e-014c5b4e026b", "value": 1488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652856826, "uuid": "37739a4f-3f27-43f9-8bfe-c84aa0f7890a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652856826, "uuid": "4b436654-739e-4977-8be1-1f541ff4478b", "value": "ACH Payment 05.17.22.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f4d8a9-d65c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652845145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845145, "uuid": "45f0d61c-93d6-4811-9dfd-2f15f730a0dd", "comment": "Malware payload (Heodo)", "value": "3e42fad317d3edfff2de6b9cec971f56", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845145, "uuid": "241064e2-7197-48b1-b0cb-54538d3dd612", "comment": "Malware payload (Heodo)", "value": "aa0b6ed27b1106a7316f0df503e0936587cc245c163229523360d67f2e2b0ba2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845145, "uuid": "a31d3858-60b8-4b3c-b71e-1f474c584624", "comment": "Malware payload (Heodo)", "value": "783303c5e4028d01b8db0e7a0315f79258808c03", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845145, "uuid": "ac82133a-6be8-4293-98c9-913627236ff3", "comment": "Malware payload (Heodo)", "value": "292fd973eecc1b8652f9b5697a03e968af3980b3f5f58e022a835e6a3a87c941719500b2d93dd24b227268fa2ca8663f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845145, "uuid": "d0aee9e2-7f14-4578-99f6-e3ccb777f50c", "value": "T1CEA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845145, "uuid": "c633bbeb-9671-46de-b081-4a644f17295c", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845145, "uuid": "0ef29c28-d76e-4bb6-ac04-aaecf4197e06", "value": "12288:uS4BnAed8BK2o0aba5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKqa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652845145, "uuid": "99fae649-e7c5-4713-9080-2a86f65e2e70", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652845145, "uuid": "23e8de01-09dd-436a-8619-f29f924da074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845145, "uuid": "c15e5f4a-99e8-4073-951d-720a91d47dab", "value": "3e42fad317d3edfff2de6b9cec971f56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa185f8-d6ee-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908216, "uuid": "e616a114-02b0-4e02-973b-8fca5463176e", "comment": "Malware payload", "value": "429fad0211f014de6e6933f9d17c4f70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908216, "uuid": "2a769426-24de-4766-823c-532c400f0ce9", "comment": "Malware payload", "value": "aa339f9862461703d20bad9aa437d9e149922066a79797d2db6d95e0beb0e920", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908216, "uuid": "1f9bc3e1-bf2c-4f31-8f2f-bcd7e2877c0b", "comment": "Malware payload", "value": "23460f871e937b092300fc9af05f251ba5cd415d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908216, "uuid": "f2b46122-18fd-4c0d-8816-b7b5e40f6f6b", "comment": "Malware payload", "value": "3fee4e79b27d5809f25ee26c7fc2a80ae42fbae75c2e860b69dd1449f982ba31a6bf6e6a3252a40e05d14aee02b6e130", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908216, "uuid": "ce18c9a0-0e1a-44b6-90f1-0ad7b24618e1", "value": "T10B05283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908216, "uuid": "903611b2-5d2e-4841-b782-9cdfe0e7e516", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908216, "uuid": "63e102ce-a219-440c-947f-98faee4d6b80", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7fmpE3:BTg9UXRD2SeqfZZiTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908216, "uuid": "d586b52b-d280-46c0-9054-82b7d7b6397d", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908216, "uuid": "a1533eb6-fa65-41e4-8440-a2e9187e251b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908216, "uuid": "fe32de27-dead-4e11-af23-a1b1752603e2", "value": "429fad0211f014de6e6933f9d17c4f70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe1a605-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909051, "uuid": "ed00797f-ce8d-4f60-a832-05d49c6f6666", "comment": "Malware payload", "value": "9b3edfbe21d101ea070eb3c688f659b5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909051, "uuid": "814470d9-dd32-4fdf-b503-bce864d35a80", "comment": "Malware payload", "value": "aa8e83b32f16890452629281db98beda6f9fa7f466fbb5c91c3065343c094977", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909051, "uuid": "4605a76b-2e3e-447f-a12b-70cb9f832833", "comment": "Malware payload", "value": "22db1732f920a5d1aae3d7fc846a2ddb347a0351", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909051, "uuid": "c0112764-0089-4e08-b874-7ee69cbecc86", "comment": "Malware payload", "value": "c2723fdc31a90d0731eecce476df6d507b22898781f701985cd7d6af4dd9631adfb4dd56eb295c82fdec8dd7342c6c70", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909051, "uuid": "722db4ef-ab80-4afe-91d1-d0c62c5ce49f", "value": "T13DA1E750112C1AB17346597AD26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909051, "uuid": "e2c942d7-768c-479a-ac4f-b761b3ca4767", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909051, "uuid": "ed0192f8-85d4-47bc-b1bd-e76dc65f42b4", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909051, "uuid": "5e46d1b5-b318-4774-ac4f-e62b2ee33956", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909051, "uuid": "1b66e7ac-699b-4d93-8111-b19567f69483", "value": "aa8e83b32f16890452629281db98beda6f9fa7f466fbb5c91c3065343c094977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7799fc-d6ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652892761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892761, "uuid": "22ebf22f-7546-4cf5-b003-cd386c90711b", "comment": "Malware payload (Mirai)", "value": "0699e2bcba32ba50507161811c660a87", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892761, "uuid": "d75c97f0-bf07-42d2-961d-3ee99651dadd", "comment": "Malware payload (Mirai)", "value": "aaeee55793ca03bc4621885ac436804f6525d9dfd124549f76a94d0031a78889", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892761, "uuid": "3a265f0f-9919-4481-8cfc-fdc10b07ee7c", "comment": "Malware payload (Mirai)", "value": "2c86d5e8bcb4d0850e46b633c0cb71a034227493", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892761, "uuid": "a6c4a0a1-aef6-4f39-8089-882123408f02", "comment": "Malware payload (Mirai)", "value": "3ff2e676b3c5f8491fc627781a179af32455525e434c8b603ccab092028908f70b5cadaf9f1a9fa65647926998ebd42c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892761, "uuid": "abd170f3-3a7a-4004-ae43-f58c3735719f", "value": "T198634AC8BA43D9F2EC0602B52077EF338E76F5B6215AF987D3949937BC42A11950399C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892761, "uuid": "95e39c78-3573-4fb1-86a7-1019f750a3d9", "value": "1536:Dc0fNarwa4HU8Bzi83gZP8SfjLBoCYFehRbz3xZGH04k:DOwa4HU8Bu83gV8S7LBoL4v32U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652892761, "uuid": "21340836-4a3d-4ea4-94dc-fc2bcfea9c0f", "value": 68144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652892761, "uuid": "92e18d38-b179-465c-9cb9-ed8890bc00e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892761, "uuid": "a833f3ef-8499-4f9b-a892-31229f7a8945", "value": "Oblivion121.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2f9f0a-d648-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836787, "uuid": "ad25d495-32e8-4eec-bb26-7fb0b19b56c9", "comment": "Malware payload (Heodo)", "value": "9cbae3e291b416832ce7b950585eb013", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836787, "uuid": "b50e3807-0302-4876-899f-b7ada5817056", "comment": "Malware payload (Heodo)", "value": "ab5a9a92e25803a8ca9ce81d9643589e0fabc8d02473c2b2b1694f1f54a28659", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836787, "uuid": "7a68abdd-f894-4762-9656-3644ace4b3d9", "comment": "Malware payload (Heodo)", "value": "fd3980721e2ea80a23e3b071919c575f4affe64e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836787, "uuid": "ad905816-27f2-48f9-9e2c-67d26d4785a4", "comment": "Malware payload (Heodo)", "value": "510529e90e9541a1a483dc23a9235e9a1d9203a4046032da479b99971d908628e2ea7bfb2a0ceddef397a885bdad30b3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836787, "uuid": "45cc68e1-7a7a-4f04-acb3-3c0a2394e27c", "value": "T1D7A48B4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836787, "uuid": "4b74709f-a257-4cf9-9290-8860701a301c", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836787, "uuid": "e163b500-a905-44c2-9783-fb3a4f45d5e4", "value": "12288:uS4BnAed8BK2o0aKa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANK9a34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836787, "uuid": "cdc4078c-7e37-4c4b-97ac-a5f72b6860b3", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836787, "uuid": "0b30e5f0-8690-4030-8bf5-83c0a618cf8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836787, "uuid": "7909a911-4f3a-4bff-87d7-834deb78bf4b", "value": "9cbae3e291b416832ce7b950585eb013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f2cc2d-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909034, "uuid": "c7eed11a-25ac-4ea3-9c0a-1976d4bbcd63", "comment": "Malware payload", "value": "7ad035ef5188dea1c95769e24ea6c826", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909034, "uuid": "39308390-6b96-4fbe-a677-2deefbc83e77", "comment": "Malware payload", "value": "ab8b9c64fd5581a8f6b4437639fe76f5400775bfa0f06afba42645bdd4ed65ed", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909034, "uuid": "5605d7b7-c876-4852-a246-0a75c650429c", "comment": "Malware payload", "value": "ddfff451e1ad25909d211b6265c7837e8e483893", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909034, "uuid": "2fd55e3c-ea51-46de-9b5c-96b1f2bbfbdb", "comment": "Malware payload", "value": "85b47fc586abde9285952c1fd1e56eedceb31512472d6e954b6897e3c6f5db7e24a409b723b7212d157c4ce6238b8005", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909034, "uuid": "67acc3bc-f861-4204-a1dc-8dd7904631b5", "value": "T1F241D7C41561483A6E99FB6736F5052076D2D8435DE81EE460FFB4EF405EFD81341EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909034, "uuid": "3ad7f177-1f1a-46bd-99d7-e2ebbfae4c86", "value": "24:vkQFsJ4BmGzuJ1KWAssIAYLA+AdksiAkOx+ZTFEIh+BPS:vyimb1KVss3YLmdJZkM+ZTfG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909034, "uuid": "eca4d211-e3fb-46a8-afa9-c26723b9db19", "value": 1940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909034, "uuid": "8f863c3d-89a5-4e02-be4f-eb6b1c12c8ea", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909034, "uuid": "8c0c7968-2cd9-4821-80bf-3799007d141b", "value": "ab8b9c64fd5581a8f6b4437639fe76f5400775bfa0f06afba42645bdd4ed65ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf5c76a-d655-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652842534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842534, "uuid": "1c168d25-b42a-4fb9-a6e9-7a46f297043c", "comment": "Malware payload (Heodo)", "value": "4334e3a2bc22f11704d20149f82c49b9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842534, "uuid": "e1188f0c-9d77-45f8-ab41-83daa67d6fea", "comment": "Malware payload (Heodo)", "value": "ab968ecc780632b9e8e76bb8a3adf130da60adb42e78875b9a61374f06bc749e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842534, "uuid": "330fd918-db5f-48b4-a5f3-f6efef6618fa", "comment": "Malware payload (Heodo)", "value": "08f1537f51090dad70e4e3025aeb00dd8af882d6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842534, "uuid": "84491b92-6c7c-4923-b313-b83d44f6718b", "comment": "Malware payload (Heodo)", "value": "26afbe6da23fec78a327e1dbc45cc950c52971449e3e4e79483bbbb98f90a56f457cfb9ee9b74797c08548e2c9d817b8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842534, "uuid": "8669e321-33f1-43f6-84ca-c46c6fc24008", "value": "T1AA94CF1572A50CBAEC779239C9434A06E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842534, "uuid": "e0432d3f-cdcf-4498-9748-9f4248ddcb87", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842534, "uuid": "1eae29dd-93d9-43eb-8877-85357dd0e2d7", "value": "12288:M3hV6Pw4aT23s2o6d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2xi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652842534, "uuid": "8409d41a-92fa-4a90-8f2a-8d791a0b6f02", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652842534, "uuid": "edbb8479-409a-4f60-a323-0eaa9307807f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842534, "uuid": "b1969148-4f04-4de5-b32d-899de4282b5e", "value": "4334e3a2bc22f11704d20149f82c49b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26c569d-d6a1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652875105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875105, "uuid": "a5ef4f09-e25e-4ceb-a240-2d4272f5ff67", "comment": "Malware payload (AgentTesla)", "value": "966f798fca35981dbfbc148b56b33593", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875105, "uuid": "126258ce-137c-4da1-90d6-35e74bffc3b8", "comment": "Malware payload (AgentTesla)", "value": "aba69f59df6e5913552e1dfd26ab7dc50225d62231958c85d7e2fb349544db2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875105, "uuid": "52eac5ae-c162-445c-baf9-b90943e7cade", "comment": "Malware payload (AgentTesla)", "value": "be87198820e45ff175693c96148a8e63bdbe43ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875105, "uuid": "b41a72b3-2496-47d3-b5b5-944312de1b13", "comment": "Malware payload (AgentTesla)", "value": "ad3459345e2e5b20e7c0298857f893db957a7d9a65aaf8dcac33334216638556f6babb22fc380e4f165e7f77a7899016", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875105, "uuid": "fdb6a053-f6e7-4fb8-b5d4-c4c9e12d8e10", "value": "T12215BE5D3690F99FC9278D37D9640C64D620AC639707E347A0873AAC6D7E79ACE102B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875105, "uuid": "7f6ea392-4575-4fc7-9043-8259065160cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875105, "uuid": "7dc88276-09be-4536-ae0d-17f5e803bfa5", "value": "12288:tVbFZ9OYscDWt9WrEox2mLbHshAFcZ3kzfuMESujCOQ2Qh3ISalB64JY8ivKe0ID:vFZdrDWt9nox2mLcF/LY3h3R4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652875105, "uuid": "e787f57b-767d-4e5d-99a5-6219635484d3", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652875105, "uuid": "f6c9ea6a-95a8-416c-90c8-dcf893895dde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875105, "uuid": "c9c607e5-f2ba-4d30-8924-030d8709295f", "value": "SecuriteInfo.com.Variant.Strictor.267077.13266.31264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ef6f2c-d648-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836771, "uuid": "aaff6e45-cf5c-48f7-ac06-50d656b6a5aa", "comment": "Malware payload (Heodo)", "value": "1e5a83ee80a9716a9d62bee411cc7728", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836771, "uuid": "e1d72d32-3201-43b3-9ed5-3fbe2404a165", "comment": "Malware payload (Heodo)", "value": "ac26205e5f002c18e6611b6b8246df23fa7ca7385f2cef9641ef9d786507988a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836771, "uuid": "ff1a544a-f4cc-4828-a757-6ba4ae3bd2b2", "comment": "Malware payload (Heodo)", "value": "85bd533402594684e87468d77cb00ada199a8eb5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836771, "uuid": "56633a26-7bb5-430b-a77a-243add927b42", "comment": "Malware payload (Heodo)", "value": "b8b92ccfbbb8725e2b5d120e4e79118e85cddf1475a4a7788ecbd52fe9bbd7f101f2a7366f423d9b87c06f9572da9bb7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836771, "uuid": "b1e50cb0-7eac-4e8c-9359-10949314e01d", "value": "T11CA48C4AA6AC58B4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836771, "uuid": "8445136f-56a4-4606-883d-78480cf931b4", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836771, "uuid": "23da3eee-bac3-4448-93e6-5ca7d7cfc1f1", "value": "12288:uS4BnAed8BK2o0apa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKsa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836771, "uuid": "8a8ba64e-bf30-4f2c-9d7e-40e3002fdfbf", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836771, "uuid": "62c9e129-c09a-4fec-8700-2f99178e03aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836771, "uuid": "0c18ae6a-cf3b-4726-8713-cd6b08eaf508", "value": "1e5a83ee80a9716a9d62bee411cc7728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7404356-d6ad-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652880320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880320, "uuid": "6a944909-3a9a-456e-8aec-9400fa097b68", "comment": "Malware payload", "value": "bb90eb3563a8d8607dc84784c83d670d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880320, "uuid": "a746796e-aece-42af-8a66-efc0816f8bed", "comment": "Malware payload", "value": "ac933635d2fe116f3133190674e6e242eecf8a24c0d39bdcd443fd9c0a08add4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880320, "uuid": "d38a3f86-7367-4797-8b97-8f0f2387a6ac", "comment": "Malware payload", "value": "cc18996e4cfdc2ca23d7acd242f2be6650274314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880320, "uuid": "67cb735a-f733-4e13-bae2-3ca12300c688", "comment": "Malware payload", "value": "b0e906b673b2afad96d0b695817b0a8ad4bba3737e6faebadeb8cdbb7eba172cd8fc2bb034219bf47cc8883ab37d5cf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880320, "uuid": "35bab4e6-41e1-4f88-b653-14be44f0b486", "value": "T1C5F2F732A25AC291C55442F9D8A7F6F003B4DE339422DA0BB0AE3F1B7A337C5CA55725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880320, "uuid": "00114849-e8b3-4ff8-80a5-76b3010c8423", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880320, "uuid": "697c0125-2d44-41da-9662-26f927b2063b", "value": "384:A/TRwFWrI4crkJmJoeprIT+iY07iMmU74bllGss/qVQvqGqWI4IDZGbINlVNPrtX:AOFK+ojT+i7wlmeQvc444gF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652880320, "uuid": "92b8c9fd-b8c7-4dc2-bac4-fd2043cb1d47", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652880320, "uuid": "366dcc4e-4f6a-462a-9b7a-1e9fbae6fbff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880320, "uuid": "f2b1f88e-7ea9-4327-a49a-0bdb500f36ff", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe27f5bd-d660-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652847261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847261, "uuid": "f41a8ab0-6e47-4e36-b93b-9d454624bb74", "comment": "Malware payload (Mirai)", "value": "2ac08f0be199139cc9bd5d894c06a918", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847261, "uuid": "66e92689-9a07-4995-b8de-a113c36a0c60", "comment": "Malware payload (Mirai)", "value": "acaa1c0caf0524afa5f8c85b2bb344c91bd9e0f63298e0ae5f47f5cfa8562723", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847261, "uuid": "899c7a2c-730e-4c3e-8fc6-f5a77333a2fb", "comment": "Malware payload (Mirai)", "value": "dc3acbe956d2a80b88d12802c02c33fea0cf5311", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847261, "uuid": "adf7c0c6-9cc7-4950-a253-89d2688108ec", "comment": "Malware payload (Mirai)", "value": "b683d34f7fe8015de0a40300faba4bbcea50138a1dacff073a9fc47ccf7423f8ef42bf16010646d10276d54d4f42ade3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847261, "uuid": "947cf17d-708d-4da2-a12f-1e2896978c56", "value": "T105633A46BC819612CAD523B7FB2E01CD372663A8D2DF3217DE115F1173CA96B0E6B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847261, "uuid": "4a3e5975-6609-4f46-b7ae-f651e14388aa", "value": "1536:8ldtXbfvW9+VSmCCjaWlUhHFSP1E60/Fd7d4sDZv64:8ldtr4+VKLFSPW6Gxlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652847261, "uuid": "e8b6e3f5-1803-4c09-8e8f-15383b6b507f", "value": 72944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652847261, "uuid": "c2b36ef1-be54-464b-9e36-60cbe7177237", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847261, "uuid": "c6f1d42e-3cb2-4839-9c48-c6ecaa22a207", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf97433b-d673-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652855343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855343, "uuid": "aeed26da-df7c-441d-b9af-7ac9b1bc680c", "comment": "Malware payload", "value": "9513f913759db729ab2ee7d8b8da52a6", "object_relation": "md5", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855343, "uuid": "21fe0e29-e305-4e2b-9af5-dea685b2dd0c", "comment": "Malware payload", "value": "acbd2bf4fd0d2f68aa7d1f645dcb8e1b18eb97f6c097cadb3a1ac7caf59737f0", "object_relation": "sha256", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855343, "uuid": "8d28c274-0bfc-4c31-b8b4-35a52048342f", "comment": "Malware payload", "value": "dbc55229da1c2c151bdfc7d18e5d19598b9be0f8", "object_relation": "sha1", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855343, "uuid": "28f871b6-5b83-491e-98f4-d2125eceaf05", "comment": "Malware payload", "value": "e44a3c239d9d1b41fe2e39d4d30b3dff277256fd9d635b905959fea88aba413495ee9b9ae17d3d842099be1c82c0a0dc", "object_relation": "sha3-384", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855343, "uuid": "b163945c-8f4d-496d-bb58-89806db6cbc0", "value": "T1221733EE1AF114A7C1540AB49959FFE02960EDB83B11CA497F80BCCDBE327E055712E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855343, "uuid": "21ced12a-a429-4f2c-abef-39e3dc07bd85", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855343, "uuid": "bd494689-2249-44cf-b057-9e328b838a05", "value": "393216:CjFm1eNrLwbMa3y8RiyN/FsI0yvk75f5xNJkmROwkWTVOh2zbWVI:TcroF3yPs/FOy875f5tOwhAhyuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652855343, "uuid": "9f7fe9e1-d860-4136-b319-c612a6be4faf", "value": 20009261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652855343, "uuid": "c2ef7f08-e651-4a2b-95dd-2de136cfc82c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855343, "uuid": "145a24d4-035e-4084-8378-525236d4edc5", "value": "HOW_TO_NFT.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee85de53-d68f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652867421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867421, "uuid": "1f7ea69c-1446-4687-a2a6-7dbeff4a2629", "comment": "Malware payload (Heodo)", "value": "1fddcbc17dfcff27f2625666589972f6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867421, "uuid": "c650b54b-afcd-4f76-ba1c-889280793bd1", "comment": "Malware payload (Heodo)", "value": "ad99748d1f839e4e509053771b82de3c2050b3c1f4aeaada973f077fac83fcd5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867421, "uuid": "e7a2c96f-42dc-4287-866c-242a157d8105", "comment": "Malware payload (Heodo)", "value": "b327e69d9f5eb35024100e20f76e6480ef340c0a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867421, "uuid": "7a8e58ee-24c7-41d9-85f1-f351ec4c40cc", "comment": "Malware payload (Heodo)", "value": "2abb74564a81d23980ab472e8f3a655b679f083d4850db6232f3180b86255f8850c7beeb5897ee8399986caa4d0d9788", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867421, "uuid": "1aa8e476-c657-4291-8c46-f8e93d92310b", "value": "T11394CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867421, "uuid": "39dd63fc-92fa-4a60-981f-7d2fec49454a", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867421, "uuid": "aa925612-bd25-45ab-9a6c-08905a58b7db", "value": "12288:M3hV6Pw4aT23s2o7d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ci3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652867421, "uuid": "66412c30-f377-43b7-938f-382e6c71a78d", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652867421, "uuid": "3b9272b8-8313-458b-b92c-4ca815bb12d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867421, "uuid": "7c4ab7b0-61eb-4135-9b4a-5d0635beec61", "value": "1fddcbc17dfcff27f2625666589972f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebebfc2-d68d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652866455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866455, "uuid": "cecf0f80-8b75-4c49-ae61-fcf66dd93b20", "comment": "Malware payload (AgentTesla)", "value": "715afcf19d167329ddc6d413c04dfcd3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866455, "uuid": "eaa664fa-86a2-45f8-b3b8-02eee1ee7c86", "comment": "Malware payload (AgentTesla)", "value": "ada82cc63307ef87e14cfdcb3e01265fa581b4f55076dcff53e7421b6a2c8830", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866455, "uuid": "f2ef1277-ad30-44df-bffb-c8e4f91916f1", "comment": "Malware payload (AgentTesla)", "value": "44b959d955715bc6609e7eb778f79a1f0a22b0ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652866455, "uuid": "bd808115-255b-4b8b-b4b7-b4dd5e86ae1e", "comment": "Malware payload (AgentTesla)", "value": "e895facbf8b0c5d4e59f7bb8728a24f0f1767f995a3e8b2f7f141be3a27e2d3b973f7992e0b6832e4f52d252135996d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866455, "uuid": "f22c8817-2116-496d-b56f-35d12cf77654", "value": "T1ECE4F12836B9DE22C6680271D0D3602013B1D9879272D7873FCA97E64D527D76DCAB8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866455, "uuid": "a20d56d5-64e7-405b-a85b-57de09a9b20c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866455, "uuid": "2ad7f098-78e8-48ab-99cb-ab4bc14e229e", "value": "12288:M5WZ2bWzg3xziSr0hlgmMmdcL4jPen2xrnQpv74R/iSQanPHav2mny5ROYx4:vZOWwxWSIlH2Pn0Dc74RqSQaPHe2mnSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652866455, "uuid": "c39a21a3-63da-4128-9919-9da37317d723", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652866455, "uuid": "c11a094c-d9b1-43b3-87b6-3fa48b500a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652866455, "uuid": "5887f295-3beb-4d1b-9fc8-73c413deaee6", "value": "SecuriteInfo.com.Variant.MSILHeracles.38451.4565.31759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec55b6c7-d6ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652880302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880302, "uuid": "a688bbc4-2f9b-4350-bb55-87a1523dbbfc", "comment": "Malware payload (Loki)", "value": "6b5e5c1f1b3707a6376a6bfbc6efea3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880302, "uuid": "708c3ebb-5492-47ae-9810-e7239c87b0f4", "comment": "Malware payload (Loki)", "value": "ada9d56dd5b2d71b1c472891e8985ab68e42cca617e935346c886c50d980ea20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880302, "uuid": "f3241a0d-ec36-4209-89e2-b08ed0a34ac6", "comment": "Malware payload (Loki)", "value": "7d086eca80ccc85d16825aeacdb13f23aedeb378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880302, "uuid": "84769790-0932-4267-88f2-3bd8f1c53d3e", "comment": "Malware payload (Loki)", "value": "2c6f71358cb7b18e87828b9e66ccd21425ca1ddf278e4292c226481838f550ecf84269b3b65339cc524c05d06cba0346", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880302, "uuid": "85ea650a-af17-4beb-9578-ff53d5c2bcc1", "value": "T140C22A5BB79C5370E52A97BFC083A5100373D7D6AA67CA1E347A33069C13396CB6264E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880302, "uuid": "13dfee1e-1923-4fa0-a72a-d8998d26dd36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880302, "uuid": "fe93efa1-b3e2-4be8-8864-9480fa236b4e", "value": "384:+tZwvmVxmqWKn7UiOzXNI0kgsiaKnb5NW6jI7SxtOi+l0v3jD5XADHf8F3LCcI:qs45bnYLzXNI0kjG38MZc85LM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652880302, "uuid": "3c0640f4-3e4a-4ab0-bc1b-0abd2583909f", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652880302, "uuid": "503034a0-2335-45f4-8d18-bbb95798a1ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880302, "uuid": "bcee46af-66a4-4860-bedf-7539254ee076", "value": "Inquiry_550.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef9ab77-d6ee-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908224, "uuid": "6fad0bb4-3de0-4b5b-9952-61443c6dd33c", "comment": "Malware payload", "value": "bba5899e5f67358ffaf0797d676d7d7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908224, "uuid": "f846a503-25c6-48ba-9ab4-4ef9ded9f05e", "comment": "Malware payload", "value": "adfc24cdf18a7d1dfff4e0d654299f1dece4cf5aa36f3e15927044b9e4fa1879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908224, "uuid": "e8e42bdd-ed1c-4899-a40c-1bba6102df8a", "comment": "Malware payload", "value": "c078dab1c9bee42cfb660e172b267d4dbf3151b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908224, "uuid": "5541b20f-93c5-4a7f-8671-66376271964a", "comment": "Malware payload", "value": "d00f32c9006ce63cb80a375054ecd922ab3f540e447fca8a7d12a6ee16ea82cf4b99d604a2e81700e0991650d7c3606b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908224, "uuid": "cec479ed-49de-469f-a06a-12ce820182b6", "value": "T13905283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908224, "uuid": "8bf469e4-3845-4584-80c9-2ce8c1857337", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908224, "uuid": "d9a81079-af08-4841-a64b-fbde804b2c9a", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy70mpE3:BTg9UXRD2SeqfZZi4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908224, "uuid": "ae4cceb3-2290-43aa-8094-8ebb577ac15f", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908224, "uuid": "197fbddf-d74f-4cad-bd58-052bea827aba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908224, "uuid": "0e2a1c2b-de80-406d-9c3a-68d0eb537400", "value": "bba5899e5f67358ffaf0797d676d7d7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba045090-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652858743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858743, "uuid": "1aa14a45-b43f-489f-b52c-9bebded9d440", "comment": "Malware payload (Heodo)", "value": "419aa3ba4dcd0b63fefda028f82e1114", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858743, "uuid": "72542a04-3808-44e1-a025-e708cadbdaa9", "comment": "Malware payload (Heodo)", "value": "aef2647ca0258fabfa2505861fb6d4738525496eb5fd6f7ae166ab43e48f484e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858743, "uuid": "7f3dad5a-3b9e-4c11-a8be-ad34772659da", "comment": "Malware payload (Heodo)", "value": "3df05a93d8dd16defaf0018c2ba3cefd04a871fa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858743, "uuid": "35a138cb-5a36-41c4-8f45-1760fb544c87", "comment": "Malware payload (Heodo)", "value": "0ada73651e84f2ad43e13e3a94ea88303ee4d3ae12f0c768ffe603232af03794c678064ad9a11a85597588479c41a89c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858743, "uuid": "cf07c959-ab5e-4bcb-a6a6-ecaa7fef345f", "value": "T1C594CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858743, "uuid": "b308a217-403e-4b2d-9aeb-03085bd3bc41", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858743, "uuid": "f1f7b901-696a-4728-b72b-596c584f0a9b", "value": "12288:M3hV6Pw4aT23s2o6d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2li3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858743, "uuid": "c499048d-f131-478c-9f10-fc8f143d4e41", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858743, "uuid": "1f970efc-13c3-4a50-b244-8030fe93e3a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858743, "uuid": "153190f4-f32e-4035-b8cd-dfccdf0ce787", "value": "419aa3ba4dcd0b63fefda028f82e1114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4971fda2-d689-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652864567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864567, "uuid": "e24269f4-cc87-4195-affd-099baee9ec29", "comment": "Malware payload (Heodo)", "value": "4def59d0cc408f737c0c9b0281ed7ff2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864567, "uuid": "0aa53268-c4bf-4707-89cf-7f44cc9a5c90", "comment": "Malware payload (Heodo)", "value": "b0083f057dd796e3c1b218d5363b18e82ef183932d8ddbcab5bc71699063f84d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864567, "uuid": "13159837-6c27-4a44-b8bd-884251021bdc", "comment": "Malware payload (Heodo)", "value": "b860c8430fa7b5e6d7ab70587917a23a73dcb599", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864567, "uuid": "1386c9fd-8e68-40cf-92ca-c9dd404c1cc9", "comment": "Malware payload (Heodo)", "value": "d53e7c46028d8cd485573123c0a2459d249de40fe074ec67054e567b2f30b7852fe7a151af9e35193019a39b14799747", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864567, "uuid": "bbda9233-6149-47a9-b256-a922ba9daeff", "value": "T12794CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864567, "uuid": "7af61cc2-a6aa-43e0-8352-9d8ad9777277", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864567, "uuid": "e46d1178-ce04-44cb-aa51-a9a1892c891d", "value": "12288:M3hV6Pw4aT23s2old9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ii3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652864567, "uuid": "e8d4a485-06a9-4608-9919-93c1d35bf8dc", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652864567, "uuid": "08b132ff-8b8a-46b8-8790-c0a11475f5ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864567, "uuid": "4bcf7334-8c54-4321-83d5-02c58c60dc70", "value": "4def59d0cc408f737c0c9b0281ed7ff2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956c5edd-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908932, "uuid": "2592341f-bfba-41d9-b497-12b1982fee9f", "comment": "Malware payload", "value": "89e24225da85f18b441307b2885f297a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908932, "uuid": "03bc83d3-70a4-42b9-87b6-be1c56403d47", "comment": "Malware payload", "value": "b06b007c51a79ccaf4a4145797517a6d46e7292e7d1abf66d5103543fe8bb6cf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908932, "uuid": "d59f3f6d-0c4b-49d0-a95b-a32a7e479ac4", "comment": "Malware payload", "value": "7bedc0225361538741ca9bbb37e3a8e14c46acd1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908932, "uuid": "3f5526ee-ef2c-4ca8-9bed-e79eb7f7ee48", "comment": "Malware payload", "value": "ab210d1ab08c4c50081ace39c458eedf6c7717e5d78e261e200b2dfef10e2b47a3d1a75276cb14385e41f35bce19ff9d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908932, "uuid": "a9fbca46-a1a1-459a-8d7c-874edaab60c0", "value": "T1BB316D8073A13A753EF31EA3637458107285A4256C909DC5E6FEB8F48D9EF092A801FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908932, "uuid": "84631f5d-08f8-43b1-bf6a-2c775a394493", "value": "24:Ij6OeRaIOeXWkaUoOejoOevOe+Oev5OecMOe5eOerOl:dlwLoXmX5Xheje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908932, "uuid": "35e30ed7-0e84-4049-8d2f-61844ed5ed4f", "value": 1850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908932, "uuid": "723169d6-fde7-4c5b-995c-eb470e8ca882", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908932, "uuid": "160579a1-2384-4861-9c64-86d255e864b7", "value": "b06b007c51a79ccaf4a4145797517a6d46e7292e7d1abf66d5103543fe8bb6cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3624bf3-d677-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652857094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652857094, "uuid": "9599d486-937e-404f-a57a-9510f3782c97", "comment": "Malware payload", "value": "7b2433d2ca33c95587e325245402ffc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652857094, "uuid": "0d9038b1-252d-44cc-9fc1-62def1441c52", "comment": "Malware payload", "value": "b0bbd1bf8657c5c7f69e100d7d7127ebe73528730e8e74f277b21c43ce7a4aa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652857094, "uuid": "54d9a42f-8c08-437d-ac4a-efd1bfd821ad", "comment": "Malware payload", "value": "c38c029fff9e59dc9972bcbc2880a0d32e4ea00f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652857094, "uuid": "48d00f55-3595-4e82-8933-159eb8049408", "comment": "Malware payload", "value": "b4ae305a81f1062d1a0223c4dbf6cb33d559a02ca02fa627abe75a60b443069935963dd31bf56677534b81ab2f9ace2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652857094, "uuid": "f04a265f-62ae-4e93-a083-5d6deb131c5c", "value": "T16CE4F15E7AA6DE63C2584372C1D3442503B1965BA373D78B3ECD12C90E027A5BCCDB9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652857094, "uuid": "21038f79-6eda-4962-9183-a5c8c26065b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652857094, "uuid": "f9ea3993-a555-4a3d-8def-56fbedcd24a6", "value": "12288:6UIKlFnV+PKiapwZC6Ad99rGK9s+gHlMYo/eP4EzkrwDMI3+:6UIkD+nHZC6AdDrtm1PRVDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652857094, "uuid": "ac2dcb79-6bf0-45fa-91ac-09a727245302", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652857094, "uuid": "fc1f8b66-e7fa-490a-bb8f-d928ecb40aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652857094, "uuid": "993cfec5-7b83-46c0-941a-1d442fd25671", "value": "RFQ.pdf.ra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5cb632-d6bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652885968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885968, "uuid": "d5d18b2b-4651-4517-8fb7-338265219349", "comment": "Malware payload (SilentBuilder)", "value": "0591c224535324764081eb46a7f64ddf", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885968, "uuid": "c101b517-f85e-431e-91b2-fd705fdea854", "comment": "Malware payload (SilentBuilder)", "value": "b0c52fae66a3490bd28cb077420e45ee50214ffcf7a00b3ca332d6f363d3bf4e", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885968, "uuid": "f27065d6-027f-4531-bcf3-cc953358a441", "comment": "Malware payload (SilentBuilder)", "value": "968a0a2e24c32e52e7a0fb2942a95a6a742c77ae", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885968, "uuid": "a15edd5a-3b25-4d5d-94e6-d76c194a9caa", "comment": "Malware payload (SilentBuilder)", "value": "7df7b5c48ea754b60a25614f13e4401e5e8857e62cfa872781058c66019adf51da2efa2666bcd9a6a4c7802409d495c4", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885968, "uuid": "37654d99-401c-4094-85b0-2d2e718f522b", "value": "T12A44D04272899439E8EE9774148B4A91D23FFC10EB5A5E4A330233FA7F756B05E1236D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885968, "uuid": "d2371372-6f36-4eb2-ad8a-63d130b1eaeb", "value": "6144:CKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgiE5BLgId0uJizpgV2h12N0SpbLbFdl:T5BLgogFgV2hw2QLbFdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652885968, "uuid": "aa7f4e10-d765-4205-8a20-9a481c1c58b0", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652885968, "uuid": "65e333a4-3ca9-4034-98df-a2fb187e1626", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885968, "uuid": "a5b59e7c-1711-4f78-872e-808a092ca12e", "value": "L2936218686.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4f208e-d6c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652891467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891467, "uuid": "c40c87a4-9ab5-462f-85b2-0bc8f0f355e1", "comment": "Malware payload (Mirai)", "value": "2a66cf4ad7ed4d4ba541081a0b6eff1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891467, "uuid": "3609c34f-08b7-4829-b1a2-577ef40c9801", "comment": "Malware payload (Mirai)", "value": "b112ffbd8099b866412dee3697b23dc63836c06dacc079f2fc65082ce0b78686", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891467, "uuid": "926937ca-c6e7-4bd3-b898-e8cd70d1148e", "comment": "Malware payload (Mirai)", "value": "956cd6b7d165037b442f9b1fa321421674cf32cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891467, "uuid": "a7631858-ebec-4897-817c-cefe9ccfb52c", "comment": "Malware payload (Mirai)", "value": "e42fb9b0053c75bfc267b09f958e25bbe4e3ee6682cb2dae3772d67ec24e74dfc460dd2673a0ce49ef7e5e76c260f463", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891467, "uuid": "646395be-d72d-4674-bfe2-0cf69f59d889", "value": "T1D093734D3E219F7DFFAC823887B75A21A64823DA66E1C585D05CFA021E7034E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891467, "uuid": "8dbaaee0-e2f3-4fe3-aa0f-affc7261dd12", "value": "1536:1YRdsnDd6C6gb/ZVyDYjMbwqZ9f0vfwW9ufY1C+KBtyRirfXDOiOc3J:CHsnD8/gb/zyDv9f0HD9FC+KBtyR6/Dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652891467, "uuid": "58531931-1112-4aca-91a8-58b22909970f", "value": 89332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652891467, "uuid": "a36df178-64cc-429a-b9d0-2b085977acfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891467, "uuid": "3a03a5bd-fb17-41d4-9929-5a3909afd096", "value": "2a66cf4ad7ed4d4ba541081a0b6eff1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f017aecc-d698-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652871289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871289, "uuid": "fe46b1c9-8a70-4339-b870-d08105d55b5e", "comment": "Malware payload", "value": "e75e4c5ac3d191a4a4801673eac909e0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871289, "uuid": "de543415-478a-4197-a2fb-321b35fe489e", "comment": "Malware payload", "value": "b18bf6f096f1ec44da4c59ba95b1b6d586406960ebc5810aa4eeaca44a25e97e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871289, "uuid": "2981ac28-658b-489e-8da1-77aeae0c9b0b", "comment": "Malware payload", "value": "875f3dee5632a20e5e0cfc5b20bd886d98db9938", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871289, "uuid": "a665e3d1-254d-4bce-aaac-934644ae6404", "comment": "Malware payload", "value": "48bbbba1551b659829520d6792f3b60b631f8001d502d424b85726f19221c1fb9cdb4f1f9747a018f8c55d3a553bf462", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871289, "uuid": "8f5045b1-56c6-40f5-b9f1-23996b4c8de4", "value": "T144E216C40A06BCC81D47A65384A421F90DF265B9E97B422CFA06D19CEE08975BDFBF53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871289, "uuid": "993659b8-6e37-4bb0-b449-c7acd563bdce", "value": "192:NBxEf7f2jcOZ7dtKyR2AsiGPi3RML/B4celiJ:NKTACRGw/mDl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652871289, "uuid": "989d0653-509c-4f30-81c9-8adcb7bfb28f", "value": 31489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652871289, "uuid": "eb63cbef-abfa-49d8-a587-7b4b960f4504", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871289, "uuid": "41369fae-4a1a-489b-a260-675b5f3e72fc", "value": "Closing Statement.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2ef880-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908920, "uuid": "a4028a2d-beb5-4dc6-b14d-45758968aaf0", "comment": "Malware payload", "value": "14986e026d4042481a6e0926617ff9cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908920, "uuid": "3378311b-7c45-4cab-821f-51acfa5f8fe7", "comment": "Malware payload", "value": "b26ed76b004c0aefad3bb5034ae1fae58da158443c6c191e905637245c4f5bde", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908920, "uuid": "242f7209-b4f4-476f-a559-ef79e0733aa9", "comment": "Malware payload", "value": "db3bf4fd2baec193c44515ae2415809f6f5df16a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908920, "uuid": "a17a02dc-4a3a-462e-8b51-b67fab2cffaa", "comment": "Malware payload", "value": "9f7b7a4935c1ed8c6427f3808ef15b8538154ba85dfc2824a7d115869bbe35e7f2763959af4994a943fdc3315b449930", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908920, "uuid": "c471164c-eaf9-45db-a201-74779de5d10e", "value": "T174A1F750112C1AB07346697AD26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908920, "uuid": "46086c81-8e57-4f51-9c8a-65a1a1b5aff8", "value": "96:ERYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ERJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908920, "uuid": "038568e5-cbbf-42db-b730-19dfdb72f494", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908920, "uuid": "ccdb01be-db6b-4940-a39a-168a21995d12", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908920, "uuid": "9513219c-c5d8-450d-86f9-1cd4c82f8875", "value": "b26ed76b004c0aefad3bb5034ae1fae58da158443c6c191e905637245c4f5bde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2cd7e3-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909021, "uuid": "2bb56287-ed10-4538-974e-3645a5ae59cb", "comment": "Malware payload", "value": "8eb4d7dc9c3099285f8bd00184f45d78", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909021, "uuid": "325be5ac-d341-4a9f-83de-6baa1dc6c0fc", "comment": "Malware payload", "value": "b2ddbe13e28eb3d7520d964105a7dcb0ce4142d7128f6c66b2c06e6896d28fc3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909021, "uuid": "c7c37adb-f634-428a-94a6-eb4ea84e3bcc", "comment": "Malware payload", "value": "acea617181f3fa07009d0f5ffc7c02d338369f09", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909021, "uuid": "b4b42e39-89e9-4837-8b7b-9a88b0232544", "comment": "Malware payload", "value": "86314b27cbdde696ced3e0a21e894083b160ecb4db24aa39e9ae4b38bfc0fdcee8e43e63f62c76c4e04233c9252d12d6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909021, "uuid": "cfd99386-fadc-4ebe-8c4e-3b79169f8aec", "value": "T1DC0168696C7C103534ABCF20FA6BC019E56099C684E79761B7985935C034C28D39F0C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909021, "uuid": "3afbe5d4-47a1-4935-a66e-bde6ea4afdb5", "value": "6:z3w3tJPyHgUI2LEuZDIdkr4znIRhLEuuTapkdCibKIYFc60rYy1K3:a/Qg0X9MrALcTe0hbv6Ty1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909021, "uuid": "b07123d5-9a20-4da0-9916-a0419f0acc68", "value": 711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909021, "uuid": "023345be-fe4a-4639-ac45-23cc402cdfc0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909021, "uuid": "95baa336-3598-4bd9-9c08-521133859d48", "value": "b2ddbe13e28eb3d7520d964105a7dcb0ce4142d7128f6c66b2c06e6896d28fc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c32a556-d697-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652870557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870557, "uuid": "62ec627a-c848-4855-b3cf-9326e91d74ee", "comment": "Malware payload (Heodo)", "value": "45ea97d173c2c8e305501f926fc08952", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870557, "uuid": "351e29aa-46ef-4352-8ac9-c4a7c3a14936", "comment": "Malware payload (Heodo)", "value": "b35e88d7ce341f45718dcb26c5291bfb781034da941e59aca871f3f867a077b8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870557, "uuid": "8f9f969f-2f0d-468a-b55b-9c232a9bc6ab", "comment": "Malware payload (Heodo)", "value": "08f669c72d0bbdb9802829931800871f4761062c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870557, "uuid": "8c4618de-b3eb-434b-b088-2dfe612164fb", "comment": "Malware payload (Heodo)", "value": "3c840436790fbdf7f1f9fe7b09eee7d0bf72c5be56e2ca7c1f257a8b3b62dea7040c4d15e64fd0c846baef68b4f442fe", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870557, "uuid": "b1d27128-02fe-4570-9271-236ac303315e", "value": "T11194CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870557, "uuid": "18a44e22-dc08-459d-9358-eb2710bf6b61", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870557, "uuid": "8dbb1265-67e0-448b-ad3c-1ae796a8aa60", "value": "12288:43hV6Pw4aT23GuoDv91Wuwf07EIvH3+38+:sb6Pw4R3GucWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652870557, "uuid": "477728ee-ba6a-40a7-921c-986615c79a27", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652870557, "uuid": "d46b15d6-8eae-4481-8227-b6a7b5f5ab48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870557, "uuid": "d58cd092-aea3-4ca1-a975-2a1269e8cc9e", "value": "45ea97d173c2c8e305501f926fc08952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636856cd-d6b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652884797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884797, "uuid": "44db994f-2832-4d17-8e3d-679f501eb530", "comment": "Malware payload (Heodo)", "value": "ba6ed379e3e91abb297edf178c2ac0de", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884797, "uuid": "e4e4b383-adcc-4979-b03e-e8ec081c338d", "comment": "Malware payload (Heodo)", "value": "b3c9d4664e0bfdacd301939b5ab6d84ab2df88017d7c573f235772a175143024", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884797, "uuid": "8b22a224-f6ff-47cb-90d7-de9d65e5e2d8", "comment": "Malware payload (Heodo)", "value": "0fbf38534ebecffc5c0ccd06631f44433072026f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884797, "uuid": "98faff50-86a9-46b0-9c1b-a3db79f14242", "comment": "Malware payload (Heodo)", "value": "a7f3ba0e4162f7192715d758069a1f9d00f384d320ac667a00b84d5c27014d107942f238cd44ae4068df3f4d74f2ac0c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884797, "uuid": "02b01ee1-580c-4a96-9ea4-fdcdfbdc1431", "value": "T1F954E007A2E940BBE9678278DC570B06D3B2B81257659B9F0371476A2F1B3B14D3EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884797, "uuid": "c12899fc-f3dd-4dfc-95e3-52023b50cdd5", "value": "8814d1a94d80f9b49a103ad2cb419460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884797, "uuid": "43b9cf2f-6aad-4b4a-ab51-f5e1584d828c", "value": "6144:yRjSsk3AzLPQWKgbZJpDphv4MOTRqhTAK3yUil5FCsCfHG72:ojVhTQWVblv4RqFAKiNL4tm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652884797, "uuid": "f459f203-05d9-4bae-aa08-b002d0cc4cc4", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652884797, "uuid": "d6b009e4-330c-4c9b-a8d7-7c64bc69a46e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884797, "uuid": "60d0ba64-ee03-40fd-9f43-2f49a68fc5b2", "value": "ba6ed379e3e91abb297edf178c2ac0de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4f7919-d6b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652884761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884761, "uuid": "4446c1d6-d95b-415a-b74a-f4c0ebb8ffa6", "comment": "Malware payload (Heodo)", "value": "46d468f300406d1913cb7d716e983f58", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884761, "uuid": "94053b5a-7627-4bff-8219-c1a6658ccf5d", "comment": "Malware payload (Heodo)", "value": "b46056c7d16788641b31cda4bf85101ceada026cffeb0dd20dff463290835552", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884761, "uuid": "aee565e7-ab5a-4c30-8109-c858cc91c238", "comment": "Malware payload (Heodo)", "value": "ae19c92d1cde94cdd60dfd575856bfd086a09221", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884761, "uuid": "1ca423fe-c96f-4c09-8ee3-2b174b3092a6", "comment": "Malware payload (Heodo)", "value": "76e33ad1e098018c869a287118f71e91464a68581cfa70b128508a9554abfe834998b1041dd24b53498956566c3a4e0b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884761, "uuid": "7bda89f6-6d3a-48a3-b7e8-ff124b9a5159", "value": "T14D54E007A2E940BBE9678278DC570B06D3B2B81257659B9F037147662F1B3A14D3EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884761, "uuid": "370e7b17-ce70-41fa-b2cb-6b6f1cce9dfc", "value": "8814d1a94d80f9b49a103ad2cb419460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884761, "uuid": "fa146380-6341-429b-af9e-965598809be4", "value": "6144:yRjSsk3AzLPQWxgbZJpDphv4MOTRqhTAK3yUil5FCsCfHG72:ojVhTQWOblv4RqFAKiNL4tm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652884761, "uuid": "091e8f4a-d413-47e3-a6f5-5697df43b304", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652884761, "uuid": "03897fb1-0680-4d82-ae49-5c229fc0f7dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884761, "uuid": "6e851419-d2e5-4c51-923d-bf8f360903ca", "value": "46d468f300406d1913cb7d716e983f58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1644bfe3-d6bb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652885956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885956, "uuid": "7f25ce19-eff5-4fb1-bfeb-ef5f4885c1c6", "comment": "Malware payload", "value": "b9f57465b9327dc74ac5c2516d0e9002", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885956, "uuid": "215360eb-34ff-488a-b31f-7420dea431c1", "comment": "Malware payload", "value": "b48b29e2b034fb43b4bcaa32474e267393fcfb75eebff377cca8f7eb717dd412", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885956, "uuid": "a3a8dec5-cce4-4f25-8839-21120d81e9fe", "comment": "Malware payload", "value": "d25e55681a699cc54755dd343607aa3cadd9ae0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885956, "uuid": "49d6b888-f9ee-4334-ab45-bf432e9ef309", "comment": "Malware payload", "value": "92505a7147467341870018b794523599d22559c44789dc5d8df908c38041b085c55f9e8e54a7510aeb7293e6ef47a86a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885956, "uuid": "7b6b5b17-b740-4b38-8886-77d2bfb1e532", "value": "T157648C1133E2CC77D5A311328A52D3A9A2B6BF11AD368647B7D03B0E9E74151CF39B68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885956, "uuid": "bea642e6-a10c-4752-8323-dc8872a58998", "value": "60e96e281950875c6520bf758d9fd938", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885956, "uuid": "d8a80274-6e43-454a-b1f0-9fd209d226c5", "value": "6144:rJ3Pyn8z6ptn5Hq+Kupf8ZPFyNMVlX93KEPf:l3P8Hq+KupfKwoXsEPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652885956, "uuid": "be622a62-ff79-4fef-b4b0-d14cddbb63e7", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652885956, "uuid": "74981df4-8165-410c-9438-a2daaa6cfe65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885956, "uuid": "eddbaf03-657f-4acc-8df9-b050b7351bf7", "value": "b9f57465b9327dc74ac5c2516d0e9002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051057c9-d66b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652851567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851567, "uuid": "143c77e7-9027-4358-8670-c51178ba3415", "comment": "Malware payload", "value": "6075d28bcde2586f64d6cbaf1d99422b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851567, "uuid": "0a923772-8382-4e16-ad2c-531274be6c78", "comment": "Malware payload", "value": "b4e1e349515f68dced149fb0c4e8d88dadaceff26e98d762f7f73aff79887e2a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851567, "uuid": "2ac59e19-336f-476f-881c-a625789724f7", "comment": "Malware payload", "value": "e4ca4e01451f9777c5d6d96ce78021e0ae42afbb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652851567, "uuid": "8ca29968-ba77-4087-8891-26fd5c3e3b27", "comment": "Malware payload", "value": "c997e0f9aa7b7216f48573d66f07f3c3c96d3c31917373aeb2ff43bd065c5521ce015d89e9eb7fb11f4b620d6eaddc6c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851567, "uuid": "27a64b01-ffe7-4045-8357-4598a6563125", "value": "T15C94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851567, "uuid": "78b461f9-26db-4bfc-869c-5729199f62b3", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851567, "uuid": "473c8003-cdaf-475c-a767-5a16ffa9a6d3", "value": "12288:M3hV6Pw4aT23s2oed9zi3BBoNIQ/hsA7:Yb6Pw4R3s2hi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652851567, "uuid": "4448e439-abfa-4d08-9b1a-1006f5d20bd0", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652851567, "uuid": "6965bdc4-1b8e-465b-bd7b-9cd0f149e388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652851567, "uuid": "d0d1bb4d-c0e1-450c-bdbc-e781f8e7ea83", "value": "B4E1E349515F68DCED149FB0C4E8D88DADACEFF26E98D762F7F73AFF79887E2A.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e83de2-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908930, "uuid": "be0ca2a8-fb6f-40d2-9be3-ddc18f3839a3", "comment": "Malware payload", "value": "677026eed9c1ffbd8c8f6dba2b93e1ff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908930, "uuid": "ba79be40-9731-4213-afb2-c2342c64b64c", "comment": "Malware payload", "value": "b517b027d32f59c8a6a7e6ebe3b5aeafa50a62206c3763375dabf2d183835765", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908930, "uuid": "e39e05f3-b93a-4f75-bf97-a7780822fa2d", "comment": "Malware payload", "value": "d8f9910755f83ebe94acd1a57943f71f4f09bd14", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908930, "uuid": "4bc307c0-53ce-4433-8553-2d48e48e8111", "comment": "Malware payload", "value": "ca693fa1c52eba9acfbff7df854d841ca3af32177aba8ae0e1949a9216426179f620b566d0a7a539db63407fe0969b2e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908930, "uuid": "66bf475a-e759-4cd1-a66d-737162f43f78", "value": "T1E8E210058EE34950A373F46667CDA4097F9B84C74F8BAE243C4D529AAF9137493F4A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908930, "uuid": "3ab3455b-f1a9-4f99-9d4a-f90e4e05c8e4", "value": "384:AIoq47z2YEERHBC+B4z6JdfB7SevtTJJJ2JJJ2efveSPN788T:AIoq47z2YEMHBC+7XDPiZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908930, "uuid": "0a3b540f-6d08-4c3c-a32e-6f0fe88d64bb", "value": 32861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908930, "uuid": "bea165a1-f814-4740-b961-d5c92142d72d", "value": "text/x-perl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908930, "uuid": "4509ed2b-c57f-4701-aa66-207005098454", "value": "b517b027d32f59c8a6a7e6ebe3b5aeafa50a62206c3763375dabf2d183835765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4296713a-d6c1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652888607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888607, "uuid": "cb4b839f-371c-4cbd-834d-8cc42a4387b5", "comment": "Malware payload", "value": "e144a7e485f28f9c9867c3a5152f541a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888607, "uuid": "452fd7fd-99ff-426b-b3bb-930914a1da3b", "comment": "Malware payload", "value": "b5863cf6a4eedefd0a943d6fdd0eddbfae87a93bdc71a45c99b85d4954ca1040", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888607, "uuid": "b98ed976-9848-4709-b52c-6004a025aa62", "comment": "Malware payload", "value": "941544f56472aca8cc635578761e5a5d1e5629cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888607, "uuid": "ec89253d-d0d3-4a3b-be74-664a58705b09", "comment": "Malware payload", "value": "24ddfd530c0627fdd61fac4ed9287a620408a5aa13e3cfacc854e6cb9ae1d4eea9e512121a45332e80e4cd2e2705e7f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888607, "uuid": "b4c4a6f8-d1d7-4e36-b22a-be0fa5c25875", "value": "T1FF94C04A73A50CB9EC7282798C574A01E672B8150771EA7F03E0875ADF2B3D1A93F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888607, "uuid": "7cc9d978-6c0f-4f5b-9310-e1dcba47d570", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888607, "uuid": "41b1db93-0657-4293-a672-b7f3a6fad9f8", "value": "6144:GgIYnzcJxDpmJIyeV2vR3JDEohvEuRfoP1SKL0w+d7sWOQSH0E9cWdb3BHq:yKz+1pcIuvR3lEoREu+9T0Rd4Hr9H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652888607, "uuid": "51f065b0-8faa-4c51-9213-92700f020645", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652888607, "uuid": "c3ff6e31-7b70-45ef-85ee-bf83ba012617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888607, "uuid": "4fd152e7-b8df-4d33-9003-530fb7a310f1", "value": "e144a7e485f28f9c9867c3a5152f541a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342ba18d-d6e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652903186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652903186, "uuid": "b9ad9ac8-17cc-4dd1-97ce-34c9184cff89", "comment": "Malware payload (RedLineStealer)", "value": "3d87b0a0a5be0172ab1e096c961bb794", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652903186, "uuid": "966a0526-012a-4b7a-a1f6-63d8465613b8", "comment": "Malware payload (RedLineStealer)", "value": "b5b3f5eb4eb1c1c146c7ececddc3872d7d93ea20a5287352cbd19a0b043b4c87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652903186, "uuid": "5c3def8a-01b4-47c5-af67-6f12558b45d0", "comment": "Malware payload (RedLineStealer)", "value": "a5047420a38bf08234bd46b150d8ec1cb9e49616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652903186, "uuid": "81447af9-ed2a-45a2-8da0-c3dd3a3e60db", "comment": "Malware payload (RedLineStealer)", "value": "89be943352db7124bb4ed23719c648803b692d79c7e6851edb5747f2edd897af3c81b014a1768f9dd16ef2ea9c844698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652903186, "uuid": "bba6ed8e-d35a-418b-962c-d09ee974416e", "value": "T1C394F100BB908C74E1211D3044B4D7B25B3BBD626675A44BE3949BAF1FB33A15BBA317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652903186, "uuid": "b4584463-4d7f-462a-b3f5-5c3180512ec1", "value": "772437747c205badf1dd67f2dee75de8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652903186, "uuid": "9ea02fa7-a5d6-4165-9fb1-325dd3389d98", "value": "6144:k9HERMK+UwyCDHaX40jAk0L78OabyuGIzi7mtiga3wVf:KERMB0COI0R0LlCypKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652903186, "uuid": "bbf0e966-7151-477f-8d4a-3a78e449da29", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652903186, "uuid": "4cdff5fb-85f9-4180-992a-6c340303f5df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652903186, "uuid": "76c2325f-56c5-4dcc-a76a-0e7675853295", "value": "3d87b0a0a5be0172ab1e096c961bb794.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d36f6c8-d670-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652853782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652853782, "uuid": "b9c30a13-a4cd-43ae-8198-5e5925a42c75", "comment": "Malware payload (AgentTesla)", "value": "015954859f8ac80d76b97720c726c24a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652853782, "uuid": "cda855d0-ea89-4425-aab7-440e11f34002", "comment": "Malware payload (AgentTesla)", "value": "b5bb2779f0527200837d519ee00b5a45d1cf8d40c2a4cba5031eb4fd14113271", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652853782, "uuid": "11a959e6-1ca2-43a5-b640-171afaa012ba", "comment": "Malware payload (AgentTesla)", "value": "6c9a4f16280f85b756c1b2c10b052b541ded92d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652853782, "uuid": "cb5480de-f21a-4680-a0d5-92815888c78c", "comment": "Malware payload (AgentTesla)", "value": "bfc7fcae58e3af7396329966111132046067fe5001f793d183761e712d270f66be7a4c768657fc33496f2e04a2ce8657", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652853782, "uuid": "12bef8b1-bc84-4cdf-b5b7-29f985f37057", "value": "T110E4F12952B8DE55E9AA83FED06216F807756D07D402F78BCEA47CDA3D32380471A61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652853782, "uuid": "de3c1cb0-7632-473d-9024-bd1cc3fb695c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652853782, "uuid": "0d8ff819-359b-44b7-b7af-91eeaf27f1f6", "value": "12288:04RAs1tc8XGmdyND+J3zc2ORZpIxy5/ZvwfBnL6W6WMHNiHesETvBy:Vus1tBWZgpzXuIQ5/RPWXHezpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652853782, "uuid": "b67c91fe-7bc8-48b0-b88e-49488cce9c9f", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652853782, "uuid": "2ada729c-671a-4fd1-aa9f-7fb2456ae107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652853782, "uuid": "9e8882a4-3cd7-4e17-b1e8-f62247023b26", "value": "MDmlvV50riQvp4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf798a5-d6d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1652896032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896032, "uuid": "d5eb52c7-2cac-4746-9340-7b396fb43485", "comment": "Malware payload (NetWire)", "value": "bbf58d8ca915c4d2d1ce4c19c05a12a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896032, "uuid": "f5519372-2b3b-45ae-a872-d50408975590", "comment": "Malware payload (NetWire)", "value": "b5d96ca45147cbfd601f93198aceff85cbc3c95a3acab2ff50d3b6e95220c52a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896032, "uuid": "b3a7e2dc-e588-466e-8e00-6f7d776d339e", "comment": "Malware payload (NetWire)", "value": "eccff9a9528eb12117a73e04032459ce29afe1f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896032, "uuid": "d79b3400-d6ab-4dda-913d-3405fa040670", "comment": "Malware payload (NetWire)", "value": "776694c1e0189aa15287a367d25e14b40e9cafcf92543e7b516ae600ffb0e22d2f61ec39b6be3e73b7ccc8fb4749faa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896032, "uuid": "26547996-902b-48a5-a012-5cba86d752c6", "value": "T11FE48C22665CBF15F07EC7B8A001985063F1E81FF726ED19BEE319EA0DA5F408356B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896032, "uuid": "b0ff63e1-1922-4539-866a-06e130816eb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896032, "uuid": "68cf568a-f210-495e-bda9-221fc8ae7acf", "value": "12288:cF3lC7QWXzg3QUAIHZTOSiv1g/TzINqc26A:cVqQWUfAIlOT1g/3IXRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896032, "uuid": "0ed85dae-4bd0-4c15-ad23-75d13dd12249", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896032, "uuid": "9723159d-408a-4442-8fc4-4b88cf2f435e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896032, "uuid": "24405388-ef51-4f99-aced-2b5629558fb1", "value": "SecuriteInfo.com.Variant.Lazy.184938.5859.28113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca5cf35-d6d6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652897858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897858, "uuid": "7143050a-4e9c-49ec-8b8c-6f8b57369828", "comment": "Malware payload", "value": "7ea297d34b2ba0b41bedf1e6e102dedc", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897858, "uuid": "724bf12f-0abc-4ccb-b7c0-5adcc3e13cf2", "comment": "Malware payload", "value": "b6496eb82b1528ca5b76f97977bf81c78eb64d47344a497399e6ff97b157ba7d", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897858, "uuid": "dd94f050-d81f-4ed4-8393-54d5fe830fe8", "comment": "Malware payload", "value": "b17a82aaf914de3efab1bdc838dd883c31ca0ee1", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897858, "uuid": "b061619a-666d-4755-944f-dd0ea36c01b2", "comment": "Malware payload", "value": "995b8987aece7136c6826b497b149daa79e2765c1fa88408fadd9150934dfcd62e767f19440d414984c36a7cfcbff83f", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897858, "uuid": "fdf260ba-cc9f-4c8b-85c0-2a1e5aa60ffe", "value": "T18DB50111F7A42E06E8160E7724132435C5F5BD06CF45CEAFABD8862A6EFBB402B25717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897858, "uuid": "40ad2560-968d-49aa-88fe-d8ca46dceb57", "value": "24576:R6d2lVmFatHyefjqB5fZnlxfKUfLSbdSm7uTu+2LhNu4:R6d2lVVHjsZLKUz8Sm7auDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652897858, "uuid": "0b693e10-7b86-4749-8db0-05ac7633c382", "value": 2490368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652897858, "uuid": "9b983fb5-fa07-453b-8433-4e1d10e50267", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897858, "uuid": "6a182d22-64ab-449e-bc25-ef15a70da487", "value": "Request_05-18-2022_59.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec56cec-d69e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652873890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873890, "uuid": "772c0ab0-6109-4191-9426-540a90cbae76", "comment": "Malware payload", "value": "13550525544cc8f86d7627f6d6d58b66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873890, "uuid": "0492a7aa-3a79-4084-bd11-e685ceb38057", "comment": "Malware payload", "value": "b728601bcd4ff2393af65fc2e960a4e40e5bbe330f5ae6be40f095e078223ba6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873890, "uuid": "127e5921-0df0-44cf-9a8d-2adf44bb694b", "comment": "Malware payload", "value": "1c17759b7ecfe76f92d60e1c220c999f36b2b19e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873890, "uuid": "a3fe1f02-4b79-4b29-9025-89b9e8f79ba5", "comment": "Malware payload", "value": "82356ee5419135db93d270f3c86129a5f509a34449dbd101b1286b36c08b153f277967fd23a7ca1c0b0e8b6082ba9f44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873890, "uuid": "d9a75fd9-0c75-4032-9dd2-3bd228380175", "value": "T19B647C1233E1C877D5A601334A92C359B2F6BE51AD3686477BD03B0EEE70252CF25B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873890, "uuid": "ec393191-c5fd-47c4-91f0-615432b55267", "value": "4660d4f55970ca074db150bc25297558", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873890, "uuid": "bf113e38-174b-43ee-8ab3-c08e040b3035", "value": "6144:ULwpEFWtfJqN4ACGWkDQoYshnGMApM9LXYbEPf:NqN4ACGWCQmGMApM9TqEPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652873890, "uuid": "931e743b-5059-4c90-96cd-e5c3375a481f", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652873890, "uuid": "2b89d5a3-40b4-4c28-8695-e362c6dbe3bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873890, "uuid": "b1d1e740-2298-405d-8c74-e2c636276ddb", "value": "13550525544cc8f86d7627f6d6d58b66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5329a4-d690-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652867469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867469, "uuid": "7f5aca39-23c2-47bc-b6a8-200f76fdcd8f", "comment": "Malware payload (Heodo)", "value": "4c2f3e4252a1bc5c4de3ba4dd8906294", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867469, "uuid": "eb041d01-3d4a-4985-8173-beebcb1570b4", "comment": "Malware payload (Heodo)", "value": "b78f33693987b2b2e381d0b537ccab725241d81b45591c7b343773f2299ce082", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867469, "uuid": "54ec9a07-6ac8-4d1a-ac4f-a3039774b489", "comment": "Malware payload (Heodo)", "value": "267dd0cc664942cae25bad767c4fbfac44a890f4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867469, "uuid": "67270121-ee9f-4ff6-9363-eaf521ecd605", "comment": "Malware payload (Heodo)", "value": "c4a63e8c4a480bee0e1ffb91ce5aeabb5e3aa67d668bab87bb5c46a013782a5a07438fef829ffe4b53db76cf0f5bba49", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867469, "uuid": "510ef80e-4722-4e30-b7da-d0a7e2c3b361", "value": "T1BC94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867469, "uuid": "be04a86f-44f8-4016-9dbf-fd25532eb613", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867469, "uuid": "8b94ec39-a16b-490c-b6bc-1c1589955e3c", "value": "12288:M3hV6Pw4aT23s2odd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2wi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652867469, "uuid": "77dffa89-a712-400d-bbe0-cef926ab35f1", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652867469, "uuid": "2945255c-151c-4e97-8fab-ff4b4bf6b6b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867469, "uuid": "1f4e856d-488f-4167-870c-0ac9a961acf3", "value": "4c2f3e4252a1bc5c4de3ba4dd8906294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a8adb6-d65c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652845179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845179, "uuid": "5697d1ae-7399-40be-b3cb-e2bf21f41678", "comment": "Malware payload (Heodo)", "value": "9cee4c2ab57dd2f47de18ccade9a9a7c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845179, "uuid": "43098f35-682b-4ded-8137-36ca20ae9685", "comment": "Malware payload (Heodo)", "value": "b7de53ec29550d24795dd85eeacd6a48a2ba6f0c90f6279fe7f70e747057dc35", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845179, "uuid": "11f9a18d-b1e7-458f-b33e-7d48727861a8", "comment": "Malware payload (Heodo)", "value": "adbff83478a249694844edde3c2453f19da93c51", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845179, "uuid": "f4fbd5b0-6e4d-4b9f-8330-0b0a0920561f", "comment": "Malware payload (Heodo)", "value": "e67464cb952e92e728da04e6b2f43a707008e825c7b5f4afecd3184e1efa7bd576978fd20c408adbacbfca4311844bc4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845179, "uuid": "11bef7ca-8dc2-4906-87da-8582382d033f", "value": "T161A48B4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845179, "uuid": "49f5333c-870a-4b92-9748-fd09706e8403", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845179, "uuid": "3a1ae3f3-473d-40d9-aaa4-eb748ef6cedb", "value": "12288:uS4BnAed8BK2o0aMa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKza34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652845179, "uuid": "c8410d7c-92b0-4f13-b302-589e8678ce16", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652845179, "uuid": "17cbe2bb-a2d2-42ab-a876-e0f42150df1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845179, "uuid": "32470ad9-4ace-4bdf-b529-958d42378088", "value": "9cee4c2ab57dd2f47de18ccade9a9a7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902ab025-d649-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652837198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837198, "uuid": "5da75e55-3c77-4060-b11c-fb60ccdd69a4", "comment": "Malware payload", "value": "de9baccfa93a6092f454288362480648", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837198, "uuid": "ecc708ba-2241-4dd4-ac2d-bdf20812bda4", "comment": "Malware payload", "value": "b8143f7c7536c92b1634e62abe7ce24b9cc876b06b0a56e4261a3c90dea47201", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837198, "uuid": "91622532-b71c-4cdf-9de5-84fa911e2796", "comment": "Malware payload", "value": "ea0151fe6922160dbeaec80dd9952eed92e7703c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837198, "uuid": "335ae165-03d2-49c9-b243-6bce2f9a15b0", "comment": "Malware payload", "value": "633d1c55e35856af29d24cc6080e069a3aa8352bd925d1dd7030e9c7f06bbc60465cdf472091f817b840a011b7134855", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837198, "uuid": "a66da9ae-a290-4f0b-9f0c-8035c6883cfd", "value": "T16AB52213F366A94BC8F3C33221B51232917B4D29D743BB86685873BE28F79E80755AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837198, "uuid": "603d5c14-00dd-4561-8915-04f562592645", "value": "49152:j/iiakdKhuo+pfMSSSSSSSSSSSSSSSSSSSSSSSSRYsLteqlrpKob7RyFdcvz/nHn:rLKRKfMSSSSSSSSSSSSSSSSSSSSSSSSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837198, "uuid": "ebb1032d-1352-497f-ab90-036e1bdfbc55", "value": 2458410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837198, "uuid": "cd7b80ad-26a8-44e3-9e30-df7f5b7ade56", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837198, "uuid": "62428a33-fea5-48df-bdd6-660d9a7dac70", "value": "sighe.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbaf1050-d660-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652847256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847256, "uuid": "7fe5b9dd-b465-4b26-b2f7-ed4c195fd3fe", "comment": "Malware payload (Mirai)", "value": "8b7c9f69c7d929267563f1078313fd7f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847256, "uuid": "d22657aa-74d2-41b8-9bfd-5e85f55fc3f6", "comment": "Malware payload (Mirai)", "value": "b819d70262023bf356bc25ec7d59ae65d67794cbb6c3c5dede326378e374436d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847256, "uuid": "f77e91bb-43db-401f-84ba-d82bdeaa94a3", "comment": "Malware payload (Mirai)", "value": "d8c547d244c2811f63169ffa472b07e11e5d353e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652847256, "uuid": "9bd22d05-5a00-4ffd-bff2-f4a5f8e96de5", "comment": "Malware payload (Mirai)", "value": "ef6e7fb1007ad46b5f4d8b28beedcce0149a8cc53c15e4870e2830ae69a6b0cbd86c2d6bf4503d93065588bc3a9cc8f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847256, "uuid": "9c580273-5c5b-4846-b0e9-a15972e855e2", "value": "T19193A71E6E218FBCFBAC863547B35B21A79C339526E1C685D15CE6012E7034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847256, "uuid": "c14dcd55-4ffc-4157-8212-04d84f0d5c0e", "value": "1536:D51Yz0KSIxVcPcPX6n+5tnjWFl37437i137ZFKjC7ziIT6wlhWUf3MdKceRteA5z:VBKSI7cPcPqnkjWFkQT6wlhff3MdKXTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652847256, "uuid": "1ee9c03c-303b-40f1-8a94-faec28dcfaec", "value": 89372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652847256, "uuid": "9dcaf588-57e9-4715-908c-7cef0308f48e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652847256, "uuid": "8e91f2f8-6f0e-4b4e-a4a7-878d4c0eeec6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc97349-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908997, "uuid": "c87c9adc-1283-4cca-85eb-637ae24260fb", "comment": "Malware payload", "value": "c081d44ed219d0965124de4afc07eb28", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908997, "uuid": "39722843-3717-43f8-91c2-76aef5b03388", "comment": "Malware payload", "value": "b83028f775c01e1caa73105289ff38e4b908439ed86001faa46541f7521ef6cd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908997, "uuid": "3cfe8aca-b9f4-45cc-af68-0fb148ec3855", "comment": "Malware payload", "value": "fcbc7978f496a9b3b1f3dff8216b427abf7806e6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908997, "uuid": "19e5d0f9-667b-4cfe-9456-c643c71d4cd1", "comment": "Malware payload", "value": "8c404f7da6022cc27c2001e63759a7ab6222e6cc724886be496251aee0817b7479d02f028889f08d22584b391452e5b7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908997, "uuid": "b3d34fa5-ecf3-4364-957c-f76eb3cc08e2", "value": "T1000168656C6C203534EBCE11FA6BC019D554ACD285EB4360B794EB39C124828D38E0C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908997, "uuid": "34085ca3-8a0b-4954-903b-a103cf46ac66", "value": "6:z3w3tnMC2J/hLEuZDIdkr4znIRhLEuuTapkdCibKIYFc60rYy1K3:a9DypX9MrALcTe0hbv6Ty1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908997, "uuid": "2fa23e4c-bf75-41c7-94ca-be5a900537ec", "value": 705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908997, "uuid": "0460dd8b-ea35-4b3c-b711-6618f54f8c0b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908997, "uuid": "0be7b3ec-e739-4e86-ac7a-d92ceabb8ab5", "value": "b83028f775c01e1caa73105289ff38e4b908439ed86001faa46541f7521ef6cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3c16e6-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908947, "uuid": "14c54be5-31cb-4af2-b8c7-6c32edb1fa28", "comment": "Malware payload", "value": "f4b3ab3ffe17012abfeaff209a5ae571", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908947, "uuid": "0afd00eb-1d8c-4ef0-91ce-5dccbea87649", "comment": "Malware payload", "value": "b8ebf78a2ad3a9695f8ba65181f5f64220d258b08faa73f4181c2545d6f6d515", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908947, "uuid": "070efba2-b493-4929-aadb-5cf4be774459", "comment": "Malware payload", "value": "779cadf7a3780a1aa3ea9931c06c23638bbde9eb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908947, "uuid": "43fa2b83-674b-4091-b410-e4f1f4b90235", "comment": "Malware payload", "value": "0dc67a3cbad8fec432d8079656fafb5941979dee7b6ac78794dbb40e39803b721195f24c6634f6c74068f7d13caa5bc9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908947, "uuid": "424601d5-b51e-41e4-a8c4-f9d91e4538f7", "value": "T187A1E850112C1AB17246597AD26FFA52B50EC81B097B7B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908947, "uuid": "a6096c0f-cdb3-46c7-8796-0cd8f100d15a", "value": "96:oRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:oRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908947, "uuid": "24565aeb-535d-4ef7-8fda-ca9b0c9da497", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908947, "uuid": "aea2269f-797e-4187-8cd3-1a3226c47428", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908947, "uuid": "d13e5586-e252-45ac-869c-04e075d17c7c", "value": "b8ebf78a2ad3a9695f8ba65181f5f64220d258b08faa73f4181c2545d6f6d515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48dd90c0-d6b8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652884752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884752, "uuid": "74eed300-f755-4a6f-898e-2dcc49558df9", "comment": "Malware payload", "value": "7d96ad36250749ba1537b111b76b84e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884752, "uuid": "673d0167-b46d-4fe2-b985-0cdf92228766", "comment": "Malware payload", "value": "b995612f888b50d1c3a8f6f216f5f153a1d472abf15e69888b76ab33719c1031", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884752, "uuid": "784e589c-5273-4076-8946-ebdd25bab822", "comment": "Malware payload", "value": "1c3ba0a0345d0defd33be1aef701775e069a4d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884752, "uuid": "536e2d6e-2ba4-4c79-9e21-9b910eab795e", "comment": "Malware payload", "value": "cfd3b92ff7dd17ff51a7dcb80e98cf1cd06d7cefdf06e08091ca197bcb4a258e6f970c9f95519e966effcc295d984044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884752, "uuid": "cda72e84-3ae4-4b44-b4bd-8ba07cf824d7", "value": "T14B54E007A2E940FBE9678278DC570B06D3B2B81257659B9F037147662F1B3A18D3EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884752, "uuid": "7260a71a-8c34-4095-8bf2-13b8e4ef6363", "value": "8814d1a94d80f9b49a103ad2cb419460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884752, "uuid": "f341603d-36a7-4e93-bdc9-ead6fc71f7be", "value": "6144:yRjSsk3AzLPQWDgbZJpDphv4MOTRqhTAK3yUil5FCsCfHG72:ojVhTQWEblv4RqFAKiNL4tm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652884752, "uuid": "c1ae593f-00a7-47c4-8c12-3e98a4e19439", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652884752, "uuid": "f56f3d39-f761-49c1-bffa-7c093ac1e4b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884752, "uuid": "cc29063c-6e1b-400a-b906-1f58a286d335", "value": "7d96ad36250749ba1537b111b76b84e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b403e64-d64a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652837431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837431, "uuid": "73131423-de5f-43a6-a604-ac0e49bd618d", "comment": "Malware payload (Heodo)", "value": "52b5d4d6b68b9ecc41a71a20149aada5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837431, "uuid": "71d4aab1-ce45-4fdd-9aac-ce9805b55801", "comment": "Malware payload (Heodo)", "value": "b9e2b22fa22e2c1206fa5842db78c8be9ef05b7a99b9e80b3da9fa4971271b86", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837431, "uuid": "165ca051-2dfe-4e57-9b05-f73f4a632742", "comment": "Malware payload (Heodo)", "value": "64fd9f5018ee365cb1938e4ee5175582db4334bf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837431, "uuid": "c450db4e-894c-44f8-af14-9197de108573", "comment": "Malware payload (Heodo)", "value": "1ffbba3483b32b7fdf2a6e86d5e917e08edc54adb2bdeed6fae17226f9c967c3f6a58922f1b397ed05d4a01a871bc0c2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837431, "uuid": "5386b636-9a4e-4450-aa9c-2caa284ccc75", "value": "T14EA48B4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837431, "uuid": "c3abe2c4-fb31-41fe-9a8f-ce587402c25b", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837431, "uuid": "17421ff8-c5d2-4c94-9f09-3b58482ca88c", "value": "12288:uS4BnAed8BK2o0aSa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKxa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837431, "uuid": "c297c478-6e60-4bf8-bf35-5acf996f2de7", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837431, "uuid": "3c02875d-d745-4282-86be-324e9a3d9cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837431, "uuid": "107aa211-56f0-4d7f-94cb-f4f5a5da9a55", "value": "52b5d4d6b68b9ecc41a71a20149aada5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9d013a-d6cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652894642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894642, "uuid": "f038357d-8855-4746-a415-3f9a8faad861", "comment": "Malware payload (Mirai)", "value": "06c0e184be2cddb92ae843bac9ff9093", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894642, "uuid": "232ab736-5e2b-48ab-b575-c9aad3565e06", "comment": "Malware payload (Mirai)", "value": "ba2addaf6ef5cad90c3250e318a1289d8847fc1217d9829797cf106fb55fce84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894642, "uuid": "a221265d-0807-49b1-95e5-f8c0b69b48f6", "comment": "Malware payload (Mirai)", "value": "ea2435d913808b0e982d0f384dc74c4d29acf82c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894642, "uuid": "06e55ca3-3c2a-43dc-b47b-e7b6ae7a2cfa", "comment": "Malware payload (Mirai)", "value": "94a09028374ef18cebefb3bd31765c65c57101d85f77f7e23b7faf600262531c3b94357597fc0f3a09cbcf5d1a64a079", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652894642, "uuid": "09261511-e4be-4595-949d-a4c8f971d8b2", "value": "T11E53BEB3C8192D58D65A41B4B0285E3A6B33F01452D76EF559EFC22650A3EECF50A3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652894642, "uuid": "cfb32e85-0ec9-4b06-b66f-1df77824d47a", "value": "1536:4/e/aU1ODyazF8vQEHfQ8T51c/kKe1Thb6+/CQI2m5:4W/z119vQEHfb4/LeH6IVm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652894642, "uuid": "20497def-7590-4a13-907b-a29b954b8f1e", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652894642, "uuid": "6739d9a9-1c34-4c43-b48e-3973ad557ce0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652894642, "uuid": "5d9ecd7e-24ba-4eea-95c1-c893d01fa717", "value": "06c0e184be2cddb92ae843bac9ff9093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c273282d-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909008, "uuid": "051cc8ab-5a40-4ddc-85c3-e0247d3c1ecf", "comment": "Malware payload", "value": "f08482044c77bbfc7a8d18cfbb987540", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909008, "uuid": "4aa0c6c2-c90e-47a8-9577-4f193a0a230d", "comment": "Malware payload", "value": "baa88bfa20114c6e92181f1aa241468be4b66dd3cdb3ea0cb3c798b15f225085", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909008, "uuid": "eb60e3cd-0275-476c-a364-c8321d674c59", "comment": "Malware payload", "value": "d47038b0f055508ee80de60e48773c3b6d276d47", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909008, "uuid": "b09797e9-d290-4569-ac10-4df26ae35f5c", "comment": "Malware payload", "value": "515db13f0c4898b9df6f080bd9b0f8c79bb5d9153f797733955fd95e6ae4da470d6b78c086757fdcb545c6c88ae4260d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909008, "uuid": "bf4178aa-4f49-4f9d-8959-f4cebe52d9ba", "value": "T10BB533B975DE24FD96E4A277A7EFCD24302BA6CD601187E0AD7601CE1806231DED4E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909008, "uuid": "c0b72ef2-99a3-4239-92aa-f4b1126de13e", "value": "49152:HT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQeH:Hos909Qg6ecEZHyEeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909008, "uuid": "bf55f56c-4111-440f-b14f-ca6e1f1ef25a", "value": 2314240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909008, "uuid": "3fad5df3-c619-4bd9-a553-3017bdb69cb6", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909008, "uuid": "8bef7af4-df14-47d7-9ca1-b9a6d047a711", "value": "baa88bfa20114c6e92181f1aa241468be4b66dd3cdb3ea0cb3c798b15f225085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f34f56-d654-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841955, "uuid": "d428ab1a-b054-4961-a380-498785c6d940", "comment": "Malware payload (Heodo)", "value": "cf88684dd35bed5dc691310c7f5d777c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841955, "uuid": "b74ef536-2e94-4fd2-9150-63111b9b8f71", "comment": "Malware payload (Heodo)", "value": "bb8b85751f10f78d8155cf195fca55340e3f1e381fb3557d268661bd1b87e3b3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841955, "uuid": "7724b97d-2286-4d7f-8233-a0c1b89356e4", "comment": "Malware payload (Heodo)", "value": "b9a62e07d22c3ba056aa08e542f3699a87c7b28f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841955, "uuid": "7def15fa-d9ec-437d-a461-49c53b2ed0f1", "comment": "Malware payload (Heodo)", "value": "3162579398524c30e71e6c99d5c2bd39b5e0da76a6edad1ca84e062831bbe8e15c5cf0fc304615791e28cfa6b974440b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841955, "uuid": "4baa6c76-cb7e-4f71-95ec-956a71e74f5f", "value": "T16894CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841955, "uuid": "113f1689-601d-4a6e-897c-a0940c0e9438", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841955, "uuid": "783eb994-9984-417b-ba53-bd0555a6594b", "value": "12288:M3hV6Pw4aT23s2obd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Wi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841955, "uuid": "275cc8a5-0552-4945-b460-6980125763e9", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841955, "uuid": "2e208cd5-eced-46e1-8497-723728b96e25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841955, "uuid": "44ad9542-56d0-4432-b1c8-cab7d8c2ce8a", "value": "cf88684dd35bed5dc691310c7f5d777c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5470d55-d6c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652891457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891457, "uuid": "1f67644d-7a81-4b40-b484-acd6aa2b4c90", "comment": "Malware payload (Mirai)", "value": "c2abeab93d02b03b4d3186e3885a894e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891457, "uuid": "6cfffef6-171a-4818-8e20-61bffcecb826", "comment": "Malware payload (Mirai)", "value": "bc35d13f4a588476521c93024ac057a9fe77bf3a35a9e82ce0d878b4dc5dacd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891457, "uuid": "f6c3ada3-73e4-4256-b0df-83acf4319130", "comment": "Malware payload (Mirai)", "value": "504d8c1f7c7493b2cd403b5ea99f5f76277ef12f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891457, "uuid": "4c7e5e8d-c671-4e8f-bc9c-248b856414ce", "comment": "Malware payload (Mirai)", "value": "c601d6c68621a9d5def68d95ffef671d2587dcb30756b20db3022eaf664704c60620e1f9204e438e8970dbae336cb154", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891457, "uuid": "1580d98c-cb3b-4758-a2a5-a7163bd58699", "value": "T1E993800AAF611FF7E89EDC374AD92B0524DD511A20AD7B39B930D818F25B30F19E3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891457, "uuid": "35d322d3-da7c-4d15-9723-59aaa81faba6", "value": "1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZqWi:qCYxrKDy46Nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652891457, "uuid": "b7361c79-c090-43b9-8caf-70ed48bcb9db", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652891457, "uuid": "39ff5799-f8ec-478e-aa23-254b129f9f9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891457, "uuid": "ef058b80-c3d7-4fb1-8374-297e6f1bc298", "value": "c2abeab93d02b03b4d3186e3885a894e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf57830c-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909030, "uuid": "931295eb-2842-4304-a7aa-7e633815850d", "comment": "Malware payload", "value": "8710c3ca1de5000cc8a45281240de87c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909030, "uuid": "f6fe2c2d-f79a-4ea7-9671-24788e8456f0", "comment": "Malware payload", "value": "bca1b06f2b1c551fde019fa92ef451d5b10e8de7d731dbb79e7ed3dee835760a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909030, "uuid": "5952a1a0-bc9e-46ec-8559-f2d9de5f476a", "comment": "Malware payload", "value": "e25a05e8de2c621f67313b5d9a324d874bde9446", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909030, "uuid": "5306e8fa-e750-4c22-aa0f-adab47f7689a", "comment": "Malware payload", "value": "0a0269890664151a5d76b9e2b769308a78497790279dd5132c0111374ad5028c23714905bbf53c99af9cbcf9c7433c1f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909030, "uuid": "6d6507a1-5e70-4202-b87a-9a0c03ac8f95", "value": "T121A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909030, "uuid": "3d418d87-7b74-407a-83a8-4c11cc0ee1e5", "value": "96:ApRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ApRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909030, "uuid": "a8ae6f5c-041d-464a-8dcf-7d2722f21c8d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909030, "uuid": "1479b198-64c2-41f1-97a2-a71524333cf9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909030, "uuid": "f16a4f40-1780-4afc-bbc1-722e6428463a", "value": "bca1b06f2b1c551fde019fa92ef451d5b10e8de7d731dbb79e7ed3dee835760a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9cedb2b-d6ac-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652879815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652879815, "uuid": "d24d3eee-c112-4c4e-b9a7-8690c69e14aa", "comment": "Malware payload", "value": "727c70fc9dfb1f9d7270e2ec307eb30a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652879815, "uuid": "e21e8e54-8d8c-4bd1-b268-0c8b0f22bb91", "comment": "Malware payload", "value": "bd89718f4362d2c0ddae6782fa52e5d26f144dfcecf00bd055612d31ee6e9c9e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652879815, "uuid": "2e6fbb8d-ef17-4400-9446-f3397d574c3b", "comment": "Malware payload", "value": "918873b331aa68594201c33f61d20eef7d743623", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652879815, "uuid": "13599145-ac27-4605-bacd-251a8966b154", "comment": "Malware payload", "value": "eced41254e2fbe4361b3d170e24f609e6e6bc533c2d3ba1056a5208b5cc6435c8a188593e25dd5d590d18f8665dfe7fb", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652879815, "uuid": "d7f1ea7a-2476-45bc-8f31-c0fbabf7b506", "value": "T1A3518B387EEA2118E1B3CFB169DD7595CFA9F973B9114D5D0082034A4D12B00ED92E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652879815, "uuid": "d2e5d93f-5067-4c2d-b1cc-37789fd6aed9", "value": "48:8m3KLVFYbZ7OXU8u0CLAr1teyu5R6fcIPj+4ab:8m3UVOb4qMA5U64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652879815, "uuid": "87c2402c-de13-4ddb-802c-0593fef750de", "value": 2510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652879815, "uuid": "0facc6ea-cfa3-4908-88ba-7902df2a9adf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652879815, "uuid": "bddaaa16-31ca-4f56-9e52-2eb0ee5482a2", "value": "Rech.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96be4c60-d648-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836779, "uuid": "14824d26-d693-40bd-8b94-f86e703b5b76", "comment": "Malware payload (Heodo)", "value": "9238524c78c28701668f09c0527a4dc8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836779, "uuid": "7225083b-29ef-4c5a-9642-d501a3907f9f", "comment": "Malware payload (Heodo)", "value": "bd8a6529a207a675780eadc71ef820b43962ed0ffa612886509a369eab867721", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836779, "uuid": "cc67fc2e-a4fa-40d9-8c7a-9b4de2e0ac33", "comment": "Malware payload (Heodo)", "value": "9555149e9017b0313df11f2deb01a7812c77f087", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836779, "uuid": "f54d9e27-e085-4ab2-a677-cc6a3ba045eb", "comment": "Malware payload (Heodo)", "value": "f056f2f017504f0433f21527d49379cc6ccfe76f446b3de829ab50e074d01d1601b32b66a36f80bf9afa59ffd6cce58d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836779, "uuid": "9bfe6837-553d-4bd3-9ae4-b9ab2992d7c1", "value": "T132A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836779, "uuid": "f998a882-b1ed-43b5-a490-f99a8bc6c9a4", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836779, "uuid": "f8385b23-6a06-4fef-acbd-4cdc8a2a31a3", "value": "12288:uS4BnAed8BK2o0aQa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANK3a34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836779, "uuid": "a088e882-00a4-40d1-960a-601c93c1ecda", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836779, "uuid": "c7c50758-7d59-49b6-b10c-7cabf30c7264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836779, "uuid": "2544965a-cc3d-42a6-b10e-e6b6560bd83a", "value": "9238524c78c28701668f09c0527a4dc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6f98a7-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909052, "uuid": "3b80f95d-2358-4095-98a0-12af15f7bb85", "comment": "Malware payload", "value": "cdfb8d8144765585aa28b9c217b8806a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909052, "uuid": "e66ed786-2605-493a-a5c2-1f64ea3653b8", "comment": "Malware payload", "value": "bdcb3fe159a00c19682c86463d35ddbf26d43597c340ae340ddb79a6e6b1ac2d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909052, "uuid": "21f7cc97-bbcb-4b74-8789-f3f713ffd51f", "comment": "Malware payload", "value": "a17b7330b001160b19e878ce9aaf459cc5321e51", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909052, "uuid": "759bab73-42f5-4690-b06d-13ccfefc28a4", "comment": "Malware payload", "value": "e4d0ac593c9b4b4a7e1b6330a25486711d02ba90d41aa692f23268a9c9a65e33ee697e12318142833cf8ee59b8a01b9a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909052, "uuid": "aeab6002-dcaf-423f-89ad-95001d44b732", "value": "T1E5E0D856FC81407F207AC464FBEBAD5A550F1111424B123CA3E95402B8B8C84504297B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909052, "uuid": "89583ccc-ca6e-41a3-9787-7dbd83bd02b4", "value": "6:/VJq5/rVYBhAnYjp3F1FGVKhOqLsVKhOqNiVVNMiOq6O4uVfvOZQiOiyiiO2:/VJ8jtYCgh1sghyTyigYtPi5yiil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909052, "uuid": "9d70f84c-eae1-469d-8a48-eb586339cacd", "value": 357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909052, "uuid": "0ba0784b-da37-4afe-9e40-a7844a4512ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909052, "uuid": "2449425e-c4d4-4212-b216-28b0798b6d5b", "value": "bdcb3fe159a00c19682c86463d35ddbf26d43597c340ae340ddb79a6e6b1ac2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51d9f1e-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909012, "uuid": "dd66a826-2abf-4c00-a1d9-ba77c5d484bb", "comment": "Malware payload", "value": "1f29fc7e6e27a5a7e92ce400cf2eaf2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909012, "uuid": "0fdaddda-f908-46eb-9115-2a81ca395ec3", "comment": "Malware payload", "value": "bf8dc5eca570a1a0d702303547b736cff9df54c31745dde90dfc429580c0cc28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909012, "uuid": "ec1a410b-de2e-4b1b-aa99-cb356ae75917", "comment": "Malware payload", "value": "901d534f3fe2a57f660a9e344734f51fd9fbd869", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909012, "uuid": "fbdbc7d5-8781-4269-950b-6645df022ceb", "comment": "Malware payload", "value": "8216141c2f904f5b130b85cc3defdde912f60e3df4bab85ac209c9d0d3cc207e99922299aba54dbca7667d89d3aaebde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909012, "uuid": "778c7c33-5a3a-4c93-9916-a4b794d6cb06", "value": "T10B969E07F9A318FCC5DAC970472BD3A6BA307C584225797B3654D9302E53FA09B2EB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909012, "uuid": "d8eebb56-d001-4583-b6c5-f9fecf8c7443", "value": "196608:u8wR0V6XiaQcjozicr6cQghbf96/my59N95ss:uZ0V6XiaQcj+icmcvVemyjN95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909012, "uuid": "4dc02a21-a447-4bc1-ab20-5d6b47be9226", "value": 8973584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909012, "uuid": "dd16ab18-123e-49b6-b59a-e01e1e1bc6aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909012, "uuid": "f287bec5-c81a-4580-87ad-a8d5986fcc59", "value": "bf8dc5eca570a1a0d702303547b736cff9df54c31745dde90dfc429580c0cc28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debf80f2-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909055, "uuid": "6b457226-312f-4d29-92c5-87e44716457d", "comment": "Malware payload", "value": "1e5925ad40a06b0bee559560c58a7f07", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909055, "uuid": "9cb6aaf3-9643-4522-8b3b-26b25707ff3e", "comment": "Malware payload", "value": "bfa3daae0db8579a2332dd22473aa9b7aa9b75a08a2e53b04b0768f2703274d2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909055, "uuid": "baed09d6-4fda-4d2a-b208-677adf95592d", "comment": "Malware payload", "value": "faeb66bd5c710d5f6ba3baeeeeb3891f40918d95", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909055, "uuid": "34283064-73a4-4b31-9c48-7056ccc02624", "comment": "Malware payload", "value": "59fe3f6b6d345c86c775d8ff034bc2a23cfed08787fee2ed57b7b2c5ea561d0a12da02373ea3bde8c26aff886c4df4f7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909055, "uuid": "e6f16244-bb33-4cc9-9dfe-f2fc01dd73b2", "value": "T12CA1F850112C1AB17246597AD26FFA52B40EC81B0A777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909055, "uuid": "5847f439-f076-4d24-a9db-7a0bc707550d", "value": "96:kRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:kRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909055, "uuid": "75a04320-5ab6-4c4b-b579-582034817c40", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909055, "uuid": "54375e96-1b3c-4b88-9b2b-320e7b843485", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909055, "uuid": "13dd1568-cc6d-4446-8f5f-d79a276a2bb4", "value": "bfa3daae0db8579a2332dd22473aa9b7aa9b75a08a2e53b04b0768f2703274d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de2737c-d6da-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652899498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899498, "uuid": "07354634-c0a8-486b-b1ab-13328de9f6e4", "comment": "Malware payload (Mirai)", "value": "1c9bddb75d855654b2e094ceba3209cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899498, "uuid": "66ca4d1d-2b07-419c-9f56-509eaf319c2a", "comment": "Malware payload (Mirai)", "value": "c002f04d1db070c3f906477491859c3c273c8a1f8b9b45d6dbbb0258bd3224cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899498, "uuid": "56083d53-37de-4188-84a8-3d05259aeb9c", "comment": "Malware payload (Mirai)", "value": "477819f31d29980b10847fbbc2bd29c5df8308b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899498, "uuid": "a4c2020c-b7b6-4130-9961-d26542748fda", "comment": "Malware payload (Mirai)", "value": "dcd6108d998940476a636c31435971aeccd793a9fb39a0507586ddc114d52d172c6c97a1c0f9dfa6f7d938065a1cf274", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899498, "uuid": "c5b140b4-d2c0-4a1a-8d55-5934ffafd019", "value": "T137D26B628D2E2D5CEA194678B5314F7D4B23F805E6A77EF55A22863D9003DDCF90C2B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899498, "uuid": "19ce2ddf-a249-47ff-8463-862a8669b281", "value": "384:XUconDanlkNcoCEhA/hAfhM5cNrlATUvF6I/YxFgWcKBzfU0z92A73gTMLXwF8oF:XUcoDaOAEhah6hZrqrTo8YGL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652899498, "uuid": "857f15a1-bc0f-4119-86c0-22c7795e88b6", "value": 30692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652899498, "uuid": "089c4c17-77d8-4430-b374-982e542f16cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899498, "uuid": "2512cb96-5eca-4afe-b3d9-60a2e0304f4f", "value": "1c9bddb75d855654b2e094ceba3209cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ed5386-d6b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652881763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881763, "uuid": "558667a3-384a-43ba-af3b-f1548ce74c90", "comment": "Malware payload (Formbook)", "value": "76ce730fc95e11065bc9887cbd19a89c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881763, "uuid": "31e1c32e-7d71-40ea-95c4-3b88d1032be3", "comment": "Malware payload (Formbook)", "value": "c010dafeb95f833b58f5a79bad37776f4dcf5a0806c1df6a17c171a606dd47a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881763, "uuid": "7e4bce94-71cf-47cf-a6fe-85cf4ad558dc", "comment": "Malware payload (Formbook)", "value": "6baaaeecdfb6c212cc71b2a949a11520169ce7ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881763, "uuid": "e2963254-4bde-41dc-b9d8-c484fbe06f8a", "comment": "Malware payload (Formbook)", "value": "5375ab075dc6c4a205bdf6ef719ed46bd32e75ba4b898aa295c92c06cf1311263f0b4e08c193b3061ff24cda99907e8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881763, "uuid": "e0dc4926-2343-4021-9fad-9a3d9c7b1d3d", "value": "T1C7240115F6E0E477D4A30E322A3176674BF79721946A74170730F8A86873DC3AA2EE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881763, "uuid": "e7e9b519-beff-461d-b5c1-88274b4580a5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881763, "uuid": "58c49df2-ed24-4659-ae37-b54914d9fea2", "value": "3072:pODZGPEouVbUz7Z4e3r8fBLio/0J1Nyl1dtK+ecOAbxIbtw3UYHTFgrCY+6Tf3S:pOtIkUSeb8f4bglfec7bxIbybFgxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652881763, "uuid": "8c5a24eb-b166-4fbd-9dc6-b9141caec46f", "value": 219276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652881763, "uuid": "cbc15719-2f59-495f-9c2a-29d16eff68f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881763, "uuid": "5c05758a-a2f3-4376-8070-42b4960b1753", "value": "5109248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6131bf7-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909068, "uuid": "b8f435cc-5420-4ea8-b642-51f556b20f18", "comment": "Malware payload", "value": "f7523dc4f9229f6f7f066d6cb8320005", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909068, "uuid": "cc1ad488-d40c-4c1b-b4e1-dc22db6af12e", "comment": "Malware payload", "value": "c123e2594664d0739524e6d055e0fb8e5d5c4e8bb337c45ef723c442dbb00b2c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909068, "uuid": "62025d23-7aa2-41f1-a1e3-d6e632b63b8b", "comment": "Malware payload", "value": "b5b5971d4f7d3b7a4b9514ea9715c26e3f0910e2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909068, "uuid": "0b8c51fc-7f33-4010-92eb-1a81cb9ac643", "comment": "Malware payload", "value": "d0a9b75133776484155898ed62e439da0b7564fcc4ab6c8316f8ec21fb702c6069f4fcdd273530278b0097411add6159", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909068, "uuid": "60710f7b-dbb3-40b1-999d-b6c7bb2b8b4b", "value": "T11E411ECA21A208BDAC91AA63727D54503094F0DA20CA7F56ADFC34F8808FF353984A97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909068, "uuid": "a96efd5d-3e5d-4df5-8d0a-722f239e099a", "value": "48:vUA0TYEO3woWJZ9eHBZ+v8YLZ/wJdJZA4ge3:vUA0TYEO3woUZ9eHBZ+v8YLZ/wJrZA4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909068, "uuid": "a1de7568-1f84-48a2-98ac-daa4632ccdc0", "value": 1923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909068, "uuid": "4f513e30-3bf9-4257-96ee-eff08992eff5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909068, "uuid": "87cdebb1-dbcd-41fb-a1f8-0bff930efd9b", "value": "c123e2594664d0739524e6d055e0fb8e5d5c4e8bb337c45ef723c442dbb00b2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df7d067-d6bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652885996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885996, "uuid": "7a51f543-dd39-40af-8098-beb3b860a10b", "comment": "Malware payload (Quakbot)", "value": "a36c0a68076df5c427c206b9b2a2d706", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885996, "uuid": "b798bca1-d63a-44ca-b7ce-ca40465444dd", "comment": "Malware payload (Quakbot)", "value": "c17f259ab01cd7625f6c9be23af91b5da3c2275bc2394403b2c820b06172e0a2", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885996, "uuid": "6d88010e-6fdc-42c1-9379-f1c4dcae8eb1", "comment": "Malware payload (Quakbot)", "value": "d4d544ebab08e2712f75eaada1379af0e46ce301", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652885996, "uuid": "9938adf4-cbb8-4806-b83e-5c6927c3e1c4", "comment": "Malware payload (Quakbot)", "value": "f0c9b43557c5ec33806a4ecdc82dd29872baeb31b6d1f3313f5d068c106cf861b2f9c9ce626341df5f13a38e2d636745", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885996, "uuid": "332d6a3c-782a-46f0-9a10-1bfed107c58c", "value": "T179E4AF22E3F04833D173167D8D6B676C982ABE513D389DC66BE41E4C5F392813A26397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885996, "uuid": "a9a591e6-cb1a-4c97-bffb-343da723cd89", "value": "ff450e39c2143a90380d4f56a4259383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885996, "uuid": "1a03f7fc-be3f-49cf-8d3e-1659966394b7", "value": "12288:SHppWamOEUPrsLSyyGq5FXllT1/BI8VwSi9NJIksifQuVS:wsdeQLSAi1qMi9TgiJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652885996, "uuid": "9af2d0e3-3f4b-42d5-bfcc-7f7c77aa6eb3", "value": 658797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652885996, "uuid": "c9d3a656-d2a7-4d60-b64d-a13aaa370846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652885996, "uuid": "2964ea84-e6b4-40aa-a144-fabfc32e165a", "value": "c17f259ab01cd7625f6c9be23af91b5da3c2275bc2394403b2c820b06172e0a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ac4b9b-d695-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652869760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869760, "uuid": "df7d5764-ee74-4ccf-87e2-29bad1850706", "comment": "Malware payload", "value": "d98f29ddcdff15ab6915da102045fcd0", "object_relation": "md5", "Tag": [ { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869760, "uuid": "d3a64d50-93f6-4391-bd8b-55e5e68e3b5f", "comment": "Malware payload", "value": "c185821335f48d2bf22c40a91a3e23db38c85100fc80623c41d8407affcd375e", "object_relation": "sha256", "Tag": [ { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869760, "uuid": "54284928-33b5-408a-843c-02b09fa548b4", "comment": "Malware payload", "value": "d10c3e455943b4153bfdf36f8b2134e4f0859393", "object_relation": "sha1", "Tag": [ { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869760, "uuid": "95579736-6e13-49f3-a32c-32481d75e5cd", "comment": "Malware payload", "value": "755d032e8fc9367f0ba1d2c74b3bf5de46cda97efefcb1a4becf48d82b18f3ef2be7b817317a9ff1afb71b18b9d3b71e", "object_relation": "sha3-384", "Tag": [ { "name": "teambot dropped", "colour": "#E30252", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869760, "uuid": "6a0edc87-b0f5-42cf-8b10-273f8f59e571", "value": "T1FF959DE45F0B1CA185AA94F16DFB11D7F0558084E4E01E2BBC992F421899DE2E1FBBCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869760, "uuid": "ec467100-2054-4fdb-9600-7f7ddf0a2d1e", "value": "49152:e/j1qAqeo3Yi3hF+tgJnaf9CqCjBcoMC7JQPAy+2cpniIpUw6GK84D1:e/j1qAqeo3YiRF+tgJnaf9CbFc7C7JQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652869760, "uuid": "909f6814-2f97-475c-8a89-fee662e6917b", "value": 1924612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652869760, "uuid": "20652b7c-832b-42e1-af83-3a7ac4df5292", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869760, "uuid": "bd3af034-1ec0-4ef8-b382-ffb4dd768f2e", "value": "prolivv BMP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac1ad72-d6b0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652881588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881588, "uuid": "3ed79c78-072b-4a7c-a81c-7b7d0efca77c", "comment": "Malware payload", "value": "3559677fd3e718f5b94aa5a6d589d533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881588, "uuid": "0b3d7458-4fa5-457c-9a9b-350f808e4ec9", "comment": "Malware payload", "value": "c1f5a5dee4ab06d25750abaf144c5aee3f46e68b76cd3b159103ab2ca15079fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881588, "uuid": "dbd87903-4e4c-4fd0-86d3-559867f81e52", "comment": "Malware payload", "value": "fe1610e4fff09b87a639d90ee0c6ff70142c7860", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881588, "uuid": "49858b17-5ee2-4bac-962e-8e3bcf25be28", "comment": "Malware payload", "value": "70f26d47bbfb8181ad377c67b26b48ca7f0d3e02462087d6d442c3ecca9347c219673bbf737e1838edf2205c49b4d8ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881588, "uuid": "051782de-327a-4dba-8bdd-51dc9d740138", "value": "T18915D7AC321075DEE86BD676D9A81C68EAD0746B831B4103A02792ED9E4C9B7DF140F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881588, "uuid": "936614e7-e5a4-451b-a3b8-aca81f975ca8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881588, "uuid": "98b19b68-fc67-4d09-b87e-2bc90fa4a493", "value": "12288:UdBcaWxnoZfJV2n7dEsmBWjQ9Qj9ymymJoiPwsUN6dtNQyfIDWAqnMJ5GzKrEm1h:UdBcaWWZf32n76smkjQ9Qj9yRIzwXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652881588, "uuid": "dd71fc15-e0fa-4f1e-a56e-b97dc1c5f14f", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652881588, "uuid": "542a6bf1-8c84-4937-9cf8-b1aaf4b15b6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881588, "uuid": "0e935b7a-35df-4712-aa7b-7ee1439c8469", "value": "HBLMBL SHIPPING ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cb5f7e-d6e8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652905287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905287, "uuid": "f7e4679f-7b85-4976-9f1b-b50ede6c7a1e", "comment": "Malware payload", "value": "791480cfeb92cabab0059e9d606eebef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905287, "uuid": "e2be3e70-582d-4b03-a1ac-26006a2e303e", "comment": "Malware payload", "value": "c25aa4bb39cdf8ee037dddbce281415b5be063f8139ae8b65695b2c6a326555b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905287, "uuid": "682c5124-9fdf-44f4-9be7-4a8fac634dda", "comment": "Malware payload", "value": "bc358aa820dd472ac9d966f8b1685c1f258bf62a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905287, "uuid": "6dfc91e7-16a8-4f58-94d9-e8e7fe469aa1", "comment": "Malware payload", "value": "efad71ba6a4c031d2772a79cf61e147e0e28e634a746518f14456fef50ff7d5f817fc136a834c30edd32a9de45cdcb21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905287, "uuid": "28a2f2a2-436a-43b9-ba2d-e201ccedb899", "value": "T15E05283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905287, "uuid": "de0f5c91-870a-4701-8c7b-81c4e542fe55", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905287, "uuid": "59c67feb-ea63-44a2-94d3-eeb56153edb4", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7cmpE3:BTg9UXRD2SeqfZZiIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652905287, "uuid": "438ab1c6-50d0-4872-b95e-5a30da215ff9", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652905287, "uuid": "3e16185c-4014-482b-b6f8-c610eeaabffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905287, "uuid": "ad742250-2c25-469f-805a-8c3eee63ef3f", "value": "791480cfeb92cabab0059e9d606eebef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b81b744-d6af-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652880945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880945, "uuid": "1ee3c3e1-4661-4adc-b32b-2b20065f09b7", "comment": "Malware payload", "value": "962a7ca6e71a6205a4813599a7a336dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880945, "uuid": "43372917-e7b6-4949-8883-e621e22ff037", "comment": "Malware payload", "value": "c2917b27e61a642cca99e466876256446e249b553aa6d9996695bbec94052ef4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880945, "uuid": "d47552b0-7f88-4003-ac95-bec5920dac08", "comment": "Malware payload", "value": "9f28b2edb1d9ccdaefd7ea7ccf8e82e3b5b11e25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880945, "uuid": "801a88ba-6510-4a17-bd12-6f5bf28cfffc", "comment": "Malware payload", "value": "4a87cbbbd020f14262fefa6aec24e03ce72bdc016fed9ca1614d0ac5409fca2e042256883d1162041ab9992204f27058", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880945, "uuid": "95e46552-cd72-4389-aee4-0bb9a8332080", "value": "T17FB52B51BB948A41D4FE763ADBE6618047B2F4D11B72C94DB74E3A921822313AD4F32F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880945, "uuid": "8c8121a1-1efe-432f-afdb-6e63b9cf7cb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880945, "uuid": "cbee0d99-a360-42fc-93da-cfdc6a25fed3", "value": "49152:Nq0ICEnctVC8mNv8tPcGTP29CacRu5VrSDlIYFUkFWG0n+E4YCKEYxyejCHpNR28:qCEctV5mNvXeP2HDkaxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652880945, "uuid": "103ff3c0-4de2-47bd-84a9-b8b817147a7b", "value": 2475416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652880945, "uuid": "d928db77-398d-490b-ae9e-ecaa93bc4a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880945, "uuid": "df103031-9604-4647-ad94-ad07dd13ee5f", "value": "SecuriteInfo.com.Variant.Tedy.113816.20738.13421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c49af72-d68f-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652867149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867149, "uuid": "c091a5eb-a4c2-4f2d-a8d4-619aed4877e0", "comment": "Malware payload (RedLineStealer)", "value": "15de4c1a25c5466f420f48738f10dc29", "object_relation": "md5", "Tag": [ { "name": "193-106-191-197", "colour": "#FAF2AB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867149, "uuid": "29d364c0-8d76-4113-bbd5-668645b4422e", "comment": "Malware payload (RedLineStealer)", "value": "c30d60761ed35693c686d0909060d14e5f08f4c072c424511a11bfeea491cb6a", "object_relation": "sha256", "Tag": [ { "name": "193-106-191-197", "colour": "#FAF2AB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867149, "uuid": "4ab3e8ae-bfa1-412a-b4a3-dc76dbfbc22f", "comment": "Malware payload (RedLineStealer)", "value": "152d8121011c0c14538cfb3c16afe19a12b801be", "object_relation": "sha1", "Tag": [ { "name": "193-106-191-197", "colour": "#FAF2AB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867149, "uuid": "96e78a44-ca06-48ef-a540-9e9453f26e2e", "comment": "Malware payload (RedLineStealer)", "value": "08b2fff0c1bf51cb0df7947abc5b9580a6784c9d534fcfd5b3165884cf05b5642966cb5e8d4b5b3b37efdf2c03f1c3a7", "object_relation": "sha3-384", "Tag": [ { "name": "193-106-191-197", "colour": "#FAF2AB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867149, "uuid": "5f061f23-e55c-4b4b-83e8-1d8c6a192a97", "value": "T16284BF50BAA0D03DF1B715F0797AC3E8652ABDB1AB2055CB22D63ADE16342D1ECB4707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867149, "uuid": "c523608c-68bd-4524-8e1b-92175eaef1a8", "value": "ae98dfb82925320d0b54ec50c18e5f2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867149, "uuid": "bd361c2f-9f94-4bfb-b1a5-7b2fc1c60bdd", "value": "12288:fEYFiXD59MDO6mqbJhnT5v6w3tXL0/JGZV:fboXymql5Vvf3tqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652867149, "uuid": "f3dde460-a9ce-442b-89fa-dcd9cfffce27", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652867149, "uuid": "cef9c62f-ed7d-4c92-9de2-f01a11765793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867149, "uuid": "3e873961-8eb2-4816-b509-af9c69887113", "value": "game-installer.torrent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de861b78-d6a5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652876843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876843, "uuid": "26745bc9-fa25-41e7-9d79-adac6dd1ec44", "comment": "Malware payload (Formbook)", "value": "e6cebdd29b713d054f636e09fa411924", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876843, "uuid": "8ad634bb-78e4-43ca-a05e-14136d3eb8af", "comment": "Malware payload (Formbook)", "value": "c483fdd57cf8e05985e6e09ae3c74a7b53cccff68ddccd0cfea136591ec5c306", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876843, "uuid": "edb8776f-3198-49bd-8f02-963fbca58b7a", "comment": "Malware payload (Formbook)", "value": "5c2a19cc01709fb4c6336b69fb91e348cc9fe2ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652876843, "uuid": "2d025951-7c8d-4d74-ba8d-c9239dbc71a2", "comment": "Malware payload (Formbook)", "value": "eb3b1d45fdce433320bb040bb2b66b86fd7c3d9efe2aee2ca657a93df107d2e1dd3eef7696cf2e102112355c1e11d0dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876843, "uuid": "66548885-8a5b-43a5-b826-6dee00c093b7", "value": "T154E4F13AB5A8DE23E65C40B9CC5109E647E5AE93DC02F75BA8D4BCDC39B5392B50310B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876843, "uuid": "83c09aa3-cbaa-4e26-8612-60031e4e072b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876843, "uuid": "515b1509-64a0-4631-806a-96e7ebbc8dd0", "value": "12288:ZSbCYYYYh5PYYkxOSdeMksAtzLejUoZQIl4iX+CPuof1omo3GyF9j:4Y8dvktzSjwMf+Cmof63F9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652876843, "uuid": "85f98c63-6e62-479f-8873-cf91530e9071", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652876843, "uuid": "0287e84d-4092-4803-b225-3d5202e5bfd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652876843, "uuid": "6c3e037b-ca60-4506-8904-6d498f39fe51", "value": "dialozx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f0f573-d697-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652870567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870567, "uuid": "b17e3d89-7d57-4218-8e2f-8b2db943871f", "comment": "Malware payload", "value": "672a4a989d4c8aadd40572fd0883d59c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870567, "uuid": "a9939336-98d7-41a6-8466-df2470349c84", "comment": "Malware payload", "value": "c4d77926a432c85324b7d0862b25085ad2b8370720b3b78579ea54e21bee0934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870567, "uuid": "7b01d2a5-9921-4d78-b85c-5747db4a77c9", "comment": "Malware payload", "value": "6cd0e3e184b1818f8da3682f8908ed78334d615f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870567, "uuid": "2b5c7e1d-f571-4faa-85c1-b1c75068a551", "comment": "Malware payload", "value": "654895e5c2463d272d1aac4378c99695dffb9796a47942528448c9ec0c058a350e844efb9be34397e508f61a68ce67a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870567, "uuid": "6f79ade4-c747-484a-8e7d-d217aefa7f9a", "value": "T19B94CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870567, "uuid": "c5221108-a5a6-4d35-9b6c-12ea92ad7028", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870567, "uuid": "1e127bc8-5990-4286-bc93-37fc2a604b1d", "value": "12288:43hV6Pw4aT23Guolv91Wuwf07EIvH3+38+:sb6Pw4R3GuWWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652870567, "uuid": "3e3e358f-68d3-4637-841c-4fbf16c74f60", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652870567, "uuid": "d834f055-cb0c-4dc0-9843-facba38e04ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870567, "uuid": "c329fb71-8e26-48c8-b80d-bdbdfb24cea4", "value": "672a4a989d4c8aadd40572fd0883d59c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d9bce3-d698-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652871210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871210, "uuid": "600f88c5-c141-4ebd-982f-e062bf71e3a1", "comment": "Malware payload (Loki)", "value": "ade32559a442031d0e5040a96639bd66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871210, "uuid": "13d094b6-34c8-445c-b838-223a496330f0", "comment": "Malware payload (Loki)", "value": "c50d3985de52cdaafefc1b94b0755d052bf7f5e6aa526773c2485636dcf9c775", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871210, "uuid": "c0517ddd-bd6e-4d05-a5e1-a8f22cabf590", "comment": "Malware payload (Loki)", "value": "897a30eb6cbb1249e6dbef5bac9b34849ae5ec4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871210, "uuid": "c7344df9-e693-4ac5-ac0c-d41c200d2294", "comment": "Malware payload (Loki)", "value": "5853485974b4ef354f13ff9007a1e52c85962d34b3e9cd6c7c11c88f7b68ed83c3eab7be2084a2c1d8b3f238abec777c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871210, "uuid": "7d519161-5f41-4a70-bf67-a5798db8d5e5", "value": "T12C34CE22BB91D031E0A785304878D772DEBB38230674598B3794277E5EB03D1AABD767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871210, "uuid": "2f9f9776-a986-4adc-9c78-14ee5193f8a4", "value": "7571adbe544c88b5f4f231486e74f9e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871210, "uuid": "ff800d78-f2fb-41a5-96ec-5d0f89740b4c", "value": "3072:vnvoKq1g3ab/k+DkQuxVybRQKejT1co4EHBKJrGBM/BVm:PvrrKb/k+IQuxVilejT+Eh4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652871210, "uuid": "5e9a62c2-4125-467a-a111-5084547eacc3", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652871210, "uuid": "ae046711-8cdb-4b32-a37c-0d4438bcbfec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871210, "uuid": "58332fe1-ab7c-48a2-ae8c-0ca3bb5ad573", "value": "ade32559a442031d0e5040a96639bd66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891686f6-d6d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652896027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896027, "uuid": "ff47a1bb-49a9-40dd-a88b-9be6010c630f", "comment": "Malware payload (AgentTesla)", "value": "73c0b2c855be16549d14190e08f71cad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896027, "uuid": "5596ee17-0170-4916-b2ba-f84fcbbc0abf", "comment": "Malware payload (AgentTesla)", "value": "c5250a2105130cd7a1b83c5c5bb165e6f9bbb64ea5e7cf42a8cd2e13e3437c09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896027, "uuid": "f680ffec-af57-44ce-a4b5-9daaf20d3ca8", "comment": "Malware payload (AgentTesla)", "value": "0ffb4bab3dd9001d9fe8e9720d6fcb84c43048ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896027, "uuid": "ae38f377-8da6-46c9-a2f3-656d706d9a5f", "comment": "Malware payload (AgentTesla)", "value": "e0320029007c1f0da18a88d89e5954838e89969f890de6eb94f069b9487fa8d14ff8a6a54119827b2a2849065792539d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896027, "uuid": "cace5b4b-d37a-414d-a346-165f2b360f04", "value": "T184E56D11F6888F15E1FE3236E79216551BB3D1D31E62CA48768E73A45B623436E0F32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896027, "uuid": "156ae6aa-0d20-4d87-bc57-6c982df9bf12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896027, "uuid": "3911c1b9-c968-450d-bbc6-f6079ffcf270", "value": "49152:Op0nElEyxmOWVPuMb4qbiYekU7ULRsa9D21gxgesqDiZgEZAZV2/Rml0tWouDLZk:jvuJL2TfWzpdSDd85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896027, "uuid": "f8c7cfb2-ab7a-41c2-b14f-39ff7e75b05d", "value": 3051520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896027, "uuid": "c00fbb39-8451-4c69-b30c-838c9dbec9c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896027, "uuid": "649fd25b-1645-42fb-b9f0-48c39f85860e", "value": "SecuriteInfo.com.Trojan.GenericKD.49032101.27844.3783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee79e77b-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909082, "uuid": "1cca7a5d-5f9c-4bb3-96be-d211d9b0cb34", "comment": "Malware payload", "value": "1bb6a78d7e5c6851ce8559a3b8cbb016", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909082, "uuid": "d34b984e-f8f3-4112-a0c5-d185277c3d09", "comment": "Malware payload", "value": "c591604f1235b233787f00dcebe842eff9f7f231d45a7620b1d7c4e67d8a216a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909082, "uuid": "68f21adb-2691-4145-9885-a8db7b093937", "comment": "Malware payload", "value": "86162d0f1036e621f85b7ee0084f0848479f84ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909082, "uuid": "f1578ac8-e33d-4956-a2d1-833e1b4dafd6", "comment": "Malware payload", "value": "f5c19dd6bc0f66dff4c02cd7dd61341989076fb605017f16c5ea2e164968dedcc4affcecab485a065f7ae0b21057c123", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909082, "uuid": "880803ec-d36f-4e0c-a070-9dab1a772b8d", "value": "T16641CD8E1F714EF8F555E93887374B35679A924847D04249E2ACDA006FC430D89EEBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909082, "uuid": "90c13cbd-91d2-40b0-98ea-36ec7d1860ca", "value": "24:3uS7dsgph8AmsiRD8AmyT/z2HdllP2BUqtWB4u3nliI8paXDdz3N9l5zBkEp7iCP:eSegpEuQ2H7s+1zXD/9LuEpUnn2UWxMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909082, "uuid": "c97d5d7f-a50e-4faf-991f-9c4a0f5f9ae6", "value": 1984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909082, "uuid": "096c4955-3133-4483-8e55-95003f4f713a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909082, "uuid": "89c700a4-e93f-453d-b641-ba0bb5e28561", "value": "c591604f1235b233787f00dcebe842eff9f7f231d45a7620b1d7c4e67d8a216a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860e1a46-d6df-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652901605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652901605, "uuid": "2be605d9-f6b9-4b6f-a034-c7c15176cf75", "comment": "Malware payload (Mirai)", "value": "8ad9c3f7d32fa74879fcfdbca56184da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652901605, "uuid": "a10101c9-0756-4f9b-b760-f7085bdd8416", "comment": "Malware payload (Mirai)", "value": "c6c7d5643c51e06afade40d97d11d804421c12366f10427a8b0cfe70113900bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652901605, "uuid": "3905df5a-31aa-47d2-a5f3-7ee6cd5e5639", "comment": "Malware payload (Mirai)", "value": "190eccb2029f3826409bf8e1c8438eac0d086b4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652901605, "uuid": "482d5f2a-c4a7-48ee-b652-a26abd3237d4", "comment": "Malware payload (Mirai)", "value": "dbaa590ce80d2cf07e5463425a010f02833867e6f564ff6b8b1f6e32b732114838e4805161030b4123f2924e146d91ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652901605, "uuid": "2a6cf7e5-cdcd-4f47-a255-3adb1589a7c0", "value": "T1CF033A39B7752A1BC8D8643D26FA432CB2B5164E28E8C71A7E730E9EFF1095075136B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652901605, "uuid": "c1016b04-3e93-4aa3-8005-c7c4ffbe0e07", "value": "384:YqdE0eFit0md80rZ89OnDgevxZNTCe4ULe3mQAneMEF81LTFU+pBLOltb:Leo0md80rZ8kg8dhS2wPF8pTO+Gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652901605, "uuid": "b8da9e1b-5b5f-46ed-ac75-a4097ac6de4c", "value": 39488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652901605, "uuid": "339816ab-cdd4-40e3-8acf-5ebf23eccd0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652901605, "uuid": "1d7f376c-385d-40a0-ba4c-97c23d04f0ac", "value": "8ad9c3f7d32fa74879fcfdbca56184da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9047ea1a-d67f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652860391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860391, "uuid": "27f025e4-8bd8-43f6-894d-2d4a1aa5f46f", "comment": "Malware payload (Formbook)", "value": "e21f324f15efde144c8a0e4107197d26", "object_relation": "md5", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "encoded zip", "colour": "#D3BC77", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860391, "uuid": "44a22d7d-e86e-49ae-aeeb-de0b736446e0", "comment": "Malware payload (Formbook)", "value": "c7722c79d6e32511e879743467112fe5cebdc063e1938cfe59de4e1766c8a379", "object_relation": "sha256", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "encoded zip", "colour": "#D3BC77", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860391, "uuid": "b79a5ec0-ddd7-4850-a64f-bcf200c20269", "comment": "Malware payload (Formbook)", "value": "6ef1f5d8e6fda633aca810aa59f10e47e6ed0563", "object_relation": "sha1", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "encoded zip", "colour": "#D3BC77", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860391, "uuid": "2261301b-ac5c-4e0b-b18e-8ba3f8657178", "comment": "Malware payload (Formbook)", "value": "99f84264147faa57889c6f5b7db2516396dcc9156e39430287f851809a8875ddbff077b67e2344c2de158479c7bb7e08", "object_relation": "sha3-384", "Tag": [ { "name": "AWB", "colour": "#CD6534", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "encoded zip", "colour": "#D3BC77", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860391, "uuid": "1bc0c668-e332-430c-a70c-2c7728d89ca6", "value": "T13C52C07021CC33F4429C12544CD66A0D9F22BD26F7B05ACE9646FA0B0EF9C9407B62EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860391, "uuid": "4f3c2586-8558-4662-bde7-bc96ace7b6c3", "value": "384:7YcXGofTixYhkqyN3zbmG+M/Sen+H/+HsCAA:71XGYTixYhVyhbiPn+D5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652860391, "uuid": "06d227c6-1b3a-444e-b3d1-f626d21911e9", "value": 14436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652860391, "uuid": "f009e6be-49cf-461f-8ff5-3eada77800e3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860391, "uuid": "b16f735c-c55f-4bb5-8edb-50d136ea5d23", "value": "AWB-2091647183.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1305212d-d653-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841283, "uuid": "7655095d-c5fe-4452-9861-237e6e17c703", "comment": "Malware payload (Heodo)", "value": "4a77df90a7ea2f923f0cbca3b2127136", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841283, "uuid": "f2100d3c-995c-4f78-981a-9c412db7e092", "comment": "Malware payload (Heodo)", "value": "c7c3f6ea4b344fe38b9c0fe808445578d6a4510c6e8096703f24b2a415a723b4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841283, "uuid": "10dc0c5e-364a-4f35-b24e-0fdbcd14fc7e", "comment": "Malware payload (Heodo)", "value": "26d2f7d897576586947047294e59fefb14f76600", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841283, "uuid": "c77f9771-3b0b-4374-a0fd-93ab78b7f4c0", "comment": "Malware payload (Heodo)", "value": "4e05f974e7289e318d6e09408e23c4027b23b8068289be12e8b2ca7d5505a90ae9d28db8c37e037ed1643a9de8f92c24", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841283, "uuid": "1c81599e-1d02-4e76-8b31-3c9a44dc1450", "value": "T10B94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841283, "uuid": "6b4d227e-4182-4610-af50-145f2bef9266", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841283, "uuid": "12828e46-3e28-4b0c-9f87-5a9b97885635", "value": "12288:M3hV6Pw4aT23s2oRd9zi3BBoNIQ/hsA7:Yb6Pw4R3s24i3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841283, "uuid": "5871d5d4-737f-458a-9964-75e8f985c851", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841283, "uuid": "5e5f1116-ad1b-452a-89f0-097d9e8384a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841283, "uuid": "39d63b4d-f424-43c8-a2aa-05a82dd293d0", "value": "4a77df90a7ea2f923f0cbca3b2127136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebafa3be-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909077, "uuid": "cf07e37f-226f-4eab-be90-3144f0ecb52d", "comment": "Malware payload", "value": "c451e7a4a57c4ad693a25bcaf69b1944", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909077, "uuid": "6c9a49f2-2254-4b64-8876-cb4b471eaebd", "comment": "Malware payload", "value": "c8014dbd53586be729d98edfbdaba7fafd88878a316a01eaa89b947c9c7b0432", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909077, "uuid": "ca759198-61cf-423c-b20f-af5401e6f1dc", "comment": "Malware payload", "value": "75e5d14af06f72516d27f59fd16ffbef740d8507", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909077, "uuid": "1921bf7f-49b8-4057-b4d3-e2287bfb3785", "comment": "Malware payload", "value": "bdd628fa5515d889d4d15f213391d1b3e349488d8316d9be1cec7b97942397792c4aa1b22eb561987029141e8d09ec5d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909077, "uuid": "e1602c19-b487-401f-93b8-523701a63500", "value": "T1D1F5330C53ADB8FDB89946383B6384E1C5E502F2988264F2D7B815580C3F57E5B9FA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909077, "uuid": "bffd3f7a-bfe3-47a1-a212-d7214751cddf", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGMt:0XSxVJG2fLAqFOfT9sMYNMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909077, "uuid": "854cbf59-853b-492e-8843-198a83ddc83b", "value": 3518464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909077, "uuid": "711e27ba-bebf-4968-9932-2a8015d44bff", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909077, "uuid": "b9e0d827-1573-4d2b-b5b2-bdfbb9d7add2", "value": "c8014dbd53586be729d98edfbdaba7fafd88878a316a01eaa89b947c9c7b0432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b101c763-d6ac-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652879773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652879773, "uuid": "939c6eef-52da-4709-a3ba-52d8c1ad050d", "comment": "Malware payload", "value": "d69c76af0636101fd515db5216f1aa29", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652879773, "uuid": "6936a650-6a5f-40a8-9101-0426f9193e13", "comment": "Malware payload", "value": "c8aa21a4fb9ff8c79f11aeb15afb4fed5075b180d6f8a6f0ec3422917f13fedc", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652879773, "uuid": "b1e956c7-c582-4df4-a885-307ad9afecc9", "comment": "Malware payload", "value": "d63e38c27bedfe0a4ef0f0e9fb9d162fae8a9568", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652879773, "uuid": "a5955dd2-9e0f-4bc7-bc4c-34b0ac930759", "comment": "Malware payload", "value": "b2d4f3ffe2678d703ed554047296dce0334036bd0de6bfc3fb5f2e9a01670691423f939bccc90cc46ba43c9bbc227ce1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652879773, "uuid": "57c3e6de-887e-49f5-8ddd-aed70829c97b", "value": "T1EB518E387DDA111CE1B3CFB169D83699CEA9B973B9114D9E0086070B4952A40EE96E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652879773, "uuid": "65edf0c3-4f20-4180-9ed6-12f57da62ec4", "value": "48:8mutmxLZ7OXU8u0CLAr1teyu5R6fcIPj+4ab:8mNL4qMA5U64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652879773, "uuid": "c471af8f-04a0-4e8c-bb83-84731a6bef5b", "value": 2510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652879773, "uuid": "8db4120e-f6fa-4867-81d6-1ff7709e20f0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652879773, "uuid": "feb4a73f-e4a0-4d69-8456-0a75220bac20", "value": "Zahlungsschreiben.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af55243e-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908976, "uuid": "901884bc-31c0-4759-8f73-5ba27a074b31", "comment": "Malware payload", "value": "4a9d4c1171fef48fe365881ce49dea06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908976, "uuid": "2c5915a6-98c9-4ae3-96c5-48ea1e21ee11", "comment": "Malware payload", "value": "c8d2dc1886bff6d677bf353be0a0c803e828638921120581df2ab0b892274cb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908976, "uuid": "c2ca1300-0e43-43e6-8d3e-a6c005e9a67d", "comment": "Malware payload", "value": "219170fbf8a25549701ef0495e69bb511f7fb164", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908976, "uuid": "c5c44b73-8459-42dd-933e-4c9e6c2c13f2", "comment": "Malware payload", "value": "4e09005d04ff5825cf05349bd5b186e9434cd8902d11357b6aafdefffb1d422a709d1d22af91bfee5b9fbac9402a56c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908976, "uuid": "610526ec-4a4b-426e-b760-a323e8379e85", "value": "T19941241A1FD01F33DDB6CC32158B27112ACC902BB06A63956334E964BD3F645A7D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908976, "uuid": "c0e1e31f-e7da-476a-85b7-3ee7e8abbbf6", "value": "24:eY23H/ki9mpHRIJixZuDa9mC05BJL4mmlZ9npeIgO/qM+UTK8mKUlu/OTSWwFLCk:0ff2xnuDW2B6df96OScTLmPkOTAFuXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908976, "uuid": "ad9d141e-476c-4e59-9b96-a1a1188d7138", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908976, "uuid": "90126a46-3759-471f-b88f-db9e6cc343d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908976, "uuid": "5c970bd2-575e-40f1-822d-17ecf0aab67c", "value": "c8d2dc1886bff6d677bf353be0a0c803e828638921120581df2ab0b892274cb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9496ebf5-d668-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1652850519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652850519, "uuid": "dfee4406-3922-4494-a730-d3d1e8ee6cec", "comment": "Malware payload (DCRat)", "value": "c659d38c0ddae7d5dfff7645b9f84674", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652850519, "uuid": "a62e2330-4c68-4977-8cd5-62989b4e5fea", "comment": "Malware payload (DCRat)", "value": "c91009760109b885f81408a2b3861f6713ba9146f86ecfef26888691850c37ec", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652850519, "uuid": "3d20b1f9-29e0-4ca2-865a-6d8ecf2d285e", "comment": "Malware payload (DCRat)", "value": "e3377e0eface776ffdde47fb2b6cde8e66741737", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652850519, "uuid": "fb1d1b3d-0aa4-46b3-a4f5-a89e0196d7e4", "comment": "Malware payload (DCRat)", "value": "d7e541e7170dcb6535a4f54f01cc623c7c65c02bfa51567afbf8e5203dd45b3886e3ac0c853bf4e82e09dde1c03361c5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652850519, "uuid": "dd18ce1f-3fd5-43e9-8ac9-a222d91fddbe", "value": "T123556B017F48DE11F0092233C2EF454847B49951A6A6E72B7CBA37AE55123AB3D8D9CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652850519, "uuid": "53899e49-8372-4c57-8964-4fbcce17c18a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652850519, "uuid": "c387e0ac-045d-4829-ac62-046fff2a2864", "value": "24576:L0fsRYQAWlklragQwzkYfVS3Xzx9aUxmmrfrQGXfdl4IKo7uplQ:L0kGQ4raDQX6D3bUaXX1l4Hpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652850519, "uuid": "6484d9fb-4236-43e2-bf4e-310163b1f2c9", "value": 1317376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652850519, "uuid": "b38d39ae-1a9e-4001-8f80-30677a1c5370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652850519, "uuid": "f1f1812f-cd00-4ad3-b3d2-f512c91a90a8", "value": "c659d38c0ddae7d5dfff7645b9f84674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7b4cc0-d6d4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652896814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896814, "uuid": "b08a477e-5669-424c-887f-13cdd7d8ae4f", "comment": "Malware payload (Mirai)", "value": "4737248ff295a64d948d3994aea30509", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896814, "uuid": "ed41e7e1-f581-4520-8fcb-e8dca464093c", "comment": "Malware payload (Mirai)", "value": "c92c34f9d9cc7787bdf95a504e9a5c42d1b2ea68ae1359ddda59dd9dd4d4e893", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896814, "uuid": "4cb89c21-df70-457f-ba3f-51773698ff03", "comment": "Malware payload (Mirai)", "value": "1befe87365a09d822a8c551fa6beab30feaf38da", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896814, "uuid": "46d1647a-bb57-468f-be30-0e6373777fb8", "comment": "Malware payload (Mirai)", "value": "b5936b7bcf6a78733786e2f5c7c2c699ed21c7f8ad368e5e2622891192e8c99226147e9337e6ddff2142432cc78fd661", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896814, "uuid": "e276a26e-9aa9-4168-aec3-bc77dbc09dab", "value": "T1B4032A035451C2FDC459D6705B7FB52ACD33B03D0631EA9A73947E2A7A1BE212E1BC4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896814, "uuid": "43910028-1fdc-483b-8b12-c8acf4003127", "value": "768:fIrhjkeEsioiBTPnOp7Xh/CAgsSScsix/NcG:4h42QLU7XtZlK3xF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896814, "uuid": "f563f64c-6086-492a-bd74-4124f164157d", "value": 38144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896814, "uuid": "870e12ea-fb59-44b0-833e-4e388a301f41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896814, "uuid": "57c7bf0d-b76f-4929-899f-17d5675ec9a6", "value": "miori.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9a754f-d6e1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652902339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902339, "uuid": "241ecfdf-ca95-45ab-ae19-7bbe4c662894", "comment": "Malware payload", "value": "b2b6f10a49b035a822d6dd9aec0572ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902339, "uuid": "d948ad59-116c-427e-9620-210deea045e0", "comment": "Malware payload", "value": "c93415cc27e0c320d3052f3413a713f3b6b74a8e11b7787c4c37703e2cdda9a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902339, "uuid": "cdec5f48-7b18-4d42-93f8-14308b272fb9", "comment": "Malware payload", "value": "d5ab66e25c2852d948ccb404f41df7e66fa292d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902339, "uuid": "8fa40ccb-72ab-46d6-91d1-216a09d14db6", "comment": "Malware payload", "value": "f98f693b75a74d7bc3d0453bbdad92f999ab236405b744e91d289d976d8fcdcce66696416acd9ced72e016d47089be61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902339, "uuid": "24cd384d-86c0-420a-a80f-a611581a8a12", "value": "T11405273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902339, "uuid": "09315f8e-5b4f-4c95-9c88-3c5540e3e7c4", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902339, "uuid": "3d6281eb-a388-477e-a2f3-552a192b5d47", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oqaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7AUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652902339, "uuid": "da4ffd5c-9f88-4e7b-97e2-ce87c732af5f", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652902339, "uuid": "0587fe30-d8ea-43bb-aa0a-f651942d03f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902339, "uuid": "e94dc4f6-d01e-4856-8ba1-072487d31333", "value": "b2b6f10a49b035a822d6dd9aec0572ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c797fe1c-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909017, "uuid": "d4f14b4b-8e7d-4551-abb8-398db7c492a0", "comment": "Malware payload", "value": "d607043808f6f17ee53f3f06e01f6ae3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909017, "uuid": "29b16318-8545-4a8c-a575-b54c9d78f6a2", "comment": "Malware payload", "value": "c964083dc71538e4cfea21504def189ef2819c22aa073c48f3d70b3601d3a050", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909017, "uuid": "b06d308b-20c6-4583-bb87-d5b676d5c2c5", "comment": "Malware payload", "value": "9c717813761d0801c84391f28b51d70587a51425", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909017, "uuid": "8ca701b3-dea5-4e74-a47c-44d312b3b223", "comment": "Malware payload", "value": "a577dbdaddec01413f3f41f34157ef715cc22b1fee03520ba7066582ac5284d56db1d6f0fcd5831aa1f531a969867ffa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909017, "uuid": "6449ee9c-3b17-4b4a-b304-95c96d2a4d45", "value": "T12DA1F750112C1AB17346697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909017, "uuid": "69cd484d-833f-4701-82ca-7441070b29e4", "value": "96:mDRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:mDRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909017, "uuid": "f45c6bc3-ae8c-4266-a4bf-f08572993a5d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909017, "uuid": "ff7851bc-4b12-409f-bdf4-f1f67a0c1c35", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909017, "uuid": "5cbac40b-4b41-45d4-b958-02326c22d4c5", "value": "c964083dc71538e4cfea21504def189ef2819c22aa073c48f3d70b3601d3a050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fef93a-d6c7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652891408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891408, "uuid": "dfd3fa38-627c-4435-9e29-6fbc9e501eb6", "comment": "Malware payload", "value": "864bbb6314ae4dda7385906f77fafd29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891408, "uuid": "9cf0ec37-ebe2-4507-8ea8-4e0a2925ff45", "comment": "Malware payload", "value": "c9c30e8b5fcdba36818cdb867d9c3aa29ab421ea94eb77d2eb82001c8d9e770e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891408, "uuid": "962eb8ab-20a1-4e49-8325-748070240e84", "comment": "Malware payload", "value": "a7dcc4494a2eb7bd712df04ec988448886c87c60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891408, "uuid": "28fa94a4-2aaf-4138-8a7c-9d542235e543", "comment": "Malware payload", "value": "798af87111ea1d9832275e091aa1890dfc2cecf04d7bdcba0d842085ef66c3501179ba3397f852b9b8c4340639e43bc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891408, "uuid": "0e39524f-ddcf-4906-86a8-a843d965b6b2", "value": "T18815BF5D7280F95FC4578D36D9641CA0A660AC67870BE307A0473AADAD3E7DACF106B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891408, "uuid": "01abfce9-6ed7-49b0-b18f-df21eac86f8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891408, "uuid": "bb07d75d-dc41-4543-b622-08940a663d49", "value": "12288:m9E6Z8t8zPVJQHDTh9Jq9BchqgEi2wbHvRf/Ng7BQUytW2tZoJBPFJMwZTI/J4Xd:m9Eg1VyHDPJABchql1YvtIBPiBzcRFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652891408, "uuid": "7e46e758-c4a8-4715-9a3f-39d18248fa1e", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652891408, "uuid": "727cda6d-8cb1-45d3-a873-05084044dbd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891408, "uuid": "cfe67471-41cc-48d4-8ebb-e8ec72aa8fb2", "value": "864bbb6314ae4dda7385906f77fafd29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bdc77e-d6d2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652896028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896028, "uuid": "7f610b86-5723-4f93-b430-c06eb48ca6bc", "comment": "Malware payload", "value": "05b6cd41d00058638993f804a19daea9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896028, "uuid": "acf982ad-c1c0-4921-a428-4f01dc777917", "comment": "Malware payload", "value": "c9ce6cdd55466893068a0f0b4f6b0ea2e96ca3f7d55f818bda2205985037ac0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896028, "uuid": "e71cada6-c42e-4156-983d-12e78f1a7aed", "comment": "Malware payload", "value": "1464d4e2b26a84a7a3a0f4bff81cc29f1a728e47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896028, "uuid": "4e72ce93-708d-490f-8a5c-d76eaad9213a", "comment": "Malware payload", "value": "536ffcd8426ed8eb5c666eca882de35a3f313bd519642edba26a0e75c45909d3edae79c473f677c819095da3bd926a5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896028, "uuid": "02c70c6f-40bf-4301-8874-ba0439476903", "value": "T11325AE98F240E99FC8378D32C5344C70A2606DE696F7D207A097399D79FE69F8E105A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896028, "uuid": "5d1d7a0c-2080-4c21-92c1-e249565886cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896028, "uuid": "7e86d4be-6daa-430a-8295-24cece4b5ec8", "value": "24576:i5BV2x/5Lc8ykG0vIw3hpZBHp6QeSLLID:i2c8IwrZilSLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896028, "uuid": "0d96f9ec-163a-4dc7-8eb3-ea67793cd15f", "value": 1008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896028, "uuid": "0f8c799b-a713-4579-ae17-320442029db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896028, "uuid": "5e0be7f9-4015-4d53-b9c7-98b41df40504", "value": "SecuriteInfo.com.Variant.Strictor.272734.13476.3027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553df348-d6b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652884773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884773, "uuid": "abe87807-a0b8-436b-ab43-9a66be2c0b90", "comment": "Malware payload (Heodo)", "value": "52ade758ae3f94fa3bb6735a74108bb3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884773, "uuid": "1238d081-6efc-48b0-a432-4759a574cccf", "comment": "Malware payload (Heodo)", "value": "ca2edf464a6b4621e17ce9df2a6a9017cba34e8fde13e64eb8a382c4fa8c8d17", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884773, "uuid": "3e90d2d3-6ebe-4b56-b8ed-2dab2fdd9672", "comment": "Malware payload (Heodo)", "value": "f33762bc8b4bc89e5a1b3e558a00d6c6c0d92358", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884773, "uuid": "f0225951-c7cb-4cfd-8cd1-5b340c03412f", "comment": "Malware payload (Heodo)", "value": "310191fa2e3dc62ef8655ef9532c24e163439d56fa2a5d446966f92341c7b04d566b76470cac60706adf20ebd90b6fda", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884773, "uuid": "b3dbffb2-6dee-4ac6-a6d2-ec333ac7cf02", "value": "T16E54E007A2E940FBE9678278DC570B06D3B2B81257659B9F0371476A2F1B3A14D3EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884773, "uuid": "c69cad14-1c4c-42f4-b355-a823402830ec", "value": "8814d1a94d80f9b49a103ad2cb419460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884773, "uuid": "b4663e81-6215-4dc7-ba97-0b9ed061f866", "value": "6144:yRjSsk3AzLPQWkgbZJpDphv4MOTRqhTAK3yUil5FCsCfHG72:ojVhTQWrblv4RqFAKiNL4tm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652884773, "uuid": "2aaf2646-6c4a-4f71-bb97-44036f080161", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652884773, "uuid": "2daeb0a1-f727-4ff4-9d00-f9a81afaf928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884773, "uuid": "8275fd21-e3b3-4f75-9d16-380781cf2954", "value": "52ade758ae3f94fa3bb6735a74108bb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9214d2bd-d6d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652896042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896042, "uuid": "5578fd24-bb93-4265-a29b-c2548c2ff12b", "comment": "Malware payload (SilentBuilder)", "value": "77f18b0b905c1f89e298656de65a5c31", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896042, "uuid": "60109c24-3151-4d60-9b69-2f08cd264b8c", "comment": "Malware payload (SilentBuilder)", "value": "ca841fc1b033f53c0b24b2f7714fe72c4572b162ad580a8c85fb6e88208d3a7a", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896042, "uuid": "4b05f39a-0f4d-4133-b386-df016f55cef4", "comment": "Malware payload (SilentBuilder)", "value": "aa7a8443fde26f15f709633d6b5d280e3556ec34", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896042, "uuid": "63bdf6f2-11e9-4f5e-86a8-49d813d74aa9", "comment": "Malware payload (SilentBuilder)", "value": "069121023d9c75c09938c8ddba185995ea179efc6aef8eacf94f202a40899eaffbbc0db44dba563a7ce1fc7f67bd3703", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896042, "uuid": "1b55293c-f0fc-4ea7-b1e7-9e36549be82d", "value": "T1AD836B4AB69AC95CE5238739499783A9B323FC150F6B07873509F3613FF49E09A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896042, "uuid": "bc48c54e-684a-4870-ae84-b5b1877306d9", "value": "1536:rxKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgGZAezwrMCtvJecvRtby6H:1Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896042, "uuid": "11b9767b-7963-4984-957d-915646be55a1", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896042, "uuid": "f831ef35-d925-4176-b75f-9f75500ac96e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896042, "uuid": "7d6d59e5-66ae-4263-bc15-b2ff0b14ab7b", "value": "SecuriteInfo.com.XLM.Trojan.Abracadabra.42.Gen.2143.10813", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4c0c26-d656-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652842565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842565, "uuid": "aa2f3ee8-4eaa-443e-a413-3278c7b6f9f5", "comment": "Malware payload (Heodo)", "value": "024e1025c684a02a6f91771af3811fc0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842565, "uuid": "37c6d47c-fcea-4f09-9147-5c6725fb265f", "comment": "Malware payload (Heodo)", "value": "caf185c656a0b3b965300af023d4e98e268bc39a5cfad5953b41f21c9d4ab6a1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842565, "uuid": "060527f2-505d-4bac-95a2-38fb0537ea21", "comment": "Malware payload (Heodo)", "value": "be8d4497f66a20852d8a73dadef7f9b5b9598481", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842565, "uuid": "57495005-0202-43b0-9e14-78421b87be47", "comment": "Malware payload (Heodo)", "value": "52a361e2cfef90380da727c55da95daf3ca0279e97154968e2c618ad5eb6962da98f36a057a8519adb8e5d22de358025", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842565, "uuid": "353abe15-dfb3-4b03-ac6c-a8292923d327", "value": "T11F94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842565, "uuid": "f56e0c6d-706d-4936-ab60-a41bd3616346", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842565, "uuid": "e75bf976-ec0e-4498-afba-1953e6734110", "value": "12288:M3hV6Pw4aT23s2oWd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2li3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652842565, "uuid": "c961cefe-bf83-47cb-8bbe-b6ea48909a9b", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652842565, "uuid": "8d286f15-7d1a-4e7b-bac3-27e47b038284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842565, "uuid": "704b8366-8bbc-48fa-bd1c-5d71a9dd7656", "value": "024e1025c684a02a6f91771af3811fc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4011594-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908984, "uuid": "952ac40b-2c7f-44de-8d04-653276a0da25", "comment": "Malware payload", "value": "2c45246965d1483dd55f41821f8594d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908984, "uuid": "91d87466-72c7-4621-9160-b61c172a95c2", "comment": "Malware payload", "value": "cb1e92e4cab34335018ab0e7bbfc2c66de0990466b4858fb27b155a4077a0c62", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908984, "uuid": "9f4e8471-92bc-43bd-b1fb-af19ff66759f", "comment": "Malware payload", "value": "38c6f124d0f0c097cdcaf7505ce96ecd0f14265c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908984, "uuid": "d8474a12-015b-4807-8abf-3989f40c1eea", "comment": "Malware payload", "value": "57062d9766909682cdf7e119611b069dcbdf3d78c88ea48ac24bf004d9c007ccce0204fbbd80e6a1fec0db1d17b4d9a5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908984, "uuid": "8e893683-cb02-4c44-b5f1-1ce940163b64", "value": "T158A1F850112C1AB07246597AD26FFA92B40ECC1B097B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908984, "uuid": "a2914e30-cc13-4439-9fb8-d306cfdef596", "value": "96:gRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:gRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908984, "uuid": "09df913e-db51-451a-8eb4-e56f1253a880", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908984, "uuid": "eec51217-5456-446d-93ec-39686d06150b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908984, "uuid": "2969845c-7427-4356-84d8-335a69d58743", "value": "cb1e92e4cab34335018ab0e7bbfc2c66de0990466b4858fb27b155a4077a0c62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0802e08-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909085, "uuid": "1783d03c-73be-4f21-af4c-7b63e477ad7f", "comment": "Malware payload", "value": "22098991dde8cf561229b144bf1c0905", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909085, "uuid": "17e054d9-d875-402f-a782-ca4e1f1fcb3c", "comment": "Malware payload", "value": "cb678196ed362e2252077d56ada8238acff7d4ed6b10421ef7cc5c620589cdf3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909085, "uuid": "6a17ed1a-543e-4286-b4a4-ac297c6872b0", "comment": "Malware payload", "value": "42228f7932551d155df63b97be6a5d3b866aa154", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909085, "uuid": "907b3aa4-e312-4d46-b1fd-d39b11cfca2c", "comment": "Malware payload", "value": "da5da5fc515583fe9e3eebe565780f2e4b71776156dc9e75378f38305b976c7b37933cd6e14309409e46ea69a2b6eb2e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909085, "uuid": "5796db64-a5f0-4a12-9e48-767c621e3451", "value": "T13BE09229FCC184BE603EC565FBE7AC5A650F1212424B163C97FA1442B8B9C845042837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909085, "uuid": "c32abc34-bf36-4cd7-b2dd-5000f4011e5a", "value": "6:/VJq5/3NRVYlGHYjp3F5/iOqVKhOqLsVKhOqNiVVNMiOq6O4uVfvOZQiOiyiiO2:/VJ8lRaeYVitgh1sghyTyigYtPi5yiil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909085, "uuid": "3a116b67-294e-4c0f-ae83-4c478c2402c3", "value": 383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909085, "uuid": "98b2e391-2b90-4a79-bb68-e0947fae9701", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909085, "uuid": "fb549875-d7cf-4d11-bf0d-55b609bd9add", "value": "cb678196ed362e2252077d56ada8238acff7d4ed6b10421ef7cc5c620589cdf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf89fd89-d6a7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652877677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877677, "uuid": "1c7b5ce8-e0b3-4d22-bf3b-2795cb5a11f9", "comment": "Malware payload", "value": "f4f63c2df92b27b44dac7ac1c580dfa0", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877677, "uuid": "51db02c6-a822-468c-a900-ebf8b9b1adae", "comment": "Malware payload", "value": "cb8df382bd6ce69c33de4afdd258aba1c72ff05d7b1b484e7e1848ea54ded891", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877677, "uuid": "157bd8ee-1f57-4513-bf9c-ee0247e9d649", "comment": "Malware payload", "value": "bbc0d1704702ad75bc85cf49416b88f929eb0e44", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652877677, "uuid": "702d7f5f-b296-457b-a1b0-f93b2b30dc5e", "comment": "Malware payload", "value": "88da41599ebac7210df2cee985ec8528388fedce4d367501cec515e15d517958c3528eaef6b0810fbc2c66457aa0d987", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877677, "uuid": "25f062a1-b845-4ac4-b009-6832a31ae0bd", "value": "T10E9423881D178AC1452491E7B1746ADFDDBACF2BEA0D9E1D1C4B86F72A9060A345F0F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877677, "uuid": "34460df2-8327-4d0c-a74d-de49cf323315", "value": "12288:q8kuMd6/3yG7tPEAm9W+hoeREzPDWnjglEI:qp43yLNlhoeREXGoEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652877677, "uuid": "9648260d-9e03-4228-8c2b-7e043e027ab8", "value": 408779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652877677, "uuid": "b7d2516a-24fa-467a-8492-8f15ee347cf8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652877677, "uuid": "7c7bb74a-d08e-4533-84b2-5a50368989af", "value": "RFQ No-11400519.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa80d808-d696-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652870447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870447, "uuid": "af9416dc-dcc9-4c95-927b-87557f80fd70", "comment": "Malware payload (Formbook)", "value": "744caed3c4b28f192b80af7c8a5a83de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870447, "uuid": "08d8ea7f-a14a-4d81-b230-9923a1fe71c7", "comment": "Malware payload (Formbook)", "value": "cc715fcd2300c306a1254671a3119516a60d0662b5776a690e0c2b451f868d34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870447, "uuid": "c1e54502-3de1-4cd3-8abc-94378bbd7063", "comment": "Malware payload (Formbook)", "value": "79a9ba4b0cab1cc4cdba8e50152ab727063a940e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870447, "uuid": "2350e31b-db9e-4310-b757-7dc9d415a8ed", "comment": "Malware payload (Formbook)", "value": "ff611a7a82a290826183d73f4988ce3880f75f06b648bd5ae0a6a4373cf0ca4d1397f43977a418d25eb9b6c31e8f3179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870447, "uuid": "996ac959-764e-4872-896a-60fdd6e47acb", "value": "T14DE4E01822A8CD51E9AD87FEE06212F807746D07E921F74FDEA47CDA3D72380475A61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870447, "uuid": "a370f6a8-932d-465c-be84-26a9876061ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870447, "uuid": "508eb333-5b45-4791-a656-a5966e4f7b9d", "value": "12288:ulqA8BTBXeLPzOcxyYotcE1GtEIaKz7IoyqJ013mfGaZRAE2d1WwcY1dsHmGn:uxYtuLPq6yLtcDEQz7HyN3mfVZRAEwvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652870447, "uuid": "99e01512-5ed8-43e8-bfab-b4291bbb11c2", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652870447, "uuid": "62de8ca4-6d10-4732-9f50-020a2afca0cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870447, "uuid": "3b365ebe-6e96-478e-b842-3b4dc2c9f581", "value": "SecuriteInfo.com.W32.AIDetectNet.01.10937.6624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5d480c-d69e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652873641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873641, "uuid": "f839acd4-b981-4c71-88cc-e9c02497446b", "comment": "Malware payload (Formbook)", "value": "07aaa3e896b194576c00cd329feb89c8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873641, "uuid": "6b9918ff-8ac5-48fb-91c1-cd3569593edb", "comment": "Malware payload (Formbook)", "value": "cd6e449dcb31c5879c06455a3cf9fdcdf2fbe61155777e1f4e7d9b464790b569", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873641, "uuid": "36786ff3-ab3f-486a-9a76-5e4a2be50e33", "comment": "Malware payload (Formbook)", "value": "32d8e51cf41f653d9a72a03ed05a9a57738c2e92", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873641, "uuid": "14dc2c6d-42ea-486e-bbbf-3fa63e60f329", "comment": "Malware payload (Formbook)", "value": "fd3370eed5feac89043faf275d76fe2038d0340bc9b69990d1d670d827ec5c4a60000a51aa06958b8f14fb2dff0ee788", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873641, "uuid": "5ee80b67-bc5a-4f36-a1c1-2b2cf07566ce", "value": "T16824128A37749A89E2FE9D768DA21382C013BCF49D366EE405083117D673DE6A6CF074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873641, "uuid": "cfbd676f-86b8-4d15-a93b-5f0250da1d6d", "value": "6144:HhVbE+2YZNdUXYOiKqFGe3tOQd5lhcu2Fu:Hhe+2tXfA38q5lhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652873641, "uuid": "a9665e8c-86d1-4d3e-aa54-973f2f88b798", "value": 229032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652873641, "uuid": "36b7fb72-3164-4b83-9596-c81b3fe72db5", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873641, "uuid": "bcbe9b8a-11f8-4189-b17b-dd224bfff98a", "value": "Copy of G22-0419 VELOUR Lebanon.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4985eb-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908972, "uuid": "edd32c59-814c-4d92-9528-92f74cfc3e77", "comment": "Malware payload", "value": "7995017c03440c9096d48b787565b9d7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908972, "uuid": "87f629e7-8653-4fbb-b2ef-7d1b5811c442", "comment": "Malware payload", "value": "cdf2c0c68b5f8f20af448142fd89f5980c9570033fe2e9793a15fdfdadac1281", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908972, "uuid": "0754c462-1074-43c5-96f1-228d87179cf3", "comment": "Malware payload", "value": "98f9affa5c661d9d3a074b17e92161b911f4fa05", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908972, "uuid": "45bce3e5-8c68-4bc7-89ba-ffc2ab747f75", "comment": "Malware payload", "value": "f7137b05d8def450015e7ad2bc7a8abbdc33aa3aea23f47e3d92ab277fd77fd43809f231dc82f1b31a878bb5f0ab70dd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908972, "uuid": "9d48dbf0-4ea5-45e1-94e3-affde4cefe3f", "value": "T18302B2EF1ED0E23F54CEC9B91339DA162A6544A224F69CECC84487EE5E4BD40E4D48BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908972, "uuid": "8ed2472f-c963-4ea4-aaee-f8789eecd31b", "value": "48:+TRrXX5gT5+sT5FZQIrymlPhPxoWnvkkjb:+tX5gTosd+mlPhPxoWnsk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908972, "uuid": "c723f053-640c-4755-9100-4e97270b5b5a", "value": 8205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908972, "uuid": "5efc9581-9210-4aad-af0d-c60bec137410", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908972, "uuid": "a668cc89-e26b-464a-a25f-9bc821c0eebc", "value": "cdf2c0c68b5f8f20af448142fd89f5980c9570033fe2e9793a15fdfdadac1281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec19d4f-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909002, "uuid": "3b3ce973-1bee-43af-ba06-69fdb63f787d", "comment": "Malware payload", "value": "c8a5211630a5685e729792abc80317d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909002, "uuid": "53eb194b-25ea-4922-8d60-2749e4c6aaba", "comment": "Malware payload", "value": "ce095a12657f860c6249518613f260293f443bc67e1fd053d2c0fbc3ee210e6f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909002, "uuid": "c7e91696-1983-4d16-bc92-73f12ecc7b01", "comment": "Malware payload", "value": "20559a47f57f251833178fcb041fc7330e5d36b1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909002, "uuid": "5aa5ef82-22be-4dbb-85c2-8b55b3fddc15", "comment": "Malware payload", "value": "aa6ec65aaa5ff734087297b25bcb01a348b07916ce7d49570cc67973f25160e6ff3fac082bb1f304ca4fe19a19e01e36", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909002, "uuid": "3634bc45-7626-4b09-8db8-265eec5f6aa1", "value": "T1E40102FF4071EF0C4D9B9E69B1A5415524E9C3E575EE4FC64F0A163D0E883047024BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909002, "uuid": "a417c4eb-5b0e-46fe-8fb3-99ceebd13f88", "value": "12:q1xWNEF8NNI1hbWha9S0U9cKFCzSyCHvMCy9W3KFMuGeSP:qbWeFkNIfbWgCfCzOPMNMCMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909002, "uuid": "bb579a0d-3af2-4c1a-9f2d-45bacbf46496", "value": 830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909002, "uuid": "f13dac20-af19-4e3f-bec4-b33794ce39e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909002, "uuid": "27048de6-455c-4c03-bdd4-47e61d3407d3", "value": "ce095a12657f860c6249518613f260293f443bc67e1fd053d2c0fbc3ee210e6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e46336-d68f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652867406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867406, "uuid": "07f5c968-252b-499d-8364-d1e8161b7b67", "comment": "Malware payload (Heodo)", "value": "25d810609b20f736e9a420e58cac60e9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867406, "uuid": "6ffe3602-fb2e-4016-9dd0-e7c356df3e77", "comment": "Malware payload (Heodo)", "value": "ceea60c362d76abf1b95ea3b25b97dfd118a027ef217ea8c3b230f4e55fbcc9a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867406, "uuid": "5b4de581-7720-4455-adf8-2ad07bb5a250", "comment": "Malware payload (Heodo)", "value": "7db2f6e23e6e31bf6f6e5539571a07a6f6502a1b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867406, "uuid": "9f9880be-318e-4c61-bba6-bef9cb641c98", "comment": "Malware payload (Heodo)", "value": "7fcd32a13006134770d89c488de4d5a549d04a710ae5e73e3e457e4c91823c5b7ca1da4e229b96ef8a395533d2d7f878", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867406, "uuid": "cdf7d980-4a1a-4e05-807b-df5397cd18b8", "value": "T18C94CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867406, "uuid": "1e1cd71f-791d-4887-9b40-ec7530b33656", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867406, "uuid": "3ca155a0-1c63-4e94-8997-4dc81917a09d", "value": "12288:43hV6Pw4aT23Guodv91Wuwf07EIvH3+38+:sb6Pw4R3GuqWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652867406, "uuid": "5543fa57-dada-4060-9094-a1016224b6b5", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652867406, "uuid": "bdc61997-34b5-4551-bccb-a193a6a1c314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867406, "uuid": "37e6b060-be21-4b10-a65c-adf375ae5c47", "value": "25d810609b20f736e9a420e58cac60e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f223cc5-d6e8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652905298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905298, "uuid": "cd286cf6-0364-49a6-8c9b-792b7cae9521", "comment": "Malware payload", "value": "7df6153b3cc10b98ca278376566a9f1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905298, "uuid": "2b781995-3afe-48df-90bd-3fdbb8d2f4d8", "comment": "Malware payload", "value": "d08863508aeceedc62cd3f4ea807fdbaffce924dadfa8480c1958b0c2e36933b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905298, "uuid": "9ab45e9e-85e4-49f0-bf28-b6da39e731ab", "comment": "Malware payload", "value": "9231969c4f524aecc466dccbeabf590fe29ad38c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905298, "uuid": "3ec81fd2-3591-4bb2-97b0-dc68d160c78c", "comment": "Malware payload", "value": "887bc46c86c6a713b0978df1f3830f161b8b27a471c20999874c87e48c6d145955d8cdcb11e10d4dcdd40043e36fd95e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905298, "uuid": "dda69207-725b-47c1-9ad7-fdfcc4e158fe", "value": "T1A905283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905298, "uuid": "0a19219d-f11d-46ea-8e6b-2da0e11882fb", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905298, "uuid": "c725f58a-10ee-4f5d-89ac-773bd7f8caa4", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7tmpE3:BTg9UXRD2SeqfZZiBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652905298, "uuid": "7e0a8157-eb0d-42f0-832b-7f3c79d89feb", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652905298, "uuid": "472e4d97-c6d3-426f-95a8-ea9c1729deb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905298, "uuid": "9988e0ab-6489-4034-9d66-fc9b2b24d163", "value": "7df6153b3cc10b98ca278376566a9f1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde0197c-d6ee-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908195, "uuid": "42ffda4c-2bb3-42bf-acd6-11c0bbab867a", "comment": "Malware payload", "value": "db4014212fbb1e5c054160716fec3dee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908195, "uuid": "0960504b-35cd-4d9d-9781-39005b6040cd", "comment": "Malware payload", "value": "d0f2cf6de629a6814a3cad44492cee163648a1fbbe1105f9d64ba61e06c9aab2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908195, "uuid": "9f9e7f6a-8501-4ce2-85a7-8a95d18acc12", "comment": "Malware payload", "value": "86591d249ac535034fa884e7c6a25b6e39074378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908195, "uuid": "e39b1446-8591-4177-8044-dd5aab67beab", "comment": "Malware payload", "value": "e413f5c8fe3a17f37deadd514d0d6e1960800cf26ab2cb1795f94dfe2c7f3164bdf1a7a8413dfcb8dc240bdcf552f18d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908195, "uuid": "9443924d-6605-4e38-bbf8-6af1c7819dff", "value": "T16C05283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908195, "uuid": "b782134c-2b38-47da-b8c8-abc888398836", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908195, "uuid": "0fee5969-18da-471e-b269-3faebee02543", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7bmpE3:BTg9UXRD2SeqfZZinm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908195, "uuid": "8f54cf76-b4f8-46db-b205-6416702e9a48", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908195, "uuid": "16193ed9-ac84-41c7-95e1-e4cf960e3b11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908195, "uuid": "4643cf71-a948-44f4-828a-b5a8ca67396e", "value": "db4014212fbb1e5c054160716fec3dee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac2f47a-d69e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652873749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873749, "uuid": "ec340024-346a-4324-b143-17f004fbab7a", "comment": "Malware payload", "value": "f73fec1d43bc4cf20daffa673893983b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873749, "uuid": "f15c045c-6981-4fdd-9953-bf98e61471bb", "comment": "Malware payload", "value": "d1436252b743d1f522311de28d13a2ec5d8e399990f5c5c26f3479414076ee26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873749, "uuid": "07d30ab8-a060-4c52-b690-ae417d9e4f04", "comment": "Malware payload", "value": "fd8a6505ab3e82ea7057d1d2a297eb32cb8081f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873749, "uuid": "4167ea17-9ee3-4554-a13f-ed03f8270256", "comment": "Malware payload", "value": "fef1bc57521382e9549091888db78c25733c9fe84a13e37df1d3578925df7b5db5c57b0fc5518ea2c184f8c8eb62655a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873749, "uuid": "b29b66b2-2cc7-46b0-be5b-bd2378c568fd", "value": "T19D357A0E7FB08108C718B9F69CC107B1D1B1AD9E87A19B061EBF39997872483CDE615E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873749, "uuid": "d0f0cd02-2a05-4bb2-bf4b-86da76742b7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873749, "uuid": "f8d7fd08-cfaa-4edb-8886-ee88525cd8cd", "value": "12288:i+4r7Jc6myoqr4/dHSIbI0Q6pZJQmMOtfazDzjIocezS7WiR2z:ifr7+ZqrUfEaJQmLtAYo17iR2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652873749, "uuid": "c7d7275d-3591-4bd9-8aab-b359b1847161", "value": 1078784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652873749, "uuid": "5b9ebe8c-250e-40b2-a646-00347239ec02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873749, "uuid": "febe746c-5b46-4945-917b-01013f6215c4", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28ae1e6-d6e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652902941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902941, "uuid": "72676f9f-5d82-48d3-a23a-750a0d22ea3d", "comment": "Malware payload", "value": "43c57eff7c0d687cf18194c2992047f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902941, "uuid": "39af4707-b562-4e92-bc53-c2fdd644edfd", "comment": "Malware payload", "value": "d1b74574f0a2362b9bf750eb9cce0efcd6bb06bd4daf3192c9c5723ddf623c1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902941, "uuid": "fa432bf9-6990-40c2-99a6-57012a301957", "comment": "Malware payload", "value": "818da4a77e1ea6a4fab7d7907903636b45e28e49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902941, "uuid": "4c946969-8ce7-484f-a2a3-e56c6ef03162", "comment": "Malware payload", "value": "f208e8bff29771f2c1074d3ab66f78c73330b3f7423ca841aaf5ea6a728dcc79624d4f660d75eb32ea89f34033273faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902941, "uuid": "a2b72238-9550-4a18-bb5f-f51bb84629e0", "value": "T1FC05283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902941, "uuid": "1795d59c-f31d-41c1-bf05-fa44687d3f2d", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902941, "uuid": "11399988-74e3-416f-b1b9-9655e5875a0f", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7DmpE3:BTg9UXRD2SeqfZZi/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652902941, "uuid": "9798c9aa-8da2-40fb-a7c5-3d468b1be55a", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652902941, "uuid": "d4f1b592-9247-4453-b546-20f58783a9f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902941, "uuid": "281edf71-7db9-4c21-aa4e-0138076e762a", "value": "43c57eff7c0d687cf18194c2992047f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d9461a-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909032, "uuid": "cab48c29-e953-4da2-b423-46d5b64f5bf8", "comment": "Malware payload", "value": "3392280980ccdb96ddade44e833fcfb0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909032, "uuid": "59fbf231-82cd-42ee-9191-9eb8d10ac17b", "comment": "Malware payload", "value": "d1b7c7652f6e793bfa129d4b2abb8d0a80a6a40867005746547f3a99ff01bed9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909032, "uuid": "cf87afa2-566d-48ec-9d5f-4c26f4212c0d", "comment": "Malware payload", "value": "b543df699ecc8aca890709377517e9cae7ff4405", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909032, "uuid": "c2816723-9f89-4877-b529-bf9cb28d0097", "comment": "Malware payload", "value": "90bfeb98c6a73fa0b16ff4ff03f3f9b737aac45821a42721c6d8dbfa8ee60429b22884cf930a13c578e3417372940de4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909032, "uuid": "85422e99-9bf5-4a96-bb8d-4094e473ad14", "value": "T1ECA1E850112C1AB17246697AD26FFA52B50ECC1B0A777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909032, "uuid": "3e7d3072-0743-4f76-8bb8-f58f2a86fea9", "value": "96:DRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:DRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909032, "uuid": "3b33159b-3682-48cf-a636-a38c2279710a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909032, "uuid": "a747d31d-757e-4e51-9992-09e22916ad8f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909032, "uuid": "42367fa6-e51c-4fd3-ab36-89acf9e1ecc9", "value": "d1b7c7652f6e793bfa129d4b2abb8d0a80a6a40867005746547f3a99ff01bed9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c93dc6-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909069, "uuid": "07a46a0b-7f9a-475d-87bb-779916818f21", "comment": "Malware payload", "value": "95d39b7ffa756388453d05659977077a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909069, "uuid": "2cfc95f9-b02f-4118-a17b-93c5fe7a6715", "comment": "Malware payload", "value": "d1e855f66c8a09402bbc141d2384c811fc3059fd5e2830388df3c19f9954ab80", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909069, "uuid": "5c5129c2-eb99-481d-a14f-4d82fff74d30", "comment": "Malware payload", "value": "b1a1dcc102758c581010f33df09c409c84b72d47", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909069, "uuid": "4377e0de-ec63-472f-bd85-d27861debd44", "comment": "Malware payload", "value": "251917f7934e504e064ce1e6d3b98a521b1091e40957cb7c806e6e32ded2af6f5b489ba9e32c52282c92080b8f1e9805", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909069, "uuid": "750388d9-3eaf-415c-9da4-b1c1eb445a24", "value": "T189A1E850112C1AB17246697AD26FFA52B90EC81B09777B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909069, "uuid": "5af4af6f-00bd-462b-bc89-6842e4127d10", "value": "96:cRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:cRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909069, "uuid": "a6cdb810-cb94-4747-948a-4b82283a0c9b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909069, "uuid": "00b4c393-c75a-42a7-aad2-756ed3fa8a0e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909069, "uuid": "f7ead7e1-81ee-4665-80fa-9139822c8348", "value": "d1e855f66c8a09402bbc141d2384c811fc3059fd5e2830388df3c19f9954ab80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65bd56ca-d705-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652917872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917872, "uuid": "9ccdbacd-c9a7-41dc-a1ac-2b4b61ba5a7d", "comment": "Malware payload (SilentBuilder)", "value": "0e94888ba8256a51753f7f9155009345", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917872, "uuid": "63314b09-c7c0-4220-8671-6468ccf5b911", "comment": "Malware payload (SilentBuilder)", "value": "d20690f352b36dac34d6cff24f7e83c496eb6ea6e2a61ab037839dad64fa7bea", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917872, "uuid": "5c7779d9-dcda-4e7c-8567-9cf0cd8f8b73", "comment": "Malware payload (SilentBuilder)", "value": "dad63d26ad44daa2a601d004bd3aafc27ac1b2fe", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652917872, "uuid": "93cfddb3-a697-4290-828f-787f03fe3151", "comment": "Malware payload (SilentBuilder)", "value": "ed949ad79b7a658d2ebb574be86eb29ec7453c07e560f8d8ae2e88c03e7116d3af3cd7b0ffe13f8b080c3827b2201e9a", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917872, "uuid": "dda3e383-6a84-4cfb-8886-8520c0af4a9e", "value": "T183835A4AB69AC95CF5238739499783A9A323FC150FAB07873509F3613FF49E05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917872, "uuid": "c98d629b-22c5-479f-9ed3-9c8bedcadf4e", "value": "1536:L8nKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgVXAezwrMCtvJecvRtby9OQ0:sKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652917872, "uuid": "dd57f7e4-b771-47f3-933d-ed148d506b9c", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652917872, "uuid": "76e2999f-37d3-47e2-b770-067cd65c9ed6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652917872, "uuid": "3888b2b4-9055-48a0-a243-c557bb9d26bf", "value": "SecuriteInfo.com.Exploit.Siggen3.32389.1290.831", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edafb54b-d6ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652892760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892760, "uuid": "5d4949ac-88f2-4f08-b42f-df411c4b7f8d", "comment": "Malware payload (Mirai)", "value": "0b0225b87895d2e8a674cbfa2fe2fded", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892760, "uuid": "2fd215f0-aa3c-4c00-a9c5-cbc8f186f7b9", "comment": "Malware payload (Mirai)", "value": "d26fa976c136a95cc32fbb253f5570bd66977a86e83cccf304c12274eafd0c91", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892760, "uuid": "b44af84b-ae4b-49e6-8af4-af99f743aac3", "comment": "Malware payload (Mirai)", "value": "fb4105360bb4640920c7e3e0d583ddbb7a6a5a1c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892760, "uuid": "492887e9-8b0b-4fb4-b23a-47eaf87cbd13", "comment": "Malware payload (Mirai)", "value": "16bf1fd7b73573338ac165f68abf3a1bf5b746a9524a2f12be08abf43b54e33b8249b62cc407aba1d597fb30be086a00", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892760, "uuid": "9d6400af-e0cb-47c7-80ed-e6879b84d67d", "value": "T167730751B8819A23C6E5237BF96E418D372563E8D2DF3207AD212F6477C682F0D67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892760, "uuid": "e7d35dff-468a-4a3b-8136-ff2e9754f7f8", "value": "1536:j0TQdvgcgQvt8ybKsyicfjfS3Tvt2VIahWlJscy055RZTq35RmO:j0tfO3Z2VThKb583i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652892760, "uuid": "81a72a40-0825-4af4-86e4-5838862b3b0d", "value": 78844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652892760, "uuid": "3c62a39c-7b89-4f0f-aa47-3a7b43e1d615", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892760, "uuid": "874c7972-aacf-411a-a238-187a37b52d5e", "value": "Oblivion121.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785df228-d6c9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652892133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892133, "uuid": "2cf0fd77-7f61-4bd3-a7fb-7d94f09bf291", "comment": "Malware payload (Formbook)", "value": "22bde89a8afcad7436370bcbc8a6b1ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892133, "uuid": "b2832b61-82ce-43b7-b320-eccacd46003a", "comment": "Malware payload (Formbook)", "value": "d2c7dcc32790d18dbc53c496d2fc1fc26ba7ed11cd018ab9baa0b58108077b72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892133, "uuid": "9901d0c9-a53c-4df5-8e89-71ce1f89a0d2", "comment": "Malware payload (Formbook)", "value": "61ab09b372aca112ffb4e7c91ee114f0800ef97b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892133, "uuid": "7898bfb3-2da1-4deb-b944-3e42e3a71e00", "comment": "Malware payload (Formbook)", "value": "a30ffd3ca69cdec6ed71965eb01c824236c80b56a25562561c3a40be664ae848369b39e079c18e33d2bbcf7fdbcfc409", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892133, "uuid": "b7140025-639d-4305-8daf-3813b570c5b3", "value": "T1321412CC73D1D5F7DDB26A38183A0B476BF18A1518AA850B1B701F9F39A70A1DA0FB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892133, "uuid": "a6ac72e3-9079-4aeb-8fb1-f8c2cd8e998e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892133, "uuid": "0e12d84d-38e5-48cc-9a8f-ee0f3d2721ac", "value": "6144:ZYa6VWVy9U9kxdLqj6qrc1fd5NZfQQRE32bZA:ZYDWVCUSLqj6qrch5eQR7ZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652892133, "uuid": "aa1b2d69-95c1-410e-9e88-bc29336f4025", "value": 203349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652892133, "uuid": "7586f681-b07d-4a22-986a-c1de8196cac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892133, "uuid": "c9b4f870-5990-4730-8655-5bb9c75d4a6c", "value": "22bde89a8afcad7436370bcbc8a6b1ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61bbdf0d-d65a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652844421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844421, "uuid": "fea5a77d-de18-4bd9-a2e5-47da0c29ea35", "comment": "Malware payload (Heodo)", "value": "289bb339bc7e7b1b0d3774aa9533db7e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844421, "uuid": "7fd848d0-05b9-48a3-9a5d-68ac6dedc10c", "comment": "Malware payload (Heodo)", "value": "d30970e1ad53ecaa120c9ef468113ba280a43ca2df0e73e7ae1fb5529cb261ca", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844421, "uuid": "6c55819e-9e21-4d23-927c-27952938f30f", "comment": "Malware payload (Heodo)", "value": "4ba6e69fe3c7ca092fe0a8f58d63c8a735a16959", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844421, "uuid": "abeb9762-fbc7-4e30-a219-6e04f47a1e96", "comment": "Malware payload (Heodo)", "value": "b909fdd9a453786b691df9f839a4966ea5d74f0c480b131deebd96f8b75edaeb6794b787365bbf3812e15d93a23465d8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844421, "uuid": "074ac463-a051-41f1-9a0c-71980949aeeb", "value": "T100A48C4AA6AC58B4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844421, "uuid": "aa27d003-da77-451f-a6e6-6435765464a3", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844421, "uuid": "c3d836cb-e2b2-48fa-8ca2-2a9aae2cc1c6", "value": "12288:uS4BnAed8BK2o0ana5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKya34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652844421, "uuid": "f143db8c-76ae-429f-848d-5d22a016f722", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652844421, "uuid": "b4fb29de-5f48-4030-b392-c933cd5f68bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844421, "uuid": "84af838c-7c5d-4927-b5f0-f28cbf2f4d74", "value": "289bb339bc7e7b1b0d3774aa9533db7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063db941-d64a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652837396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837396, "uuid": "33b0bcf7-58ec-4fbc-86a7-b3affcf740df", "comment": "Malware payload (Heodo)", "value": "c9ad4eddfbe7cbc690aea7cd22a0c803", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837396, "uuid": "256be990-97a4-47f3-9011-f483c445b8df", "comment": "Malware payload (Heodo)", "value": "d30fa17190ab3ee8f22d3a1310bed77a349d50078155eb2dec8d71c1f25a6ef5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837396, "uuid": "e3e8a20a-e8cd-4ced-9053-e1bd97a7829f", "comment": "Malware payload (Heodo)", "value": "635ec3d2e4423b7bc14153adbc75aa2ffb9e3135", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837396, "uuid": "31ba100b-74f4-4274-bfeb-6ea861d46821", "comment": "Malware payload (Heodo)", "value": "098c5497805a8aa68104b786364892f3e9e7fb4c91b52c931450369011bf871a69eac68dc68e0e2915d217ab814ade92", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837396, "uuid": "a78527b3-1b19-4d44-882f-3bc0fbb9b2d7", "value": "T1D1A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837396, "uuid": "79d91273-c853-42bd-8619-cdb357826b23", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837396, "uuid": "5ebe2e67-7bd9-40bd-849b-8e34f25b1c43", "value": "12288:uS4BnAed8BK2o0a5a5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKYa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837396, "uuid": "4d050b53-d226-4243-9602-d0627aff8d71", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837396, "uuid": "e742dac4-caa3-46b2-b352-90c01b96c720", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837396, "uuid": "4bbc9ea4-1e1b-4bc2-8fcf-f5c3737731d8", "value": "c9ad4eddfbe7cbc690aea7cd22a0c803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214f8c47-d6f1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909167, "uuid": "8830aa30-6402-48ea-9c5b-5537a52d23b1", "comment": "Malware payload", "value": "72905aa96729a63f6bcb1f4b3096259f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909167, "uuid": "03245ec2-5ecc-4a80-88e2-637e7d09d5b2", "comment": "Malware payload", "value": "d35e670038854259c710653a5acb31d53bf1ecb5ca5e79754528ee6fb5ab3cf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909167, "uuid": "ae4f15d8-d266-4467-820c-5a29a37cc41f", "comment": "Malware payload", "value": "501787d1c0fb7491f628fa0d55eec0c17ca59fcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909167, "uuid": "6fcb52ab-cfcc-42e8-aa04-f4c9f036f6b0", "comment": "Malware payload", "value": "6ad88341a98e09f7d9d9cf54e419875981ee5d29166ee7b840fb31b04d03fe406f8193592a490dde0a7b2546b1eded2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909167, "uuid": "c77e75c0-6d1a-4c46-bb72-07a41241bdff", "value": "T17195C03BF268A53EC45A1B3245B39350997BBA60B81A8C1F07FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909167, "uuid": "14e5fbb3-239c-4a34-b34b-3661d8e31257", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909167, "uuid": "c4c45264-2dd1-42a2-8278-9d944718fb5b", "value": "24576:+4nXubIQGyxbPV0db26WIJVEuPisv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdOr:+qe3f6i07SffPMWrQ0Zkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909167, "uuid": "f937539a-9a2c-475a-8c2c-4c16ee84a2fb", "value": 1935824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909167, "uuid": "f82b5b9f-4a18-414b-83d8-deb7d7da7813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909167, "uuid": "e6d12df0-d30a-44a2-aad0-0cc934f08828", "value": "VkDJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0d499b-d647-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652836303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836303, "uuid": "592658bb-68bd-4d49-ac79-dc775a7ebeeb", "comment": "Malware payload (Heodo)", "value": "cf92bea011e3b4624afd54c45bc74980", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836303, "uuid": "63fdb3ae-8916-454c-af3d-114d46b238e9", "comment": "Malware payload (Heodo)", "value": "d383dc1d853314219c01531d287fcf502f42dd3ab883012625e1a24be315d9fe", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836303, "uuid": "4004261d-a12e-4148-a889-84cffe50f9ee", "comment": "Malware payload (Heodo)", "value": "a58ec6c8be662f7d66a3d93f011d3940a0d033d6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652836303, "uuid": "a65f9117-3eb0-4d70-8290-a25c2d7d1539", "comment": "Malware payload (Heodo)", "value": "1e98b421e6a173c44f04435b92ded2cd87de2c3b0be2cae05f416b53466e5e2d5989ce3715b61c087b17f010329dd237", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836303, "uuid": "72fb8017-3446-4e6b-9aa7-8063c0226974", "value": "T14394CF1572A50CBAEC779239C9434A06E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836303, "uuid": "7254be9a-9832-4217-9646-81c9a8d32d91", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836303, "uuid": "4fa7731b-70e6-4049-8158-77e6b27828ba", "value": "12288:M3hV6Pw4aT23s2oMd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2zi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652836303, "uuid": "f98c2bcb-799b-4ac7-883d-9f4314e91b5c", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652836303, "uuid": "27d88e6e-f8ea-4ac5-8e1e-bdc26c76b8c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652836303, "uuid": "7a070d23-1f76-478e-bfd2-c1456680e0f5", "value": "cf92bea011e3b4624afd54c45bc74980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36dde5a4-d697-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652870549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870549, "uuid": "e00d5145-b11b-4b43-b731-3edf20fc11cb", "comment": "Malware payload (Mirai)", "value": "42d65cab82053c2ee51202d30cf2563b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870549, "uuid": "8f8d32b9-3825-422c-8046-03a3637f913e", "comment": "Malware payload (Mirai)", "value": "d3aa305a90f683684ce37689bf3d06901b14ed1105b0a96630cd091d7bdfbe64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870549, "uuid": "5354db6d-c7b3-4488-9c57-d730a9174174", "comment": "Malware payload (Mirai)", "value": "1e90a61865ea6d13a96a74934ebc4968015a68aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870549, "uuid": "849f0805-1167-43fe-a2e9-0f4bd1b6da80", "comment": "Malware payload (Mirai)", "value": "c4b798b17a9eb3611721bad46819b93c721aa597d1257928cae376aa044aa53674595260a0bcf6f6a1d9b603864c836d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870549, "uuid": "246c0c54-40c5-41c7-a52b-97097460bbf5", "value": "T10693BF27C9341D54C1144A7131F5DB369323961285C72DFAE58ACB6DA843EEDF22ABF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870549, "uuid": "75d75915-ec9f-49a5-a6bd-289956b5fa07", "value": "1536:+2CCLgXpFRCVfVe48yTd4njx8Vi3+X39CS+r46KX7RcRHup5hrw:F7SJidiyTd46w+X39umXE85hU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652870549, "uuid": "216a0ee3-7b73-4724-9f18-d104f8f32068", "value": 91508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652870549, "uuid": "f8b08fba-c08d-43a6-9a47-e53bccda974e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870549, "uuid": "6ed3ac17-c7cb-4693-b76e-4141dc8bfe67", "value": "42d65cab82053c2ee51202d30cf2563b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4293e6d4-d67c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652858972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858972, "uuid": "5a4fa0f3-5a24-4d86-b1ff-94a78db39154", "comment": "Malware payload (AgentTesla)", "value": "a70c204dabd51f1a5fa6909ad97b85c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858972, "uuid": "f4ca2c69-cb91-456e-b361-d89289679dd2", "comment": "Malware payload (AgentTesla)", "value": "d3c3eaf544886b59568e9bd922d683002f64909d70ac6c50c9434731b2171a8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858972, "uuid": "1e3b6d50-cd83-461d-9854-4b89e1b48e85", "comment": "Malware payload (AgentTesla)", "value": "57f050b6e8f9923f9324c8cd0a8b6a5cbc3761b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858972, "uuid": "d81366c4-0597-4216-91c1-0675144e3005", "comment": "Malware payload (AgentTesla)", "value": "f895d312afea9924909908aea7b5efbea45c0eca5d983cfc2fcc64e20446f37151a8d6ec3d212158d4b5317bce832141", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858972, "uuid": "c55a6c0a-ef8f-471a-badb-7bcca278c720", "value": "T1F615D7AC321071DEE86BD676D9A85C68EAD0746B831B4103A02793ED9E4C9B7DF140F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858972, "uuid": "6e806090-9b20-4ad8-ac5c-0aaf8538f18e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858972, "uuid": "37d0b487-dc67-40a1-9edb-76c7860db3a9", "value": "12288:F3WkaWiyRv63Y3cHsjw3YJB39Ia9tonzHq1vrSR8/UweQUAvA/k5GF8KmqvKKeHj:F3WkaWizoMHsU3YZIaUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858972, "uuid": "4b923e9b-d249-4fb7-a7fe-14a7c41dea9c", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858972, "uuid": "2aebc57d-1f60-4762-a387-933b69082588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858972, "uuid": "dd121e2f-835a-4797-b9c1-207ca1f06362", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4a5312-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908999, "uuid": "45d88c7e-77e7-4e96-86ba-283bb6dcc06f", "comment": "Malware payload", "value": "386164fee695a32061473d0f8c5b49b8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908999, "uuid": "574f43ff-56dc-424f-b1ff-096953075436", "comment": "Malware payload", "value": "d407b0a8a0d555f4ba6f0dfbb5255a1c0969f17db0c256f2e45b7fb7f98eedd8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908999, "uuid": "84fd4bb7-6f68-462a-8b24-69b2ef3f4e73", "comment": "Malware payload", "value": "8b374e8646d1b26205a1a49f73b1f6e5405f261b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908999, "uuid": "6645de3e-e444-4c53-a4f8-412beff37e42", "comment": "Malware payload", "value": "08615df16618d7eff0a92eaa0afb0b2974053e0b671cd47107836f5c3671582d182cfab8cb2b70aecb3f9291021b7299", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908999, "uuid": "aa04896a-b352-488a-bbd4-47ac5f98fae4", "value": "T123A1E850112C1AB17246597AD26FFA52B50EC81B0A777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908999, "uuid": "32dfceb4-8bdf-4e52-a1eb-30234e191fcd", "value": "96:RRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:RRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908999, "uuid": "444ac11e-9352-4259-930c-07edf1cb4522", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908999, "uuid": "c2e47a08-5fd1-45df-85db-00bab715b84e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908999, "uuid": "e416c074-3ad5-4f9b-8c65-fb5c066dbc94", "value": "d407b0a8a0d555f4ba6f0dfbb5255a1c0969f17db0c256f2e45b7fb7f98eedd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a8fcda-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909038, "uuid": "39fa0d62-bec9-48fd-a163-d3a13b3be12c", "comment": "Malware payload", "value": "5860b898fab272f49728107d2991da3f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909038, "uuid": "a183872e-8017-4e9a-97c7-53d319995994", "comment": "Malware payload", "value": "d4b976e270f399e759db07ba6b0a6338731109f603d5abf7b6098cec0a89e955", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909038, "uuid": "21ef394d-ba39-4cae-a9fb-8b66bcf2061d", "comment": "Malware payload", "value": "53bcc1b153035db437aacf59b554d59800938fbf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909038, "uuid": "3ad488a7-0e60-444f-b0de-ca2f38e9945e", "comment": "Malware payload", "value": "cf32941479c7223d0a2dd9ba5acadc4dd1796ba3a96e40e371d7a33665b12aee397ec5afe3421777b5164c4cd001a37f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909038, "uuid": "084d5c69-e153-4b3a-b15a-0cc23d58d164", "value": "T1D1A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909038, "uuid": "de79a703-3ff9-4322-b7c7-ce347ba5d9f1", "value": "96:GRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:GRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909038, "uuid": "d94d12a3-db7a-4075-9be5-4512545416d1", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909038, "uuid": "a751bd07-953b-44dc-a72a-53f4e5c5ad2e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909038, "uuid": "ad14d928-0483-4c99-86f6-d43ba22136c1", "value": "d4b976e270f399e759db07ba6b0a6338731109f603d5abf7b6098cec0a89e955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb3e7b7-d6dc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652900143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900143, "uuid": "6991252d-ae17-41b3-9c26-0502f47786d4", "comment": "Malware payload (RedLineStealer)", "value": "03822fcecbf038dff981180fbbebdb6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900143, "uuid": "aa067ce8-8fcb-4c16-89ea-874c61e58a89", "comment": "Malware payload (RedLineStealer)", "value": "d5d20876298dde3e49b0284b29f04b45d96f1d23b3a143aa1e22dfffaf8ad26c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900143, "uuid": "1f49ed11-0fc2-4022-87da-4dcda4b5352f", "comment": "Malware payload (RedLineStealer)", "value": "c291715a2aeaee86e260366830e26f3ffd521a15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900143, "uuid": "c9f2efb7-6e42-4978-8b2a-1d3892b70130", "comment": "Malware payload (RedLineStealer)", "value": "830ce8e49cda667259a032bd878950c7041f26405cf76b01303c4f38476ee0afc008676aeedb00614bf1b62d5c258554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900143, "uuid": "3cff19fd-ae91-4105-821d-6a264f16c3d2", "value": "T13A94F111FB90CC72D4011E3054B1DBB28B37FD62A974954BE7885BAE0E733A19AB7316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900143, "uuid": "51b4e556-0d5d-4d82-b515-4e82004c975d", "value": "151adccff5e70213fb31de55ca880f7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900143, "uuid": "1b796c98-38bb-4510-ad03-3532a458b210", "value": "6144:lB3+KTOERexCWZD2hsX1XbEqdntq598dmQriga3wVfN:H3+Ki6YC6ChsX1LEqdtK8AQG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652900143, "uuid": "ec9253b4-2d68-4b95-9b3b-3262b42df202", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652900143, "uuid": "340b19f4-822a-40ce-b9e4-6144861c3220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900143, "uuid": "aadd0a9c-1ba3-4927-aee0-a6769295ae83", "value": "03822fcecbf038dff981180fbbebdb6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af20f04-d65c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652845242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845242, "uuid": "a102637f-bb66-4817-a98c-95a2e468551f", "comment": "Malware payload (Heodo)", "value": "e84e1cc81ce949974acf088b8fa4ce90", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845242, "uuid": "97e1b8b1-5955-41da-b7df-271526af6b8a", "comment": "Malware payload (Heodo)", "value": "d63415bc21d904450bb2dc6e529479845129a9de1cfca6a7b882b9c9481caf9a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845242, "uuid": "04c75e05-fe82-47eb-bac2-436a6ab4c3ec", "comment": "Malware payload (Heodo)", "value": "13d1bb59cd745cb1a841cceadb56696999821a1e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845242, "uuid": "0219d99c-dba9-45e1-9c3d-4294e0093bf1", "comment": "Malware payload (Heodo)", "value": "fe35c9ae0ef83285418b7443c2084596f35dc235f20d7f1131bd5784f92bd3ab2b40ae381704021a6e26e9d59ce86a72", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845242, "uuid": "d233cf5f-5a57-4d63-8a6d-7e85beb5d4ad", "value": "T154A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845242, "uuid": "8ea0762b-bb9e-49b5-863b-831375e0163b", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845242, "uuid": "824166f3-c691-4980-826e-12769c55d7e3", "value": "12288:uS4BnAed8BK2o0aJa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKwa34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652845242, "uuid": "7f7cfff2-e9e4-4ef7-827b-f17431ec290a", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652845242, "uuid": "a74fdc02-a465-4d66-8ab1-8ab70b13a4e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845242, "uuid": "f2ac9340-d62e-45ae-8d08-9e8ba7442ac1", "value": "e84e1cc81ce949974acf088b8fa4ce90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd24c41e-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909026, "uuid": "d681bc47-bc74-4cc1-a315-bca8db283e8b", "comment": "Malware payload", "value": "e343aad807be4aa555b5562bdb955069", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909026, "uuid": "9d267fed-0f91-4164-a8f9-cae466ac8fa8", "comment": "Malware payload", "value": "d717f2c8741f47f5658c1328edd26ce04f6368b14afa9cc94251e09dda41df16", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909026, "uuid": "28ceec60-f3df-4a69-845c-fcdb60a87162", "comment": "Malware payload", "value": "c96754bf01fe9a41adc0dccacef928b3ecf750ee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909026, "uuid": "1bc56607-ddd5-4fb7-b415-fb7c6fd8e257", "comment": "Malware payload", "value": "2337a868e45d074015943fdd9631e9c52a4e44aa83db1890de99ae74af97ec6215cf6fcbed294f142c95da7155d2c797", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909026, "uuid": "d884b1ff-c930-4f83-8650-d16286e95d34", "value": "T1E7A1F850112C1AB07246597AD26FFB52B40EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909026, "uuid": "3e9da911-f076-4af1-9a24-e8c3ef5873c0", "value": "96:5RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:5RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909026, "uuid": "cf03f2c9-d662-4892-bd4e-2c254a979a10", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909026, "uuid": "53507125-5929-4f90-a118-3f1a34dd5b50", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909026, "uuid": "2a57fc72-ea5f-4de7-a80c-6915593b4279", "value": "d717f2c8741f47f5658c1328edd26ce04f6368b14afa9cc94251e09dda41df16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4e4a01-d69d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652873190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873190, "uuid": "f2176aff-03a4-46eb-802b-3f2e3e3bc470", "comment": "Malware payload", "value": "cac907372c94febedad023b3dbc3bc23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jlaive", "colour": "#8D1737", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873190, "uuid": "18f0c714-e740-40c3-b7b5-0f8b0c347365", "comment": "Malware payload", "value": "d763020097798a06a3211fcc6eccc41d8ab7e3a2571f206c38e4ab30a512015d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jlaive", "colour": "#8D1737", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873190, "uuid": "ed56d743-588c-49f5-9144-906ca6d4b357", "comment": "Malware payload", "value": "527a73761514ad54ea845fcc46319f47037222da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jlaive", "colour": "#8D1737", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652873190, "uuid": "28b354d5-6ec4-48bc-9c2e-ab4127238f61", "comment": "Malware payload", "value": "2556cc7cc3c1e326bf94b34dbc6032ec4c878e8b7ec3c5da0cbf377e80ec59386eacd180989357b0c96cb20c22a92ee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jlaive", "colour": "#8D1737", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873190, "uuid": "a14844fb-6d82-4c47-b5e4-c0a342e17e25", "value": "T12AB2B50437E84318FBFB4B359A7651408A73BAA7A931DA1D798D119C0FB764085B2FF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873190, "uuid": "17b71cd0-634a-4e80-8c3f-f38c4cd63bfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873190, "uuid": "029d1db7-a19c-4f4d-bddc-834c55375096", "value": "384:JJeMCOXytoVo+7rc01aT11a0eW0FLLNSgFTAZ0x8mTOfnvSm:D9i4oCgmYiZXx8mTOfnvSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652873190, "uuid": "21184db8-044e-4f83-8428-f3c0f0e4c27f", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652873190, "uuid": "41cd8dba-29f0-48cb-bb81-2c6c67564d85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652873190, "uuid": "7ba1c79c-1224-45e8-be86-1da3ca4e790d", "value": "JlaiveCLI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f8401c-d6a3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652875674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875674, "uuid": "0da22988-1085-4e78-9610-864e23610717", "comment": "Malware payload", "value": "b000082824d51bda81b046be122a02f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875674, "uuid": "5db082f7-4024-4359-98a2-976eb03f5f85", "comment": "Malware payload", "value": "d79a3905e74be12a90010d43149399e3217faa91354e0ce4ca083c600e295b38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875674, "uuid": "da925352-3659-48f8-a32a-8b7935784cad", "comment": "Malware payload", "value": "98e81fc7abebbc17198d94625b85f75d7c7011ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652875674, "uuid": "0641a208-a366-4b35-a958-16f89ab4a7de", "comment": "Malware payload", "value": "b081140a7b815a1a4fc162d6fd8d84df11b9e0d11b944fe2f5406a17f6bcacf404920b9b282002c710e229ac90ea23b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875674, "uuid": "21f52dce-02b1-45cd-b938-7e0570b5b028", "value": "T10A45D05D3290FA9FC41B8E36D8641CB4A6607D668707E307A457399DAD3E79ACF002B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875674, "uuid": "5e3a71ae-a003-4a4b-93e6-7e76ddce9a5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875674, "uuid": "f94fc6d6-cf7d-40be-9085-4ae0d579a7f5", "value": "24576:UsTFBb4XQarNE/XNXYCyA4z1z8nA/eYcHs9xWMrH:UR9rskA4zR8nqeYAKVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652875674, "uuid": "f9b4915b-1e66-4117-a5ce-c24f3e98d0b5", "value": 1184768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652875674, "uuid": "bbc3c3c4-4291-4874-aa67-1597aa904aca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652875674, "uuid": "b5b730d2-2ce9-434a-896a-55eb0256e8a5", "value": "Remittance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924972e1-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908927, "uuid": "68b44c5f-d739-4ee7-b279-58c00fc1fdef", "comment": "Malware payload", "value": "5ed50fce43bf6fa2e46d26796526b247", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908927, "uuid": "733de5bf-ee82-477b-9f61-c52e57f90ff0", "comment": "Malware payload", "value": "d7b0819019609152f91d6718b1e74d692bdcbd20b18487485b63c68f2cf37c30", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908927, "uuid": "8e8880a8-1683-4102-aa95-f4ee58fcdcec", "comment": "Malware payload", "value": "ba1fd5ae590b0b1a0893d230642634bf609dd72d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908927, "uuid": "a2f5df9d-149e-4852-a242-00559b9d5a69", "comment": "Malware payload", "value": "6742b269307591abbde6f04e7f537d1f190e6499e2199f6e14403527d49a320f516dff211cbb3c2e79105a61aee96492", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908927, "uuid": "edcf9d48-c464-4f04-afd6-3e7694273da0", "value": "T17C419ED061A139B13DB799F7A72E283039C0D03968905E8939D4B4F48AEDE4931C4AFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908927, "uuid": "66089ded-f61e-4911-9c8a-29e60b72e671", "value": "24:IjoV0oXm9YMoki/EHoi/CKoiuv4doiFAj0Pk0oi4Rqo0oCMIM5M1ok6:nm9k8/Csuv4VFAyn4RjLSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908927, "uuid": "bc87e394-4077-4ce2-9760-60a6f902a817", "value": 1913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908927, "uuid": "44bd0bd9-741b-4e38-a7c2-5bc5c5e4c271", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908927, "uuid": "00dab5e3-550c-426f-88ba-265a1a1e7edf", "value": "d7b0819019609152f91d6718b1e74d692bdcbd20b18487485b63c68f2cf37c30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc6a983-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909000, "uuid": "665863d8-4184-41ce-984c-d5c4f4f78ce6", "comment": "Malware payload", "value": "8c559bae592f67f01a8857bba4c9fa38", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909000, "uuid": "b6ae84bb-0872-4a28-aaf8-5c487e8db337", "comment": "Malware payload", "value": "d7d517edb4898bcfe17fd2dc06e2a5d1a04a25e2e957b9f0727cb0205b7c6938", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909000, "uuid": "bb912fca-e68e-4f79-9866-51d955a82c85", "comment": "Malware payload", "value": "cc1281930a10268dee3a9abfbee6631dcaf3bf0c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909000, "uuid": "3de36f41-a03e-4fe6-9415-c36654ed3bf1", "comment": "Malware payload", "value": "96889d02df76b736a00e4e56af682a17f50460595624c9778ddec7c46ce6e9f54e30c1a188dec3db494721c5fa91ee85", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909000, "uuid": "b0b5bb97-5555-4188-9bbf-be4b672b5405", "value": "T17EA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0796C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909000, "uuid": "cb481f38-bfa3-4092-8f0a-9e6872ebe0f2", "value": "96:GRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:GRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909000, "uuid": "44093f04-ed75-4f6b-a503-54d7edd87e09", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909000, "uuid": "b59dcf57-0b49-4b62-9355-e79a201c2e6a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909000, "uuid": "d4cd7481-0b7e-4fc2-9798-9c06cd1c6b13", "value": "d7d517edb4898bcfe17fd2dc06e2a5d1a04a25e2e957b9f0727cb0205b7c6938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3552f35-d654-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841981, "uuid": "bb056d42-cfe7-4702-bc31-3793db28d8a9", "comment": "Malware payload (Heodo)", "value": "9e1471e25e73716c107c07ae13b4a55f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841981, "uuid": "6c1c55ec-1589-4864-93c0-8ebd4756ec89", "comment": "Malware payload (Heodo)", "value": "d7da0dac71a19aaa0ae7e2353b2409c26debb02995facf49488fbd85899e3d3b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841981, "uuid": "bcf720df-cbd5-4852-bfaa-c49daa238cb8", "comment": "Malware payload (Heodo)", "value": "4e2132c11e5c82334000eb3cc9faf684152c6e3f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841981, "uuid": "a00466b6-59ac-4820-bbee-db1a2a1bac37", "comment": "Malware payload (Heodo)", "value": "fe6ae62f62faf0fd1b89f310be21156ec1ceed0b7bc9205ed3fae0da7b4561a2122b45d2a783b3c8a99b36d3ae0502de", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841981, "uuid": "e0a13f52-f505-4367-9e25-467dec012a08", "value": "T18A94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841981, "uuid": "9e9277eb-c181-4d55-b4c6-fba902fbca6e", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841981, "uuid": "d096e01d-8caa-4e8f-97ea-b3201deba14c", "value": "12288:M3hV6Pw4aT23s2okd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Xi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841981, "uuid": "7aba0c3c-379f-4753-8d48-f6b7cb5bc564", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841981, "uuid": "5c37d0a0-72fd-435b-921a-aa08f8af3a37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841981, "uuid": "b100b9be-8272-41a3-9777-fc49a6aeca15", "value": "9e1471e25e73716c107c07ae13b4a55f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe0bf1f-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908977, "uuid": "69c4da5e-4390-4924-9c57-e7f69ceadd10", "comment": "Malware payload", "value": "c602866a8f6ff6807a84d360ace5324e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908977, "uuid": "b05a2a32-a370-4099-a118-066ae71e3e7b", "comment": "Malware payload", "value": "d8589deddf98ef063a241bc150e5975694e64f0622c17ed873128a44c020fcb5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908977, "uuid": "283d5ad6-2c72-4676-95ee-8b4fb65135bd", "comment": "Malware payload", "value": "6aba28818a12d060973c23d3d9b5a6d4f3c843e5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908977, "uuid": "217c0f1d-90ea-40bd-a862-20878970e073", "comment": "Malware payload", "value": "f0e6bcef40ec61ab1e017bfa5263aa98ce753a900baca255c25b359565ad97c8be126775771a4c2660e795c46c6b5558", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908977, "uuid": "f3c197e1-5003-47b4-925d-ffea3fb7a4cf", "value": "T113A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908977, "uuid": "36ffcec4-714a-4962-8237-3ff9ab8dfdad", "value": "96:eRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:eRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908977, "uuid": "ec39a1e0-a086-4e43-a76a-5bbf25d643b5", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908977, "uuid": "a0dea373-7263-474c-89a0-3faa4ee11206", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908977, "uuid": "2f190f3f-51ea-4f91-b84e-25d07dad98c5", "value": "d8589deddf98ef063a241bc150e5975694e64f0622c17ed873128a44c020fcb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0f1d93-d666-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652849569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652849569, "uuid": "932cc48a-d13d-4be0-a953-87fa869cf301", "comment": "Malware payload", "value": "d2d978e89791db01bba46472b834d045", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652849569, "uuid": "6badff8b-4b4f-4f97-9c7b-89f23bb89fa6", "comment": "Malware payload", "value": "d85cf388c5cec98cb146f68b30fae49818ddf527e2d1b2d088210cead4be8e1b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652849569, "uuid": "247400b1-470a-44e1-bb05-e5431be74bfc", "comment": "Malware payload", "value": "95f95ddf5bc154ca9c884c9b3786c90f8194138c", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652849569, "uuid": "69005088-714f-4a22-8698-05d30acf4c8a", "comment": "Malware payload", "value": "6ebaa067cb20c8cccc34fbdd72c1d4ef3c72ea33785bfc1a7064a8f1a7b4906f54abf834b007630e6589aadfb83e1836", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652849569, "uuid": "d4caf3fd-3a60-4e08-a4f3-ae80558390d1", "value": "T18F34222469959B99A559605C2784CB80223C3CAC501BF7CA94013E27DB1FDB7BC8E7AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652849569, "uuid": "211fa43a-91c5-4461-b7ec-75dc0adf5c66", "value": "6144:dPstFOk4N+y0PIDxcWNd/771Uwnv/zm9fkb3hCj:dUzOk4D9xb11vyQ3ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652849569, "uuid": "9d0740e0-a333-4c78-8ead-0ab9e2ba4f0d", "value": 235547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652849569, "uuid": "3e7377a6-e36a-4bff-8283-f8761da5020d", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652849569, "uuid": "c1b9a8b9-fb38-4452-af98-6fa4feb81482", "value": "NetWire.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a71fa52-d65c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652845161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845161, "uuid": "c19aa855-fff3-4e2b-9226-f41b8c4f581e", "comment": "Malware payload (Heodo)", "value": "594f0a688ab9ba9e2a1378bc40f2141a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845161, "uuid": "858a48b9-0144-4dca-8edc-2e8201a20e24", "comment": "Malware payload (Heodo)", "value": "d8f487e19fc924dc5710af44ca5216e395e0f9a8919c858bcb18d58a4e25857d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845161, "uuid": "aba22662-cbd5-4e60-bc35-45fc6a39e02a", "comment": "Malware payload (Heodo)", "value": "af5ff0ba486eeb2600473c9f2d41e42511fb85c2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845161, "uuid": "3630834b-71ea-4f35-882c-672eb0b3a652", "comment": "Malware payload (Heodo)", "value": "e641ef04f4b3704cc3463cf99b8559fd72341c9b9bde7a2f66d6c4cd895dda57653019ff9fa45ba77a82ce16828d9594", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845161, "uuid": "32b7dc69-4579-4509-9b6e-7ec9147a1ffc", "value": "T1A894CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845161, "uuid": "61c78318-0b4d-4acb-bed6-5ad64332e5d5", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845161, "uuid": "8ff48033-6ea7-4ed9-a523-e3da1872c42a", "value": "12288:M3hV6Pw4aT23s2owd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Xi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652845161, "uuid": "76d2b21a-2893-49a5-8652-70e2a6c7d24b", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652845161, "uuid": "27080914-74e7-4606-bb0c-5fa6692f7449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845161, "uuid": "a726874a-ff0f-47dd-8e1b-ace52fad64c4", "value": "594f0a688ab9ba9e2a1378bc40f2141a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c49ebc-d6bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652887158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887158, "uuid": "e63e4e2f-d837-4df4-b9b6-6097271c618d", "comment": "Malware payload (Heodo)", "value": "7c1c7c4e8fb93b623d9c50b123213a06", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887158, "uuid": "cd25b91a-012d-42f0-a6ca-50a5eee509ce", "comment": "Malware payload (Heodo)", "value": "d96e9ed537499730942ac3cf6118433860e187b6617577d4e1d7418b90b7105c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887158, "uuid": "af86bf1c-16b6-47a9-a513-40c8cdad5622", "comment": "Malware payload (Heodo)", "value": "d80c23baacd6703944c83f355bf0a70870fce2ca", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652887158, "uuid": "e62c58d6-39ea-463e-b3a4-2ac2a908b456", "comment": "Malware payload (Heodo)", "value": "83f6d5206b94d8b770075aab458077c843fe9e2ef136edd41cfc46ca275e5c7952b3954ee803fa2309cf381f81d8e5e2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887158, "uuid": "7cde2ee6-976a-4a94-a345-0efdcc90d842", "value": "T13F54E007A2E940BBE9678278DC570B06D3B2B81257659B9F0371476A2F1B3A14D3EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887158, "uuid": "256c47f1-33bd-4dba-8563-d17f54a1ccd4", "value": "8814d1a94d80f9b49a103ad2cb419460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887158, "uuid": "66a48ead-3d1c-4767-86a6-e3d412b305ad", "value": "6144:yRjSsk3AzLPQWIgbZJpDphv4MOTRqhTAK3yUil5FCsCfHG72:ojVhTQWHblv4RqFAKiNL4tm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652887158, "uuid": "057aedcb-9103-4efe-bd1a-93df7f1fddc3", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652887158, "uuid": "dddc4295-7986-446a-b271-4876f2eec60e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652887158, "uuid": "7ee22f5b-d054-490c-b7f2-5fb1980da66e", "value": "7c1c7c4e8fb93b623d9c50b123213a06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f537889b-d6c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652888477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888477, "uuid": "faf84755-f8bd-4d2e-afc8-32f4a7c7908e", "comment": "Malware payload (Smoke Loader)", "value": "61a832c04d2bd73ef6701ca0089d8fde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888477, "uuid": "42994168-d53c-48fe-85ea-c335d28c1e77", "comment": "Malware payload (Smoke Loader)", "value": "d999ea24a63d51de747956882700b282102765b563c8b477a038e3ec17a31679", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888477, "uuid": "eadca49f-53ec-471d-84bc-5bfb838886f1", "comment": "Malware payload (Smoke Loader)", "value": "e39a65573360d7f7d7286fbc411e51b7977997d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888477, "uuid": "03459395-c04b-45ad-bc96-2c3e0e40a0f6", "comment": "Malware payload (Smoke Loader)", "value": "5977698ce91b8c7d2726623215e6f501c235258789f5302280198753fa03177a0b0716bd16d401567abb59620380c09c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888477, "uuid": "9367bfa7-c5e3-4a64-8c55-d9415632476a", "value": "T1FE64BE12F791C470E0921D305471D7B25B3BFA325670A50BF790AB6E1EB33E09AB6B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888477, "uuid": "dfa51b41-f68f-4a55-b853-45830c030fc6", "value": "db57d5e3d04b9a257784f752aaee46da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888477, "uuid": "9684ac0e-7f27-4fda-9bef-9bc2c6cf18fa", "value": "3072:zyqm8uObqO0VIrP6LZ/n2Vb/OOjNV3lsxkgaBChUpZa9uD6Vdyhk:uZgqO0VIryR2VbGc6iga3wVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652888477, "uuid": "41af52d1-026b-4917-9e97-18d82bf5f84a", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652888477, "uuid": "e3729645-fbc3-4d8b-afe3-2627f64705e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888477, "uuid": "969a85fd-e0c7-4278-99da-c9f725437fbb", "value": "SecuriteInfo.com.Trojan.Siggen17.52642.32412.19127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b5a1b3-d6b0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652881464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881464, "uuid": "aba37aa5-8b2d-4f94-a79e-7b1ff40b3d93", "comment": "Malware payload (AgentTesla)", "value": "a334f4371987c64cc5110ec5468a5a05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881464, "uuid": "f7469992-3129-4354-87c1-18380baac5b1", "comment": "Malware payload (AgentTesla)", "value": "d9c638afabe803afbe1949b402858ce3875395791a524cb56ae0e8369645424c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881464, "uuid": "243475a6-e490-4916-afe3-41b7943c44a1", "comment": "Malware payload (AgentTesla)", "value": "47cad43d59e483bfdb70f11d24594603a2054836", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881464, "uuid": "0f4c3e11-fe72-447e-9ff1-76b282ad1fdf", "comment": "Malware payload (AgentTesla)", "value": "7bec43ab4213d93984ffd115aa29ee2daecf4de38b9f43f7a1294e431d82788fa7322ae0bc58f0a5e6104d406fbe5058", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881464, "uuid": "1140afb8-a621-45fc-8d75-1d76cb3ec3b7", "value": "T17F15C7AC321075DFE86BD67AD9681C68EAD0746B831B4103A02792ED9E4C9B7DF140F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881464, "uuid": "73a5053c-f1df-4e77-bb01-ef4fc7ed0866", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881464, "uuid": "4ce1012f-5ad9-4c64-83eb-64b72a7c31a3", "value": "12288:CgsWmWHo93wDEK1D2+XatsprvzbXrGD8CPp/Bw9yPYlB/q6vnOsN7PdS3zYgxPES:CgsWmWj7DP4spvzbX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652881464, "uuid": "9aa7e427-593b-493a-bee5-b12e4489f964", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652881464, "uuid": "a12ef8f6-c61a-4064-8e3f-41a7d3e82442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881464, "uuid": "177f7d91-34a0-4fc6-bc76-c639f1141d8c", "value": "PO38876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40dd5a8-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909091, "uuid": "91b5795c-174b-485a-aa9a-28c943a3016d", "comment": "Malware payload", "value": "d7e33edec97e8bc2afdc560b2a528d62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909091, "uuid": "146705fc-55d2-4e33-93cc-d3ca6b53e163", "comment": "Malware payload", "value": "da9a51bcf05b047eeee9b6572babb86a7105743b49f3ae973c92fc71ee9170be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909091, "uuid": "43e26b61-2478-41cf-b81a-a1ec5ee8cdf2", "comment": "Malware payload", "value": "a8abbe6b6a68980d37c29fe29c15546d0376a030", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909091, "uuid": "29678c86-4c61-4336-9eb4-29bb41135601", "comment": "Malware payload", "value": "afbd19984a5a374056ef6857fb4ebf56236b96dc2ff659e4c12e8914606f401719dbe27cca09c7880715c4e20b7d5114", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909091, "uuid": "7944a843-a63c-434f-a31c-5cac64c589a3", "value": "T11741F0CA1F325EF9F55AD93847370B3937AA520847D14289E19CEA006EC030E89DE7D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909091, "uuid": "6c5870c6-ac8c-4918-9252-583a796148c5", "value": "24:3+Ydb5jl8AmslI3t8AmypR/z2HdllPMqtWB4u3GMI8paeudz3N9l5zBkEp7iBAGV:OG5E4GYg2H761eHeu/9LuEpgn38vmBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909091, "uuid": "01c2e187-50fa-4d30-92f9-66777ba6e32d", "value": 1983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909091, "uuid": "7789d0ae-27d1-436b-8e5a-fb4f8056d887", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909091, "uuid": "61d42dbe-bd97-4af0-991b-0b274ac42ef9", "value": "da9a51bcf05b047eeee9b6572babb86a7105743b49f3ae973c92fc71ee9170be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22314a9-d67e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652860018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860018, "uuid": "22562fcf-264c-474f-83b8-0bab6d342b4d", "comment": "Malware payload", "value": "68648ffb5d8b7dccddc334e609fc39a2", "object_relation": "md5", "Tag": [ { "name": "93V0MF", "colour": "#CA8A8E", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860018, "uuid": "cb30da57-f17a-4806-a51a-3899efb79d03", "comment": "Malware payload", "value": "da9abd0dd8da13b96d51ff0612460e355863642bd5c953fe7aefece2bdc23b08", "object_relation": "sha256", "Tag": [ { "name": "93V0MF", "colour": "#CA8A8E", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860018, "uuid": "2bd71548-7318-487c-b6d8-05dabcfa126a", "comment": "Malware payload", "value": "0b2e2402bdffa5a4932e0e1e602561549a285b27", "object_relation": "sha1", "Tag": [ { "name": "93V0MF", "colour": "#CA8A8E", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652860018, "uuid": "3cbf2bf5-50b1-4669-af6a-1d246f02276d", "comment": "Malware payload", "value": "ce527e33d880c2d8616607943d0919a397c939c567991c201c747d3eccb08a516ff37fd84309def816e1ed2ab0497186", "object_relation": "sha3-384", "Tag": [ { "name": "93V0MF", "colour": "#CA8A8E", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860018, "uuid": "10fe5600-6a61-49cb-ae6a-442f74d949dd", "value": "T150311CA4C49CFD18C456E03442EF17531E68F1302FD7899F9117B923A1260780D88FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860018, "uuid": "f262919e-504b-4779-a130-e97c95c5e108", "value": "24:D5g+W9iw9hGzsIwulZdojjZIhGVZysi98sHHqDi8Yd9VXuHqGTJFQ5A/2TE+MHyX:dg+WsWv2SjjBVZyv9HHmi8Y7VXs1Tv/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652860018, "uuid": "c0db0abb-0ee5-424e-8073-c061b96609de", "value": 1490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652860018, "uuid": "719532f9-9e2d-4606-b9f8-3418e535e9d9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652860018, "uuid": "e3345dc9-5015-4c67-9db8-d09745ed0f76", "value": "Omtrans.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4367da-d681-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652861240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861240, "uuid": "d36134bd-d3ee-4874-bb53-d7693529b9f9", "comment": "Malware payload (Loki)", "value": "0ee2a81aae42ac9b413f02979c6ce6f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861240, "uuid": "76861195-a944-40d0-af21-41c6965e38e9", "comment": "Malware payload (Loki)", "value": "dae867c4b385b3ac246fa3daa68654af32d8bb89af7eb5b7164480fd3b40ccfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861240, "uuid": "12e4209c-4a2d-4df9-a775-fa870e5a058d", "comment": "Malware payload (Loki)", "value": "b6401db71005cb333c8be6a3b10e4db9800be989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861240, "uuid": "21be53e7-acd1-4d9e-9bc2-f2122d5aa5e0", "comment": "Malware payload (Loki)", "value": "083bebe320faad01fd4b223821591959ec21974e0c7d8981bf0294f6295151332daa099edb64b720e251d0d0ceead830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861240, "uuid": "c16ce855-34c7-4286-9828-3f438ab80a05", "value": "T1F2746B10BB50D036E1B712F7497A8269752ABFB95F2451CB72D47AEE96346E0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861240, "uuid": "ffd45f4d-4553-41b7-a8d9-2d1778b053d8", "value": "1f8c4cf685a1da89700dff1891ed4f70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861240, "uuid": "f82c4a8f-b46e-40bd-ac53-3d260ace4a32", "value": "6144:WWIaU2PEnXv/V0XS7/llyWFaokehxhmZQ2WiN+X0Ok9/Io:WW54/90C7/llzMehLmei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652861240, "uuid": "18852bee-fdf9-464a-9a9b-cd058150e147", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652861240, "uuid": "37a4ab52-6e9d-42a5-a1bc-6a17a4032353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861240, "uuid": "20de9abd-603e-49d9-a1ce-866771d635ac", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef36860-d6d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652896037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896037, "uuid": "f9db53ff-a2ef-4a62-99c5-7bd00d397bff", "comment": "Malware payload (AgentTesla)", "value": "e6b4cf9792d38b8f6df7713c06fcdd71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896037, "uuid": "ac4a86d6-f31e-4327-b263-5ce6fb4908d5", "comment": "Malware payload (AgentTesla)", "value": "daefba65d01929fbdcdb7f5098fb2ad8a3fcf87afcde3f24fd138391ebcf27d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896037, "uuid": "c21c4698-e66d-4f78-a814-3c68c8a15950", "comment": "Malware payload (AgentTesla)", "value": "e1f833e21747bae2c3e6e5235e212d7338d6c075", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896037, "uuid": "c900a780-6eec-4c02-aacc-9fdc7fd833c4", "comment": "Malware payload (AgentTesla)", "value": "a470b6b09ad9cff2657211928527872c4e1852e4a937f95d851315008a7b13443927a8fd85b892bb2a26140cdc43a240", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896037, "uuid": "0cfc9732-c4b2-4d17-be2d-61b382b40e1e", "value": "T17E35591E7EB48144C35878F6DEC207B0D2B19D8E87A18B065EBF39993472183DCE665E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896037, "uuid": "dd429c82-4124-41fd-b777-0b08ec485bee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896037, "uuid": "3c5560bd-0bda-4b55-9465-47fede9ffcc4", "value": "24576:zxuJHNbXeGL5+KSepzvNe3jxsGQ8LwOQVMSo:zxmH3eC8rVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896037, "uuid": "11f18a00-6d4b-458b-982f-44aaf40d70d4", "value": 1140736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896037, "uuid": "5cacc84a-4f2f-4f04-94b5-c33a0f66a616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896037, "uuid": "144fb549-15f9-4fb1-8922-4a1dadf2595f", "value": "SecuriteInfo.com.Variant.Tedy.119043.15360.12887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bacdaf4e-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908995, "uuid": "a25afe86-7312-4f07-bc4d-7801eab9fc97", "comment": "Malware payload", "value": "33386c8dcbad5e8908de4426c26cbdf8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908995, "uuid": "8540c20f-2e91-4ddc-bbd8-5ea680694555", "comment": "Malware payload", "value": "db0875582d8a7855264f6eaffb020263572804f14269be25863c1eee9613a859", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908995, "uuid": "a01adacc-142e-4b96-a170-8994d6cc682a", "comment": "Malware payload", "value": "7a9c68ff0754390e807f9a51546ecf5c6a9f73ca", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908995, "uuid": "f082dd0a-5c25-42c6-8616-fdab41e338c6", "comment": "Malware payload", "value": "3c1f63f48f90c51a5470528b82e63878d2b3058607e3ffb7c1c07f9d108a5e164957ff49fab6bfd9c04ce959bdc76a5c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908995, "uuid": "13a3eb92-5121-457f-abaa-25a90e17dff3", "value": "T1E431A0D235B1293C3DF724A3B3750810B18160242C941DC9F6DDB6B4AEEEE8171846EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908995, "uuid": "a16dd20c-ec26-4cf4-b51e-1ca327b17f2e", "value": "24:IjodEod0kANiiVZ0fiHeBisp6iBArJaNu:2oiVZ06HeAsptBAou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908995, "uuid": "f61cc20c-d8d1-4b4a-be14-30926a009376", "value": 1840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908995, "uuid": "631bed41-6ea7-4a20-a20f-8769775a1731", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908995, "uuid": "540d2c53-bf99-4403-bf6a-771af13821c9", "value": "db0875582d8a7855264f6eaffb020263572804f14269be25863c1eee9613a859", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34af46ed-d64f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652839621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652839621, "uuid": "5e42c43f-ab68-40e7-be19-de1b005bbe5a", "comment": "Malware payload (Loki)", "value": "a0033191a7a309317e1b4abc255a1b52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652839621, "uuid": "df4114b5-a93c-4f64-854b-04ee65085796", "comment": "Malware payload (Loki)", "value": "db33ad49ea94e38b3cda7b48cca06a29701052bbf784c9fff3d6300d7bf6fc81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652839621, "uuid": "08960d98-1ea1-4348-b69f-10ce43c7e782", "comment": "Malware payload (Loki)", "value": "02273978ab8de3cd26dd07ad24c95d83c85f26ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652839621, "uuid": "f2836610-494f-4bc9-b718-20738653f9cf", "comment": "Malware payload (Loki)", "value": "fdf7fb1c8a700610b7b60c3499008f1151437d065a1c32b8cc1da0fb9851460037f945c3811ab2c84f5966d27cb245fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652839621, "uuid": "6bc3b99a-d519-4e66-ae7c-88f18374f5f7", "value": "T1F0C3F1181BB1C473D4620F302C7B1AB66EFEEA2120B85B1F17105FAD7D261929E1E767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652839621, "uuid": "7fb8c679-59ab-4709-9f7f-1aede9903e1f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652839621, "uuid": "143eb6ec-7332-4942-8ebc-319143aec705", "value": "3072:VfY/TU9fE9PEtunbERdUHwAcaGGe5IwiOXWhvymcBpA9h:ZYa6VERdGwWGviuWaAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652839621, "uuid": "1a927863-8fb2-4bb2-a7b7-21a9dfcb2f70", "value": 126534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652839621, "uuid": "99fffc04-a020-4957-907d-ea089a33fc4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652839621, "uuid": "df89f548-fb76-48e7-b0ff-7a1a61bb4fa1", "value": "RFQ 00078569_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8224d1-d65c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652845221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845221, "uuid": "8ce20178-5756-424f-978c-8ab4d3b01a2a", "comment": "Malware payload (Heodo)", "value": "6b675c5c0844cffa7de86442175faaed", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845221, "uuid": "ef77c716-373e-4cba-927f-20b1990b8705", "comment": "Malware payload (Heodo)", "value": "dbbe0452bc471de499c624ebec355268037ff8fe61122e63d8939d90c5ef9f16", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845221, "uuid": "87d3a077-9e1a-4b53-b749-e9838363e6ed", "comment": "Malware payload (Heodo)", "value": "32737ee80c2ca4dc93b887c83e0ecb7c248de165", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845221, "uuid": "1607f5c4-2b12-40dc-bf1f-531323c5f239", "comment": "Malware payload (Heodo)", "value": "8e042386230d1b9cd3bb69d718425a8138a3c39013e4263f321130b722244ba134abdacffbc8e90bc4ba94ab4d438b04", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845221, "uuid": "36b5d7bd-8b40-4c66-b475-c3df987f15e5", "value": "T127A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845221, "uuid": "4cf3f9d6-0b0b-4602-9c8e-cb2a602a4067", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845221, "uuid": "09608d96-7233-4283-a55f-04e119c1e884", "value": "12288:uS4BnAed8BK2o0awa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKza34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652845221, "uuid": "864118bd-149c-4b0f-8303-59e113fb700e", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652845221, "uuid": "067078ff-dbae-4757-8979-e85201e9b269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845221, "uuid": "81d5e50b-928d-4324-93d7-b64a531641f8", "value": "6b675c5c0844cffa7de86442175faaed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e238a15b-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909061, "uuid": "b7a4c0d4-b8f7-4cfb-8eec-b280104a6bf0", "comment": "Malware payload", "value": "ecf2bd6bcbadc48487970af7e0d9a86a", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909061, "uuid": "73b1ecec-2030-47e0-91a6-9a0eb98e1042", "comment": "Malware payload", "value": "dbc7021d2528d24797464f552733aaada5d9167b237b686e3c3d4b7b604228a9", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909061, "uuid": "bcc2b0e3-8713-47ef-8edd-13164c66aee7", "comment": "Malware payload", "value": "9e7f6ab42eb758f37fbaab89ecef809784ec8052", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909061, "uuid": "ac2aa2f7-f9b9-449b-b6a2-e356f42845d4", "comment": "Malware payload", "value": "06f3b85ea82dfb0a3335c24e528bfc06feefbc19f9452bbf57c01b339e73d04b3bf461d1f4f064bc3834fb7fe7e8e154", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909061, "uuid": "aa2629c9-9ecc-4355-b32c-e55cba855b7e", "value": "T1BAF533109AD112C9F598CD2E1B9C7526053FEFDE24B4EEE385928BF4040FF85DA72169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909061, "uuid": "db4b6a66-a7be-4196-8d64-74655d09b52a", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvqE9H:G1wwAjzIQOMK2GNKslgus10Y1/UJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909061, "uuid": "e79bae10-b28e-44ed-aedd-1922b9378d1c", "value": 3514368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909061, "uuid": "0ecb552f-f90d-4464-9df3-31dabfc394aa", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909061, "uuid": "8e3a23d1-7005-44f6-89fc-aee867175661", "value": "dbc7021d2528d24797464f552733aaada5d9167b237b686e3c3d4b7b604228a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef0b2b9-d6ef-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908653, "uuid": "3cc26e5c-919f-4bb3-a63e-f464d5929c2d", "comment": "Malware payload", "value": "0f2d2e51d08946e437e209ec6f0e1020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908653, "uuid": "896a1805-bce0-4473-a5b4-02f59c7292c3", "comment": "Malware payload", "value": "dc13a6eccec9aa90bf84d6430cbb5c46731800fed950dbf85decad958695b106", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908653, "uuid": "91ea007f-8286-4ca4-83d1-f4bd2bcc24cb", "comment": "Malware payload", "value": "1e58902ecc64ef53885aeba4cf11834d75e09cb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908653, "uuid": "79737017-ee97-4c0a-a944-7b9f207112a1", "comment": "Malware payload", "value": "e59284adf2f0521d960606bc90bbaad4c1b91c6a7e605d9fa8c8b02d03e2755ebeb787b01467e08ffa108266a077152a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908653, "uuid": "f60d2979-37c5-4a50-b72c-a6e547ebc3b1", "value": "T1A005273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908653, "uuid": "a0a21c21-3fb1-419a-afec-9cc5e98e6540", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908653, "uuid": "78d74617-d376-439a-9cd3-21546000db54", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7o9aIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy79Ust", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908653, "uuid": "c2bcac64-e09c-4b48-90dc-af500bd285d0", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908653, "uuid": "384ff6dc-69b1-47e8-b749-5a3fe1757cdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908653, "uuid": "bcd27ac5-76bc-412d-8678-cebce01cf589", "value": "0f2d2e51d08946e437e209ec6f0e1020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039a30a7-d690-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652867456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867456, "uuid": "21d5ed4b-54c4-4d1e-a152-afeabe75ee4b", "comment": "Malware payload (Heodo)", "value": "6f371e7f163f02d64a4a4f291ebd4f9d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867456, "uuid": "a0ff3911-fc52-4a3d-b9b9-6764e7f99f14", "comment": "Malware payload (Heodo)", "value": "dcca5a1c04a8788b7d856003a6fd67ff53e0e619df4c9b758490c91b38d228bb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867456, "uuid": "175283b1-a9f7-4b9b-b900-d7451b8c2db1", "comment": "Malware payload (Heodo)", "value": "b71d2250e0a8c25594688ec3ba5db1a927166451", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652867456, "uuid": "28684b1c-7a62-446e-9b91-a306ca4bfb13", "comment": "Malware payload (Heodo)", "value": "2cc09b780443b02f3c143e3225c519b2e736c906a4bd8fd9e3827c24ef70c5d66b86a7fc6d6a5dbbf2c5add1677c7567", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867456, "uuid": "ade6203e-2431-4373-9c51-e3b005e76ecd", "value": "T1CD94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867456, "uuid": "43751c82-6b6e-45fc-b6cb-1c280585e1e8", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867456, "uuid": "9d506236-6113-4620-ac6a-e9b389a4620c", "value": "12288:M3hV6Pw4aT23s2oVd9zi3BBoNIQ/hsA7:Yb6Pw4R3s28i3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652867456, "uuid": "222b318f-67ca-4dcc-b158-ac9b23b5da13", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652867456, "uuid": "035ee493-dd52-4c98-9523-b3cce0ab21ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652867456, "uuid": "9eb2d675-e955-483e-9fad-b15c3820a6ec", "value": "6f371e7f163f02d64a4a4f291ebd4f9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e19408-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908928, "uuid": "057504fe-6e41-4968-939b-b4b5f2768e07", "comment": "Malware payload", "value": "4f67b6da38f3892aee4059dadc9a636c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908928, "uuid": "3f215766-4f17-439a-a16e-e5327d9b5a36", "comment": "Malware payload", "value": "dcdf6497668e07ad5446dc63be8b3ebf67eea0d66a9dc392a424c61d258c2979", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908928, "uuid": "00e2ab3b-9081-4063-9660-7f8c84475f7f", "comment": "Malware payload", "value": "fa578acdbced6f801c67e4e27c441fe3f519ed4e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908928, "uuid": "77515ca5-ecd7-4653-b1b7-b1197e0c260b", "comment": "Malware payload", "value": "6a23c3b1e2841138ed58c4ff4237fbec144a16b286daef592fa288d545e4871744a73cf3295be1e89532675e6884172c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908928, "uuid": "2cc0e322-572f-4075-ada2-65a9a95eab00", "value": "T170411ECE21A2087DAD91A963737D984071D8E0DA30C57F9699FC34F8808FF367484A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908928, "uuid": "50ff7bae-ffdd-4a48-972e-0b76d444f566", "value": "48:vequTCuQ36CMJb9eHBb+v8YLb/wJdJbA4ge3:vequTCuQ36CWb9eHBb+v8YLb/wJrbA4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908928, "uuid": "14fd8a54-d5bb-4ae6-acba-aeea39c6e3b6", "value": 1910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908928, "uuid": "1b96b174-d939-49bb-a7ad-32383e7f7422", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908928, "uuid": "088ec000-f20d-43c3-b04e-6c0fc1853fa5", "value": "dcdf6497668e07ad5446dc63be8b3ebf67eea0d66a9dc392a424c61d258c2979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b93b71-d65a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652844435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844435, "uuid": "8dd22698-5584-455b-87d3-ab77019423eb", "comment": "Malware payload (Heodo)", "value": "4844b5fafc8a2f7ba9af637ab998a247", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844435, "uuid": "fe56044b-07b7-400c-82d4-1fbf7eba2be2", "comment": "Malware payload (Heodo)", "value": "dce0675f060b96a0c173b2eb7da50b0ee64e6b559433d10084afa58d4f157674", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844435, "uuid": "edea22ab-25c0-4ab8-bab6-60ea405a1479", "comment": "Malware payload (Heodo)", "value": "d9ef77caac183b9fdca6ad9f3b83ee5d14e9f3b5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844435, "uuid": "24eb6441-e1a4-4d9f-9d54-e89281cc75fe", "comment": "Malware payload (Heodo)", "value": "faec6bb93f89c0e024cf68a16ab9430c1004f0bcb8b8a69780c5cedb7bd79e33bb1a1bc7b3f7dcefabe1e56b8c70039d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844435, "uuid": "f1708fbf-49f0-42d6-a8b6-e2e9a3064724", "value": "T10094CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844435, "uuid": "dca9b955-bcb6-4192-bf74-d0259321cb94", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844435, "uuid": "88268509-af1c-4591-8de4-41a66dda0847", "value": "12288:M3hV6Pw4aT23s2ofd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Gi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652844435, "uuid": "355340eb-39b0-4fa0-ae60-bf25cd90e592", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652844435, "uuid": "33d98f11-9ea3-42be-990a-6920af8d5b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844435, "uuid": "accbec2d-fb08-4841-8fad-a21bf02ba360", "value": "4844b5fafc8a2f7ba9af637ab998a247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c8a35b-d6e8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652905312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905312, "uuid": "5a2fe8cf-6513-47a1-a3ae-623fe3c8b58a", "comment": "Malware payload", "value": "a1c4944a172a90b8d789b13ce8000e04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905312, "uuid": "b62aa981-a036-4244-a1c4-75355a2aaf5a", "comment": "Malware payload", "value": "dd631a7861bb3fef8ae5237ce81c5dbdc08bce8e3c88a69e5af8da41a48552d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905312, "uuid": "ab638b67-dbfc-4bc6-945a-b2ca11aadb24", "comment": "Malware payload", "value": "603b7012b4040be3d7d7027438a96019be707619", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652905312, "uuid": "af390afb-3008-4961-bf43-2de4185dd1dd", "comment": "Malware payload", "value": "526f7c89dae44820dbe1c9d66d5b192eaf238d5a3fb6de492e5b973670c455f77f75a33a377969842e8fdeaac2627d16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905312, "uuid": "503af90d-844b-4bc8-b063-884512c2ca71", "value": "T11405283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905312, "uuid": "032ca530-2c3e-45d0-a516-77469462ee03", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905312, "uuid": "5f41f851-e3b4-4ddd-93a0-16e3d07f2aee", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7impE3:BTg9UXRD2SeqfZZimm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652905312, "uuid": "3759459a-7207-44eb-af7a-887ae8c3ace1", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652905312, "uuid": "12d83426-07ef-499f-b177-db0efb5aa2c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652905312, "uuid": "d80f132b-b74a-4311-913a-4596976006dd", "value": "a1c4944a172a90b8d789b13ce8000e04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8d36c7-d654-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841894, "uuid": "9d67540c-090b-43dc-abd3-a40753beaa90", "comment": "Malware payload (Heodo)", "value": "040f22b6dd6663796f6443f28e1588c5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841894, "uuid": "f598b4c4-2e1a-4cd4-bdd0-3972b822402b", "comment": "Malware payload (Heodo)", "value": "ddbeb35c44f1449b90f4150285d746f03cffd5ef674fef3973e6fa9271c676cd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841894, "uuid": "185bb91a-36c0-410d-96cb-1c07b9cc0cf6", "comment": "Malware payload (Heodo)", "value": "e5e24317fb3c1de99157851f133d98f974666cc4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841894, "uuid": "14c62e5b-0546-48f8-a68c-0a56e4f391e4", "comment": "Malware payload (Heodo)", "value": "4ccbfbd5438f40c25901a909a346ff5e7c1542dc10bd52259f4a424f90ab68ce9730336040d91085fcbc31d95b2a399f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841894, "uuid": "aa57c4f4-fe0a-40dd-b86c-c14dce800a18", "value": "T106A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841894, "uuid": "bc3c8dc3-a316-4d09-8809-a7149fc1261c", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841894, "uuid": "7af1fe90-4d58-4faa-8865-9edb2d004fc0", "value": "12288:uS4BnAed8BK2o0aIa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKna34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841894, "uuid": "c6b35791-e115-4bad-8789-abbe9fc72fa0", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841894, "uuid": "ae95cab9-8f87-475c-9dbf-c00d725b1de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841894, "uuid": "90e01198-3267-46ec-b796-eb882d1a0cd6", "value": "040f22b6dd6663796f6443f28e1588c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94d479c-d6ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652892672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892672, "uuid": "326f1d1a-086a-4e79-a43f-6320f7909d80", "comment": "Malware payload (Mirai)", "value": "7328dafba50d4a3039e1f919cdb8fc67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892672, "uuid": "f8864a5f-8f2e-4dec-922f-c3f54f3d3787", "comment": "Malware payload (Mirai)", "value": "ddc08e9f18d092d85f2e3ea0a366a8dbd58e13ed19e43d026703c59446c3910a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892672, "uuid": "000a5826-be78-4038-8698-96cba06e95d5", "comment": "Malware payload (Mirai)", "value": "002b413ee72b1576110facc463829f9a849aaeb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892672, "uuid": "5fca6197-1d94-4c7d-bd41-591e9bb1215c", "comment": "Malware payload (Mirai)", "value": "5e2569eb1e9c4ae0bdf87b30a4a66f71627df9782655c609282397411a65e10ae5a5caf9b25f914768cac84eef4c6223", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892672, "uuid": "d0f42256-a900-4acd-9843-4bad159ac570", "value": "T180735C34A97E2F26C0C4A17E52F78750B2E5220F29B4965D7CB20F4FFF24544A8562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892672, "uuid": "df579cd1-2b23-4fc8-ba38-c890107f19b1", "value": "1536:vsnCSemCLLWeKNJ+1kbOSYcpC636v/bcYSZJFFi:rS1+SYccv/gp7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652892672, "uuid": "89783f44-920c-4e33-b119-0efa5311b4e9", "value": 75388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652892672, "uuid": "3675390a-5623-4447-a468-7dcf9dd93b40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892672, "uuid": "ab37c2e7-e9db-4d6a-87d0-c2482cefc25e", "value": "7328dafba50d4a3039e1f919cdb8fc67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028c0506-d656-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652842543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842543, "uuid": "963965ec-a07f-4707-94f5-a05117510bc9", "comment": "Malware payload (Heodo)", "value": "0cbd680d8782a4ebe6a650e62ac6ad14", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842543, "uuid": "5bad08b7-9bd9-4d25-affe-86dc87ef1a1d", "comment": "Malware payload (Heodo)", "value": "ddca714220571918fcff73b8252ab683085791d3328dd07a3e505725585106a8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842543, "uuid": "35b58f65-5891-40c2-8187-69283b8ee1fa", "comment": "Malware payload (Heodo)", "value": "43e2ddcc760f06442a33909306a0412dc32fbfdb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652842543, "uuid": "eebb1eaa-890d-4de1-927b-f5428c68eba6", "comment": "Malware payload (Heodo)", "value": "4892f388c623705cd2b4db2b7f092547d3be9e0cd9b41aa4e7a43d7a4939d6fc683ad3d2d0df0b47d33d1c42730d8948", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842543, "uuid": "dfe753d7-de95-442f-a1e7-96b42fbb42b5", "value": "T1CAA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842543, "uuid": "9fe82eb5-0907-469e-a5b0-e7ad7eca0a1c", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842543, "uuid": "597c7137-df9f-4440-b0ff-173639ea1929", "value": "12288:uS4BnAed8BK2o0ara5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKma34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652842543, "uuid": "8a86479e-b336-4bbc-b335-6bc17f5ae456", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652842543, "uuid": "33e782cf-a596-49e4-8a60-c15e0fa15499", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652842543, "uuid": "86b80bb0-25f2-492e-934a-3fd2e4aa36b4", "value": "0cbd680d8782a4ebe6a650e62ac6ad14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76f88b9-d67c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652859195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859195, "uuid": "f25db0c5-ece5-4174-af2c-2148bf113df2", "comment": "Malware payload", "value": "691a5af1f4de0847005160f0f5d07841", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859195, "uuid": "81a2d997-2e39-46eb-9314-3c581b04eea8", "comment": "Malware payload", "value": "de85e7754cdb6c18d93f074d58406b4b4e91466cb53e82f962535452ebc2b9d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859195, "uuid": "9aeb91c5-a255-4d3e-9108-ec9c343e9873", "comment": "Malware payload", "value": "ef977fc4defc514063d4159d7be18a771065104b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652859195, "uuid": "8309b845-e58c-492c-87f5-8e113224daee", "comment": "Malware payload", "value": "060c83780c08c58344c5a2faf427854839d02f0580128504191fd429bebf89a9c3c12f8c0e0d45579890848706379f15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652859195, "uuid": "4ac12e42-cb5d-4696-92a6-b3731d740d28", "value": "T1BC663313FDC684B3D956153407269A041ABDBE342F29C3AFB7A8AC69CC742E07517BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652859195, "uuid": "33489884-33a6-4eb9-9a81-0ec713bab559", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652859195, "uuid": "ffb4bf12-aa27-4192-9efc-56846814fd09", "value": "98304:qRcD4YBOcmIM1JrbKQxtrjlCdS5JIy3OdRgU/D01RnU+0tbHae4EofvwL36aowyz:ju79lCdEeXWCg1A1HazdXsym6WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652859195, "uuid": "9a010f39-7d0f-4e2d-ae0f-c59b90a2f2ee", "value": 7073836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652859195, "uuid": "cdf4d64e-69b5-4e63-96e6-45ac889b27cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652859195, "uuid": "7f66cc45-c38e-484c-a9b4-41a0e653c8e6", "value": "691a5af1f4de0847005160f0f5d07841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0244c7d0-d64a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652837389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837389, "uuid": "b4413584-8f3c-475b-a74f-4f59bc1b31bc", "comment": "Malware payload (Heodo)", "value": "8dda018bdd79111a8bbac47674ada5fc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837389, "uuid": "490fb883-8806-4f0f-92ce-1c2098e4abf4", "comment": "Malware payload (Heodo)", "value": "df2ef58bd43141b9199810b15847a73dc6a7358ecff16d025a4986c4e1f02c06", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837389, "uuid": "04e74f46-c80d-4070-a77d-d7d467960403", "comment": "Malware payload (Heodo)", "value": "6d888b7594bfd9255191ae8fd0f3e5dc7a3ed248", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652837389, "uuid": "24cd0de3-3570-4c4f-a109-e3071d7ce097", "comment": "Malware payload (Heodo)", "value": "38a0a5f63e041e6986a35c97430d2c254cb61d07d16842dfffecde339fc2b7bcfb74d978a34546db8471610e3ac2f704", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837389, "uuid": "2a9d0320-0638-4aeb-8c0e-bfc53516a670", "value": "T1E094CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837389, "uuid": "21f87ccb-f66a-49d9-b8b1-2da99806fbec", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837389, "uuid": "c1efc843-0acb-4c41-ba9d-fd82f67ecb01", "value": "12288:M3hV6Pw4aT23s2oSd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2pi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652837389, "uuid": "bd895d40-1bc3-4869-9ab4-fbf29b74feff", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652837389, "uuid": "24e7f0ab-c680-467b-bf5c-09cfa0b16a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652837389, "uuid": "9fd5ca68-2cb6-475c-9b48-e1453570cdc6", "value": "8dda018bdd79111a8bbac47674ada5fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cec2f1-d65c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652845205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845205, "uuid": "6ac00919-4a05-4cac-8cd0-ff734d365c1b", "comment": "Malware payload (Heodo)", "value": "1b0b1abfd2340040a48979327233d834", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845205, "uuid": "08868bf0-ae70-49cf-a8b5-37e18f381706", "comment": "Malware payload (Heodo)", "value": "df52b617c7864ce06e6627f09c2b141429961e8a6b01722252d7f461be08bddb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845205, "uuid": "84310e05-347a-41ca-8e0f-ccb1a4b0dac1", "comment": "Malware payload (Heodo)", "value": "40a0bb116212807afe9043c0154a0bfcb96bf993", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845205, "uuid": "4ecf2f86-19d2-46be-b0bb-c3e7432cd88a", "comment": "Malware payload (Heodo)", "value": "bb019421c443ad98e0a88d7af8baee610ed9e344cc63fab39deec245fca3185d8e598c6f2f1497671d6efc59f2be1b1d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845205, "uuid": "38ecec02-c201-4041-8a5a-7efee801d37c", "value": "T10A94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845205, "uuid": "b7bb37c5-0ad7-4597-8f2b-e8c89c450e3d", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845205, "uuid": "3507cb83-47fc-4b3f-9475-3194e5150cd1", "value": "12288:M3hV6Pw4aT23s2oyd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Zi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652845205, "uuid": "1a043f64-55c3-418f-b78e-928cc8075330", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652845205, "uuid": "312c1967-6acc-468b-86a9-94a51daeebac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845205, "uuid": "4d920308-aa82-4557-b3bf-d09b53ce07b1", "value": "1b0b1abfd2340040a48979327233d834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994d6c04-d685-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652862983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652862983, "uuid": "8a90057d-92f1-4b49-a25a-bb924fd266bd", "comment": "Malware payload (AgentTesla)", "value": "a0c5151cf7d8d1d7f762f2cc1ea5eebf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMPACET", "colour": "#AFE4CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652862983, "uuid": "69e32bd9-48dd-4245-8178-5779beddbe39", "comment": "Malware payload (AgentTesla)", "value": "dfbb929580b91504cf8e1f739f746f9660aa166cca5cfbacb4c9a9f3f0989bd7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMPACET", "colour": "#AFE4CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652862983, "uuid": "d9e3cb2a-80da-4005-9d2b-fc985f5c97aa", "comment": "Malware payload (AgentTesla)", "value": "e2c7b3e97beeb56a361414e7bd0de8766f9ceab6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMPACET", "colour": "#AFE4CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652862983, "uuid": "ee0f0a38-7f41-4b4d-bf2d-6f490581a2b3", "comment": "Malware payload (AgentTesla)", "value": "df5cbe8f7acd314ffc5e8eb558f1d55d426cd369f3a37e0e5ef7825f6be6b7a5cee74b717cf86693623331c82bbb5712", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMPACET", "colour": "#AFE4CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652862983, "uuid": "a50f20d4-03f7-4128-a7d1-28b23545b083", "value": "T12FF47D931BB8BD12C13D263065507C90E3F7D0CDDAB9A648286071E67FB2781BBD26B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652862983, "uuid": "42912706-f9ef-4bf2-8964-635abee8293a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652862983, "uuid": "fa63bd93-90ed-4740-ae34-73fdf6a6c772", "value": "12288:AqVZk3Gg0zmU9DZBxxdq5w3p8lP8Gb5ff3tJjM:lVZQGg0fFxEemk8bM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652862983, "uuid": "ac0959f3-05a6-4caf-a4e0-056a477ba54d", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652862983, "uuid": "1f72a428-0a28-499a-be76-4b36a24ae459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652862983, "uuid": "c5324eee-0eb1-40ab-836a-d7c11112df2a", "value": "AMPACET_1805183.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3024f3e8-d6c2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652889006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889006, "uuid": "ea3a8873-25a4-4c56-ae80-3bf9258cfcc3", "comment": "Malware payload (Mirai)", "value": "5d8e8d8324a199840de276a55c43e449", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889006, "uuid": "95a84f32-aa78-4c7f-a8bf-dceaa3c17a3f", "comment": "Malware payload (Mirai)", "value": "dfe3d447fe55e834e886c328f5a54776d31c476944351109124ce0dd27da925e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889006, "uuid": "ef0cfab1-8121-4592-8b7e-ab83b98e9fd1", "comment": "Malware payload (Mirai)", "value": "e457ae1fc02242f5a4b05cb97d68d1e6effef595", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889006, "uuid": "6e82c02a-7638-4bf1-946c-422ede612698", "comment": "Malware payload (Mirai)", "value": "bbe11f39b4b50ef5a90cf3a6bbb5a30d8cf35b0849f21b70487d5cca976b4bdd29460677d5ade938f06aa70ed620d8d5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889006, "uuid": "7ad252ce-93fe-41d0-9237-7de27024811a", "value": "T19D6319817C80AA26C7D0177BFA9F108E3314ABD8E1DB73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889006, "uuid": "2244273c-fbfb-4af1-b0bc-4ece23c1f0d9", "value": "1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V8OHxouJeZWDFI8TM:GbtexU0r8QCKw2FbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652889006, "uuid": "9075e690-8676-4326-858a-e43e3313e2a6", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652889006, "uuid": "534a7e28-411d-4b4f-8dfb-434e096cd508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889006, "uuid": "15dcc449-91ae-4a3d-987d-603bc1787642", "value": "loligang.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3aa2c1e-d677-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652857068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652857068, "uuid": "4cf6c78f-712f-483a-b3df-09c6d03ab753", "comment": "Malware payload", "value": "5c87cba4d351f3e848f384faddd5a0e6", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652857068, "uuid": "a7831cc1-78b4-4b96-86ce-dd422abf4cb5", "comment": "Malware payload", "value": "dfec57dd6d062eca98ceef918b683107293b334b2ebf03b90679d39fb6d35fd5", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652857068, "uuid": "595275ad-73da-42e3-a65c-d5ed8a6f8638", "comment": "Malware payload", "value": "bc3f10df960bf7ce33ff1174b791e01aeb3518b7", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652857068, "uuid": "5af61e57-7bfa-4bd9-9656-1cc9f828f6b8", "comment": "Malware payload", "value": "7a4fe280fae02563ebc155c7c4c1092267b4df15db07d8b6803b883b1cbb39257b0bb3938e3b1cbd00282d3d267c9864", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652857068, "uuid": "2aff5386-1be9-4f17-beff-5b38c3d1d132", "value": "T15AD4235D9D8AE142CCFAE527148A2E29C3FFBCBE207B70551C3F264A07C604D7E96529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652857068, "uuid": "6b0a96e4-7712-4c38-a982-6ca99d59a47a", "value": "12288:dvF2fYB20DTqvVjg7FjFw+4JurLdOk9QHlN84eLIizOKt3x+kqbjBxLJt4b:dvF2fYcpvVjCjKTJoBOoKeLB33x/yzLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652857068, "uuid": "aa18bbde-1011-46e8-af63-4921981cc0cc", "value": 649379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652857068, "uuid": "93ec0480-a3ca-4d5d-a1e0-cf3903a20e17", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652857068, "uuid": "6ed0d0e2-c683-4914-841c-451421a00b12", "value": "RFQ.pdf.ra.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b8b497-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909040, "uuid": "2e5d7711-dc4a-4b6b-801d-78a7dec46896", "comment": "Malware payload", "value": "65d1ea3bbe0bd6feda139035d6e1279a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909040, "uuid": "34383574-85fc-4fba-8e28-84cec984afd6", "comment": "Malware payload", "value": "e02212bdb786c4d67509ebbf97d15144d6e40e8fab2abff6e833f14cbe2396e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909040, "uuid": "c0ffcd0f-3567-4f2d-a152-554b7d992fbe", "comment": "Malware payload", "value": "9f99f46466ddd86d64171231559011ef2dcbed4e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909040, "uuid": "36052270-4fd5-4356-a075-abc8874875d5", "comment": "Malware payload", "value": "8cfa6b2f75de5ecd039712da399fde15cfc2169383e048444fe6be6c07e36648c7ebecc9624f4b82f55f28378f8dbd79", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909040, "uuid": "cbdac790-38e6-4632-82d6-5a54d066c33e", "value": "T194A1F850112C1AB07246697AD26FFA52B40EC81B0A777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909040, "uuid": "f40b4daf-7791-416a-922d-cfccce6d4e1f", "value": "96:/RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:/RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909040, "uuid": "0cab5368-cc3d-49cd-b5d8-70082cf83b9a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909040, "uuid": "709e7c91-4957-40ed-84fe-80350f2e2ea6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909040, "uuid": "d8bb6b1f-c6ad-46c0-9f29-98917eb72192", "value": "e02212bdb786c4d67509ebbf97d15144d6e40e8fab2abff6e833f14cbe2396e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daba9e04-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909049, "uuid": "8c758e17-ea6a-410a-b6fd-5df637a2490f", "comment": "Malware payload", "value": "2c17e3e42a8c58e9cc287cceb1801798", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909049, "uuid": "503f39c8-51ec-422a-9307-8a785de24e6e", "comment": "Malware payload", "value": "e177a69cd9b95e54bc74eccb146464679df0f366616d010268e6398115ce0f0f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909049, "uuid": "2e452421-e9f1-465b-a92b-876abeaa5748", "comment": "Malware payload", "value": "b8d0c132630c70e226f23161acccc26ac0a37095", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909049, "uuid": "b50179e8-0a14-4bcb-988b-d1a29c477859", "comment": "Malware payload", "value": "7b28ef0f85ceaabf6d0d938104e80f5633ef32f346780a9e53974f37096dd5d24d5f063560af5ba3b08942f439f47929", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909049, "uuid": "2789368b-2b54-4495-9c13-cb79285bff61", "value": "T1ABC19898A18C0AF218D4E5AA35BFDC5C76E492C7651F1E4D99AB1CBF30066C5F10A4CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909049, "uuid": "e98eb50c-2373-4183-8215-5f36f474c868", "value": "48:jaJMK7MNZMP1M9JMW7MTBMYXUaM95Mt5MAzMKLMNBtMNwPTM/b8M/WZgwD9q9z:jaJRSciZ4caiyjHUtXbG89ZgwD9q9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909049, "uuid": "b2cf0b2e-8f20-4abb-b69c-5fb0568bb1a1", "value": 5741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909049, "uuid": "6bff319c-ecf4-4ded-b674-4b2c3f3ff66d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909049, "uuid": "22b9611d-649a-4b3f-a5ca-597cbe83a488", "value": "e177a69cd9b95e54bc74eccb146464679df0f366616d010268e6398115ce0f0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54756565-d6e4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652903669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652903669, "uuid": "d69b127d-715b-4fbb-85c4-2b90d59ee79e", "comment": "Malware payload", "value": "a5f2b2d9be74db766e264cb31d57718e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652903669, "uuid": "03997d5f-011a-44a5-9bfa-ef3cad6173dc", "comment": "Malware payload", "value": "e1d0332122ef67e0c87adc0cf0c92a3b956c9ebf3848be073feb55ee9110688b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652903669, "uuid": "83c0fa3d-3f50-4dad-ae95-73594229e7f1", "comment": "Malware payload", "value": "7961a19c3c871d56ada97ee05f16e279c2ad9d03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652903669, "uuid": "2e6a0044-af58-4dfd-a01e-5986e63dae2c", "comment": "Malware payload", "value": "48a3b293da0cfc7765fbe9932c01739d4b6521a447a893aa8b93d68a2502384ece1011b07ab21a3a2dc9e863b455391d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652903669, "uuid": "e7fcff78-f72e-4a84-b26b-db6b01c7843e", "value": "T15605283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652903669, "uuid": "91737cab-a563-4db6-8b93-249e92252015", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652903669, "uuid": "5330c132-9193-4552-9734-dec7d56ef06a", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7ampE3:BTg9UXRD2SeqfZZimm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652903669, "uuid": "0157db61-fa3d-4718-bca4-651fbba65930", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652903669, "uuid": "47aa2fba-39b5-4055-8e42-1a347c63dca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652903669, "uuid": "e8c45eac-1af9-46d9-b3cb-555e21bddb2d", "value": "a5f2b2d9be74db766e264cb31d57718e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24003951-d683-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652861927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861927, "uuid": "1ac14285-ff65-4af8-a9c9-fab954f72f1b", "comment": "Malware payload (Heodo)", "value": "87b05bf39dc38baa199ed170c019cf22", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861927, "uuid": "c665bef2-5a6d-4f77-b4a7-36e8283e430a", "comment": "Malware payload (Heodo)", "value": "e239f7a905cc91e886d2935f5fc76bc5e2bd8bc6c05ab244d93cd5b1482d3b2a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861927, "uuid": "e5bce8be-a811-49f6-b136-55a058e37427", "comment": "Malware payload (Heodo)", "value": "9ae850e7c7234cc2ab23b3f80538e4e8e40fe0e9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861927, "uuid": "beeb19eb-c1ee-41d8-bb12-6ac1a176168d", "comment": "Malware payload (Heodo)", "value": "723f3e69be9b4532b6fa5c692a2c7b56461f48837013c23e6c79f4886d9154dcf2332f6e7d22970ca8fd37cea373fd80", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861927, "uuid": "d8960ac0-e0d4-437b-8901-de07aa5f643a", "value": "T1FA94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861927, "uuid": "4105c631-7366-4e09-90ff-f84a064ec7a4", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861927, "uuid": "2e11de35-189b-4b4d-8502-bf5d96953c77", "value": "12288:M3hV6Pw4aT23s2o6d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2di3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652861927, "uuid": "e6595334-7b0f-4919-9dcd-a74853607ee2", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652861927, "uuid": "ac572c61-1cb0-488a-b4a2-ccf42f027474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861927, "uuid": "832f825c-217d-480c-aa38-0d65b3592a13", "value": "87b05bf39dc38baa199ed170c019cf22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a4e9a9-d6fc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652913949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913949, "uuid": "c01aed09-8b54-4266-a76c-d2e0db97b67a", "comment": "Malware payload (RedLineStealer)", "value": "edceab15a24fbc9a9161ab4b2ff6a41f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913949, "uuid": "512bb633-7549-4283-b930-dcd374a7ced4", "comment": "Malware payload (RedLineStealer)", "value": "e254a5c2bd326c36a36ebfaf72a2f4fdd409a7e882d95fb26af2862972cf30fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913949, "uuid": "a7c11d7d-7faf-473b-b58f-11c238f556e8", "comment": "Malware payload (RedLineStealer)", "value": "c7fdbea96749e4eca9bcb25f4248b5b5029043db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913949, "uuid": "2c00f6e7-23ad-41fc-9c3a-e84033f57781", "comment": "Malware payload (RedLineStealer)", "value": "7aa0662bf9a712da15816dbad01897fbd9cac5c55515bb1078d79736091836f8e8254d0e41606259d55e1ed499941fb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913949, "uuid": "e9129264-a6e6-4046-84b8-f253ca32623d", "value": "T18294F111FBD1DC31E0920D7048A1EBB15B3BB9636670654BEB905F6E1EB33909A7231B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913949, "uuid": "016fa2f0-2e14-4daa-afdd-d6b7ff87de67", "value": "db57d5e3d04b9a257784f752aaee46da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913949, "uuid": "0dea463c-48de-43a0-bf0c-ca4d0a367c89", "value": "6144:mjwQdXl18bPkoAEJOEtChpc6KAEcfirFHiga3wVf:qwmXlSbPkoAegTc6xxfirs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652913949, "uuid": "40a55619-7efb-4fb8-a580-02dd6cbda085", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652913949, "uuid": "e72730d7-6eb0-4503-91bd-a1bc102d1584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913949, "uuid": "0e6c6414-3e5d-45f2-a4ea-239e7e070b4b", "value": "edceab15a24fbc9a9161ab4b2ff6a41f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69920a20-d6af-11ec-8e58-42010a9c0032", "comment": "Malware payload (FormBook)", "timestamp": 1652880942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880942, "uuid": "b4f7c20a-50ca-474b-8e3b-b5568d6a1f99", "comment": "Malware payload (FormBook)", "value": "a7f66fb0a1bc9824384b409aa7430ded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880942, "uuid": "1799b9e2-403e-4529-9875-9bcba6e62a75", "comment": "Malware payload (FormBook)", "value": "e261d9f28aad1bbd77d7fb3a1c66f7f80f9c11b853615302d5e6f7363a8dc282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880942, "uuid": "c60774ca-23f5-4f52-a695-ca9c071f96cc", "comment": "Malware payload (FormBook)", "value": "1a89c3a67c16c8442f1114ee91b8922ea15bcf39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880942, "uuid": "80434a9a-8599-4f62-a7cb-3fb550c50d36", "comment": "Malware payload (FormBook)", "value": "6a913bc9dd265901b79460d4e76201408d7d55c40d64c2a4de1fd277b7ea4a835306c9914dc5598c2ac31d3adce3395f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880942, "uuid": "b6e9aae9-5f5f-4a56-bf5e-c8db321ee9a5", "value": "T14845F20DBEB08244C31878F69DD107A0C2705F5E82595B4E2EBFBA597472183CEE6D9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880942, "uuid": "312a24b7-3f77-472b-8b95-cc1c3e01538a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880942, "uuid": "07386b51-ce34-40be-a220-2145167efcb4", "value": "12288:SJdT707LWCr01NJgElLBpNNDW6apvyjynhDiTbO5TwrDiIV21CPGRu1jJ42Dmx7s:SJqPrWLBxWVojyxkO6eIQ1CPGYjJBm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652880942, "uuid": "3d5de721-9a51-44ef-bdd0-f09cc75459a2", "value": 1242112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652880942, "uuid": "5b95118a-594d-4dbd-b4fb-8c88d97c406b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880942, "uuid": "38632088-b5b2-45f8-a6d8-dd1383e4a8b9", "value": "SecuriteInfo.com.Variant.MSILHeracles.26997.7726.20843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998a39fa-d681-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652861265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861265, "uuid": "41237e2e-44cf-4518-97fd-5e1422afc632", "comment": "Malware payload (Heodo)", "value": "9feb131bb132ab63eeea2183b2376297", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861265, "uuid": "6a2edd5e-84a1-40f2-848e-03875156d1a3", "comment": "Malware payload (Heodo)", "value": "e26dafc4e001df40480d1139788f6dce32d368287da1bcad2c1c8b5e9782ebb7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861265, "uuid": "3411d6d6-65bc-46ef-9650-ac537568fce0", "comment": "Malware payload (Heodo)", "value": "9c3f3da5e1b5e5ea87749df9606f48ad50979a97", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652861265, "uuid": "4f251538-d418-4810-9e9d-91e1a402747b", "comment": "Malware payload (Heodo)", "value": "fdda851a5a2e855d2935463d7f6a1a3c271f563aad7f568495af55660822c27b079703473b89a040aa113ceef4e71701", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861265, "uuid": "24af49b4-c81d-437f-b355-ff0848876c53", "value": "T14194CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861265, "uuid": "ce712dc1-bed9-4ff1-b5de-ab2ad01518b8", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861265, "uuid": "768d7d3c-f099-40e1-aa64-6822f947d709", "value": "12288:43hV6Pw4aT23Guorv91Wuwf07EIvH3+38+:sb6Pw4R3GuEWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652861265, "uuid": "00dcf62d-a0f5-4521-935a-6d8329da5c24", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652861265, "uuid": "c924ccdf-1b62-4eab-a983-751c54d8d16d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652861265, "uuid": "6fe42c7c-4953-4987-8597-dc5014717199", "value": "9feb131bb132ab63eeea2183b2376297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd03f2c-d6b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652881860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881860, "uuid": "a5bcd792-c3f3-487c-b7bb-37da2fd2458a", "comment": "Malware payload (AgentTesla)", "value": "981db7c13aa8543dca5f534b45ffa2bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881860, "uuid": "bce13458-dbf7-45f2-9874-068a1430f35a", "comment": "Malware payload (AgentTesla)", "value": "e28373004354934e8cdfd0b7edfbaeab53f2d9d6c97992db5e572b9489ef61dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881860, "uuid": "a17f2723-d574-4115-a701-b261c133a3c5", "comment": "Malware payload (AgentTesla)", "value": "72aed08de927b2bcce1d546bca0d320e6d54cb5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652881860, "uuid": "6960775f-243e-4e2e-97c9-64803c643abc", "comment": "Malware payload (AgentTesla)", "value": "f5e1b71d7c38871b1dabf4e6744f03b4bc2d7e7a716d9e5dbb1ac9167d9c1ad77e96cc2a54eb28aada2990a9b410ba51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881860, "uuid": "8693e84c-5c29-4399-8735-60147eeb2401", "value": "T1DB15C7AC321075DEE86BD676D9A81C68EBD0746B831B4203A02792ED9D4C9B7DF140F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881860, "uuid": "734ab38b-c663-41f1-b98c-6b076bae7ab5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881860, "uuid": "260d5def-a5c1-4b5e-98b4-8f3378e11434", "value": "12288:X8YiwqWBb2qubi1IhS/b+/2ppoLTsvEAEz3nHyt328fnPH2TggWCI69h8svBW8cz:X1iwqWV2qubi1N/aeULTsvEAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652881860, "uuid": "014e0da3-64db-47a1-8b27-ba7625c26770", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652881860, "uuid": "fcfc058a-f010-4b55-8e81-f7b84137a023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652881860, "uuid": "2d81f5ef-e94e-4321-8b9d-03b9a29362a0", "value": "lee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e657a7-d6ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652892767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892767, "uuid": "dc24dde8-2780-4b08-9e96-79da18e2b194", "comment": "Malware payload (Mirai)", "value": "271ad94ba56c4104ed25d78e7c72014f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892767, "uuid": "05fc0b0d-9529-4ea7-b864-ce7176f85e3f", "comment": "Malware payload (Mirai)", "value": "e28485d762313701e0cef081382187c85a85deb835f5e6c74227eac2878dc6b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892767, "uuid": "e0ee4bd1-86c1-4a94-ad80-3c8d4879b7ee", "comment": "Malware payload (Mirai)", "value": "fb8c40d18737c3f8d09390acb22719a0c8a65024", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652892767, "uuid": "099e1702-44ad-4b06-8cc7-c3efab0fac15", "comment": "Malware payload (Mirai)", "value": "f359e0bed0d1282db54053d65717f7d682b06c5f882b58e7dbeda6a7220ca537453cf6d8441684da0456c00adeff7be5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892767, "uuid": "0c454511-2b0f-4f2f-a114-a8b0d39c4c29", "value": "T106830A95BC818A11C5D413BAF92E018E332267E8E3DFB2169D205F2477CA92F0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892767, "uuid": "12c47993-4fbd-4ee1-90fb-6d35a017e653", "value": "1536:68n7Pcpy2VT7ar3spZiQG28ILGYhG6G1TYlw6y5rpZ55LJKc2JIPiR2Q/GynR3:qphbZjn8ILGEFGZ9b5y2Q/GynR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652892767, "uuid": "72b4cfe1-3d79-43fb-8124-74bc9d9b0d16", "value": 87440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652892767, "uuid": "568441e6-c6b8-4b1f-91cc-60e06fccac36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652892767, "uuid": "f8bbcdb0-e948-4982-87f8-2bdde87aea63", "value": "Oblivion121.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea260086-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909075, "uuid": "da2e50a4-9bf8-46af-b3e1-e11d6fa59396", "comment": "Malware payload", "value": "58ea7964652a7864718120607b365be2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909075, "uuid": "e5576937-6b6c-4a48-8386-a38041e707ba", "comment": "Malware payload", "value": "e299a4a89f54cfe0cf87367744b2d2ba24a71d552f1c3bcdb80dcc0fca628032", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909075, "uuid": "7ec5080a-fa37-465d-a307-8c3bf4ab78b8", "comment": "Malware payload", "value": "0215f7831461a76823a6f3ddb00ca6ace646a8da", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909075, "uuid": "ba00ff72-1e05-48c9-8505-124ac133a169", "comment": "Malware payload", "value": "d895f2f3710a79990cd79d5f895aa53fd5f8ac11d2513298a33967f6f6d411883d357be318fe43f2b855fbf47b8f6504", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909075, "uuid": "0ae359ee-a525-436e-b03f-219f6ddcdf6f", "value": "T106A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909075, "uuid": "303cc018-94d4-4fe4-a549-df9bfa7358f3", "value": "96:QRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:QRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909075, "uuid": "66404f19-3189-45ce-a6bb-277abc18ff92", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909075, "uuid": "b004a691-55c6-4674-9d2e-173085a49f0d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909075, "uuid": "66508d74-2eed-433b-9770-c606f95b2a95", "value": "e299a4a89f54cfe0cf87367744b2d2ba24a71d552f1c3bcdb80dcc0fca628032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86780cc9-d6d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1652896022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896022, "uuid": "94e870cf-464f-4397-8f66-d1d516cec7fe", "comment": "Malware payload (NanoCore)", "value": "18895b026e64a199ef607f6542f321e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896022, "uuid": "033e0528-91bd-47b6-bc7f-225014d7eaf6", "comment": "Malware payload (NanoCore)", "value": "e30cf2ffd0b74369525a408f6fc0e661cb1aa9ab5c41786e2a3bbea741b76520", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896022, "uuid": "8bd1f9c6-4b84-4ff8-aa06-6e2a52d7b4bb", "comment": "Malware payload (NanoCore)", "value": "82c4b5d56b45f9a34b85d179efef22b7ea47afe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896022, "uuid": "d83ca361-4cec-4b44-bcb1-2797f3229c1e", "comment": "Malware payload (NanoCore)", "value": "21efe4d315570e9f56909ee581bdfe4ca1033055ca20f89a6c1cdb5b92f5aae4bcd4d8b9bcb67020e6e30920a6e932e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896022, "uuid": "589154cb-780e-4dff-8505-ffde370bf8e7", "value": "T109E4022DFEB5DE12D25806B2C1C3552403F1944B6772D78B3EC992D60E023A95ECE79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896022, "uuid": "d6915862-c80c-4803-8092-abf24293e4f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896022, "uuid": "200f1c29-cc56-428c-ac31-cf79ab6efcd0", "value": "12288:oCvoWXBiZ4CzBOUaI8AycHDN2L5Mji2Yyvz314Xh0gtqacS5:oCvo+y4CzcI8Ay2DsYbyXOgtVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896022, "uuid": "2bd8f24a-031b-46a9-b494-b20498311e13", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896022, "uuid": "67286d94-2f99-435f-8427-02741d3fbe85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896022, "uuid": "2e16cae3-f323-42f4-ad37-c2a4f2473da5", "value": "SecuriteInfo.com.Trojan.PackedNET.1342.21637.19377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6abe7e86-d6f6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652911438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911438, "uuid": "113cf4c6-6b2d-42fe-93cc-4829652299e8", "comment": "Malware payload", "value": "4893239d93fbf4b5f123c9881de45b3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911438, "uuid": "f73ba836-95fb-4432-9103-ec15f9063910", "comment": "Malware payload", "value": "e3626dfc7972b059fad843e7a8203aab46c0b868e3f8eb7f5ea60d61acdcd497", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911438, "uuid": "9bbac801-1e13-4692-8e39-e6f53f18530d", "comment": "Malware payload", "value": "1bd3717a9c78bcf3e625b7cdb774edc5ff25c0de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911438, "uuid": "7f980323-ba25-4e34-94c2-b0a8870434e1", "comment": "Malware payload", "value": "c90c287dc5c588f95ef39b3381cd88c7e4c9f52bbbaeaaa39fd3df38ba6d215a3f1eba4234a6cb19bd5428a935a3ecbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911438, "uuid": "4c0eecd6-f6a3-49fc-8a45-97a0a0b6358a", "value": "T1BE05273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911438, "uuid": "d2c44eea-0a5f-47bf-9f07-705ebcdcf620", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911438, "uuid": "e2825b29-008b-48ab-a73e-60f369ebc25f", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oQaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7qUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652911438, "uuid": "5cf7c4db-5854-4135-822e-fc9041ab26c9", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652911438, "uuid": "981abef7-1ca4-46b6-9601-23157a58551b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911438, "uuid": "cf8d1d9c-5c59-4c89-9373-bda17073edb8", "value": "4893239d93fbf4b5f123c9881de45b3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dbe664d-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908946, "uuid": "38ba6888-6f04-4ea6-bda8-366c0348896b", "comment": "Malware payload", "value": "22c1c174c6a6c3ac596deb97e7882267", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908946, "uuid": "0dc9dbde-e680-45ff-b860-fe9408f40cbe", "comment": "Malware payload", "value": "e42fe62634c714e283688fc4e7edd6cb07d2d9c44a10cd28bfacc06ab904cedd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908946, "uuid": "fc39f6d2-c179-4d77-bfcc-845a843264f5", "comment": "Malware payload", "value": "11201f27827e871545f33e4ba971b1c3c328fc74", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908946, "uuid": "81aa7884-5b32-4bc7-8940-d0ac62b93032", "comment": "Malware payload", "value": "677c63140f7bd45ccf67a2cf9cbb9a5006b57c5acd6a44c4f2e3af5f4a8a69d6ff2b7eeff8c3558bed867683c0c609d7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908946, "uuid": "0f39aee7-ba1b-477b-8d70-fbe92d1769e8", "value": "T10D317EC4607131723CBB54A777791C2A72C0A0267CE56E48A8E8FCF989CEE4525D41EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908946, "uuid": "dcf9c37e-4aee-47f0-a999-e6c29f848ce9", "value": "24:Ijmc9kic9/iKWcu7kNRAcuQLtcuZqcbcuu5bcNlc90lcHn:JGjKWaXAchWCdlun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908946, "uuid": "ee866ccf-3385-40f2-9370-5cb3867045b2", "value": 1650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908946, "uuid": "cf2604ef-f3d6-436c-b8cc-74c78a2132a8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908946, "uuid": "09a761cf-6298-40b1-9c6a-e8cb78dd1b48", "value": "e42fe62634c714e283688fc4e7edd6cb07d2d9c44a10cd28bfacc06ab904cedd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1d8c47-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908942, "uuid": "0303315e-4bd9-4312-b004-99619d8d2c15", "comment": "Malware payload", "value": "db962759e50047b0f0de46bbe55adc5a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908942, "uuid": "e3cedc37-e8ad-4c14-939b-6bf296a3a05c", "comment": "Malware payload", "value": "e45e3ee07d480e90232262ee651dc93d7b71e8ef506abeda354827a202f1c0ee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908942, "uuid": "227f2a38-2588-401c-a062-cd1a47fb2524", "comment": "Malware payload", "value": "d0689a2b860df12832aac6b854122ebc8bcee64d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908942, "uuid": "6c6f88b1-aa0a-46e3-8999-d0f35befbc71", "comment": "Malware payload", "value": "5a6471e044a6c53e6bf049dcabafdacfcc48abca2480912bd61792aacc22eb48ca4109cafd838300328cd7f0bde692d7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908942, "uuid": "f62fa40b-0477-47f0-9af1-76fbf3439abd", "value": "T14F411BC410DA153D28BA9977A7A6060436D795F618D22D8C54D9B8E6ACCCF04ECC3FA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908942, "uuid": "d6e6f416-5b59-4450-886c-f57030715d24", "value": "48:v+3g+sA+LVa+VgJ+Sk+vK+sk+o8+p++UgM:vRuz/sVSAHgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908942, "uuid": "b93ab527-43ff-4d13-a941-b576e392d0ac", "value": 1903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908942, "uuid": "aa8f92a4-9a43-4d1a-a967-3822ce439399", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908942, "uuid": "8f0d7587-362c-44c6-88e6-4d205354d57d", "value": "e45e3ee07d480e90232262ee651dc93d7b71e8ef506abeda354827a202f1c0ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627aa1b1-d6af-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652880930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880930, "uuid": "f6c9c831-1177-4e26-ab3e-f67fdc82b044", "comment": "Malware payload", "value": "5ddc8d6b0a9593e558539c726b28be4b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880930, "uuid": "66492f8a-b514-42ba-86c2-0c1c87803322", "comment": "Malware payload", "value": "e4b7d685b55a74e1a476e315c0f2f8780c2f84681917ef9cb0b668a1021d641b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880930, "uuid": "a949f3b7-51e7-4bfe-a145-607073e1c87d", "comment": "Malware payload", "value": "b3bdf5a732f1457e2de48e8c8532c6a0338d7343", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880930, "uuid": "d700544e-9360-4f7e-93cd-b2eff3661b7b", "comment": "Malware payload", "value": "eae05fe8b3f20bb4523698df03f18f837d429d99d6a25eda095a070d794feed649a1a51b57ee3559e55c736fdae464f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880930, "uuid": "65126294-8c1e-494d-b073-6d12b604fe2b", "value": "T19A81D717B65ACA13C1800A316E82C1786212FD03FF32AA0B79CE771F5E717C59C55299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880930, "uuid": "47ed6a11-9601-4a77-bf05-2e1b82e36a6e", "value": "48:rtv2iRrezUeAiV/ajq38CKGHoDvLkhM7:Zv2SuHA4/2NeoDDke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652880930, "uuid": "ee70d857-de02-474a-a786-22979adfc5a8", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652880930, "uuid": "0f380e3c-489e-4f50-8741-bde8d118fc79", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880930, "uuid": "fad93898-c323-456a-a458-bb921259ae0c", "value": "SecuriteInfo.com.Exploit.ShellCode.69.18191.14835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9262a4-d6c2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652889003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889003, "uuid": "abea3226-3de9-46ce-8ecc-5fcebb8b6205", "comment": "Malware payload (Mirai)", "value": "bcb6daf6b5280741a7ccc25d8653eb61", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889003, "uuid": "0e45d493-c56d-449c-872f-52140de43327", "comment": "Malware payload (Mirai)", "value": "e4c77dc987c390918405ffad7d9fad4bd3202ff8a825f2633089a476da6b37f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889003, "uuid": "e941183e-bfd0-400f-9159-9c4501c1b979", "comment": "Malware payload (Mirai)", "value": "19efa98b27a58a3645c449d3a24e8d817a6320cc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652889003, "uuid": "700ae31b-6dce-468a-9b1b-b3f921a01f1e", "comment": "Malware payload (Mirai)", "value": "fd7820618e94ca933ce3499a1ab9f9c90045b464b89cc8d53c2064e23807253ecc50e6ce5e5a64f0ba07013d68b5e996", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889003, "uuid": "e4963dde-14c4-436c-9bec-2183f2e97571", "value": "T126E34A42EA408E13C4D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E62A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889003, "uuid": "2f890508-d2c7-4226-b621-565cdf791064", "value": "3072:walgM69pe0QmlTvIUdt9mrsplDKZUQQBKXAVanXX+F8JyvSPhLZ85iBMR6yoC1Qc:walgM69pe0QmlTvI8t9mrsplDKZUQQBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652889003, "uuid": "823f3d04-1913-436d-80ba-42519d829d6e", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652889003, "uuid": "86f713cd-8041-4f87-9439-eab214695e10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652889003, "uuid": "10e3a7da-e779-4ea9-92de-654cc131d39f", "value": "loligang.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf01087-d67c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652858909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858909, "uuid": "f448a50c-6cc3-43b8-94e5-31cddee8f447", "comment": "Malware payload (SnakeKeylogger)", "value": "f551e3947f82161ebff4db56e87989ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858909, "uuid": "947fd2e4-4e32-46f1-b262-df3ad0db48b8", "comment": "Malware payload (SnakeKeylogger)", "value": "e4ce432bd87b6bddfc2e50b718967e8f139abd3b6b7a845bd3609b7f9a85129e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858909, "uuid": "293375e5-bb35-4c2b-b7f2-d0f5219875aa", "comment": "Malware payload (SnakeKeylogger)", "value": "29a015984e5cdfc07b336d9b8581efc009fda38d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858909, "uuid": "76e0add7-bf3f-4b81-a79c-65ab9d812a36", "comment": "Malware payload (SnakeKeylogger)", "value": "b5425e4a450831b4b90e922a8629d4e1642defc0694458bc6c8048a0884e724216a24210b5d53c6e3e8f36706759b5f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858909, "uuid": "194cbf05-264b-420b-a5a5-d6071645258b", "value": "T163D4F12952B8CD50E5AA43BED0A251F807B46D13D902F75FCEA47CDA3D363C1871AA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858909, "uuid": "fd0d0774-a03f-4956-aa4b-d267b94ce714", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858909, "uuid": "0bf972cf-a24c-4778-9b27-7dac59af4120", "value": "12288:nYEPmJpXosFxCcaT/8Ve7ZEhVMmWdkBWNWCq22C93:Y4mT4s2TMvDMmWdpWCq22c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858909, "uuid": "c0db4202-efc2-40a3-bd83-6509834e7538", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858909, "uuid": "76537fb3-7c83-4928-b263-a327fbb90e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858909, "uuid": "9fbe1186-a042-4f4b-b78e-723bfaadd292", "value": "INQRY-80164-S2-1163651.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d260e478-d658-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652843751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843751, "uuid": "085cefad-c399-415f-bfb0-e8b3d973d0db", "comment": "Malware payload (Heodo)", "value": "be41cc23af4bd2d901d0215ec233c9d4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843751, "uuid": "9f470c43-ff28-47a2-ac25-19e72f5ee3c8", "comment": "Malware payload (Heodo)", "value": "e522dfb1c5cd877169d40c71122b446a77f7c39728f08324045980e349ff9b94", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843751, "uuid": "49cd87e1-dfb0-46fb-9451-f7e1fa545c99", "comment": "Malware payload (Heodo)", "value": "9340317166c81c20ae44a7561808b15c62a67dc7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843751, "uuid": "acd739d0-c4f5-47fc-a6e4-b85ed6f9b9e5", "comment": "Malware payload (Heodo)", "value": "b5415fd765ed12a0b5719cfed14c1d862cf259a8f66de2a7733bc788b71d21316b79b1721d40076e7762f14c8f414918", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843751, "uuid": "e9b6fdbc-6753-41fa-8ea8-7c44d5fb923e", "value": "T14F94CF1572A50CBAEC779239C9434A06E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843751, "uuid": "0a29ca79-a1ed-4dcf-a48c-4774dce6d981", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843751, "uuid": "8ac9ff75-33c8-4ab9-ab69-fc3afe8b80f6", "value": "12288:M3hV6Pw4aT23s2o7d9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ci3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652843751, "uuid": "2920e591-78e2-4ac3-94b6-58a35f9edd55", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652843751, "uuid": "4b952b32-3be7-4523-833c-1da228a55a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843751, "uuid": "293f1fae-0286-46d5-987a-36d317848dd3", "value": "be41cc23af4bd2d901d0215ec233c9d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c56b8c6-d6d5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652897106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897106, "uuid": "f56d64fb-6917-4b5e-9d65-031dc5631141", "comment": "Malware payload (Formbook)", "value": "f1f8fb39e415aa754ab38f42e9f6bb68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897106, "uuid": "7c2ca676-2c55-4222-82a5-bf9bd9f3da64", "comment": "Malware payload (Formbook)", "value": "e54460b814db593c07a06645065eb94fa5fcf08b77a459d1ce79ce401d3e0075", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897106, "uuid": "f1d4c970-5053-412c-8cfe-2f6039f981fd", "comment": "Malware payload (Formbook)", "value": "6d1f3f5c06a64cdf47b05b09ddb8769a286cd7bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897106, "uuid": "c256bc14-2195-40ae-ab10-053d0f562591", "comment": "Malware payload (Formbook)", "value": "75a80b55646a96f71274b95d1d31a4e3e4dfbbc261c26f54542a9f8006f4ddc9976169bf10609902d013671708192eb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897106, "uuid": "86cf20f9-c88e-4a49-96e4-65d6e22c4f82", "value": "T10CB4229031F8EB78D97E4BF30C695646A7F918210963E7162CC510C96B737828EB1B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897106, "uuid": "5a02cec1-aebf-4bab-8200-bd4a2079f0f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897106, "uuid": "1af6b7a3-4f14-4426-8882-f7b6b95c23c5", "value": "12288:Zz2iNRrWk+rAfVHEicp8wjn4ixXmXKqM60XyiV1xJZh0qR6:V1zWJkfV++dXKC0d1x3im6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652897106, "uuid": "4c6d7355-43de-493e-a0e6-f48953066f23", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652897106, "uuid": "d4900226-af13-4d21-9999-ce2121f8acb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897106, "uuid": "af33069b-6f17-4db2-90e6-ecc0bed3f4a9", "value": "f1f8fb39e415aa754ab38f42e9f6bb68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a040dd58-d6f7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652911957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911957, "uuid": "09d44bca-c040-467a-8b3e-23569535dc18", "comment": "Malware payload", "value": "ff72b295ded9889cee24320db368bcf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911957, "uuid": "653efd18-5594-4d96-8528-401cc677bfcb", "comment": "Malware payload", "value": "e54ccfd9a2ab15b4461eb38baec21eb828f7757ca3e67db3b7acb261be34adcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911957, "uuid": "bdf8cb57-7f88-4541-b731-f3e1d624b754", "comment": "Malware payload", "value": "5d7991f8495d56088710dd558faba639ffd05292", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911957, "uuid": "b8f9f9fe-fac4-42ea-abf6-63146bf00977", "comment": "Malware payload", "value": "fb46ffb88dd3ac6abe438adee3e71e8e36f1899802357ef6383866970c97bb89996c3a19ad5d53ce0e79fc8dde0a7020", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911957, "uuid": "e28334c0-8bd6-47fa-91bb-50d3c9531f75", "value": "T1C30512A1B508C6D6E44D017A5C17CA460A62BC7D8AB0625F77FEB36D89F239500FBC87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911957, "uuid": "51da5fb5-a568-40a0-84c8-029273f261cc", "value": "12288:x1C5Hd6IFau1QqizENnbiYLZ8FRFlOVbFPL1ZbIXUZimeax0nY2LvFB:xA596SagQzunvZMRFIfPnYUZtX4Yyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652911957, "uuid": "21199c30-f2d3-4a26-915f-ab6d80d4e7f9", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652911957, "uuid": "3f44199d-eafc-4ce3-a09a-8e7c53ab9655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911957, "uuid": "22458314-7c56-4f13-a677-f3dec146d4a9", "value": "ff72b295ded9889cee24320db368bcf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bbce63-d6d0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652895219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652895219, "uuid": "2f623e9e-492f-45d3-9409-5d0700553c8d", "comment": "Malware payload (Mirai)", "value": "b61c5e8873a44f1957ec104d4f887503", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652895219, "uuid": "d1889010-00fd-4460-be65-3d5b84406907", "comment": "Malware payload (Mirai)", "value": "e571261d210bd23d8fdd71f5293bbfaa73dfaf8977fcfdefc3ca34bec252c954", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652895219, "uuid": "02b24ec2-56d9-40ad-a7b3-3db2679c97e6", "comment": "Malware payload (Mirai)", "value": "df08fdaa52c1b380f165b373ded151e43b1fc9e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652895219, "uuid": "b781527e-1cbd-41d7-9396-8a7eab1a2b7b", "comment": "Malware payload (Mirai)", "value": "f8bb1b4b2d02c68c475045b307795efaa46ec9036e5a0aa56cd4a5301d47af33e14f409bab95c23cc108b01e10d889ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652895219, "uuid": "d4dcf7b4-c378-43a8-b563-e127f810b7e3", "value": "T148734A36F9392A27C0D1A43E11F74B51B2E11BCE26E8CA1E7D720E4EEF615506417EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652895219, "uuid": "8db9ffd2-ae64-4e8c-9771-fe443b773c23", "value": "1536:eMsk4f4Unhcct+Pq/mqt83GS7uJvs27FdmgR20ux:zskg+y/e72k2tRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652895219, "uuid": "760c5945-0a53-4c33-a332-61bd7ee49905", "value": 79800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652895219, "uuid": "e4cefa17-042c-4427-b0fc-bbf4e6a21be5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652895219, "uuid": "16b2222f-15d1-4780-b36b-ad5d6c24aa39", "value": "b61c5e8873a44f1957ec104d4f887503", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9060830-d692-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652868673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652868673, "uuid": "07ba7cfd-1315-46e2-8050-8546bcf4c97f", "comment": "Malware payload (SilentBuilder)", "value": "acd3d4e8f63f52eaf57467a76ca2389d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652868673, "uuid": "836a6151-19f7-4de6-9510-470f2d2f184f", "comment": "Malware payload (SilentBuilder)", "value": "e598b9700e13f2cb1c30c6d9230152ed5716a6d6e25db702576fefeb6638005e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652868673, "uuid": "928980c6-d7e1-4473-acb3-172d2c4471a5", "comment": "Malware payload (SilentBuilder)", "value": "4a42b5e7e7fd43ddefc856f45bb95d97656ddca6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652868673, "uuid": "434b6f59-798c-494a-acb0-1554e78144ef", "comment": "Malware payload (SilentBuilder)", "value": "f07965c52818b73769a805c5bb17f6213fd3e40df5ece84762cd7b4d8ee59367a65aef3d3887e24c798baacfb3756fda", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652868673, "uuid": "b5d70bf6-4077-41af-95e4-232805a5935d", "value": "T1BB735B4AB599D96CF6228738499783A9B313FC110FAB07873549F3B13FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652868673, "uuid": "d46296eb-53a1-438f-bde5-65f1ddfc27ba", "value": "1536:WMXKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgd2AezwrMCtvJecvRtbiAw:HKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652868673, "uuid": "5ab2269f-10e5-4bc1-9bfa-611b733fb236", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652868673, "uuid": "2d82503d-f771-4b41-90e1-3dd9c009372c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652868673, "uuid": "82067078-b7da-4a98-a633-1a2b9854d222", "value": "info_1805.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1787335-d67b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652858728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858728, "uuid": "0b18fa73-f512-4b48-a8cc-d2de3bbda931", "comment": "Malware payload", "value": "5c7f6873ad107689ebb960447f8a07f8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858728, "uuid": "e96a5d24-ff30-4fd3-943d-c903b25ad742", "comment": "Malware payload", "value": "e5eed24b2125ce4d81778690780888eaecd93391c4a0996dacebef4e9ce4e21f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858728, "uuid": "aca62d71-0d31-46de-b871-87f669bf6967", "comment": "Malware payload", "value": "1bf7b8595d267d913f32a55627f1e3412461e7c3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858728, "uuid": "2cb4c624-3da3-4368-a6ab-64a74b28e8f9", "comment": "Malware payload", "value": "85d9ebec53601f9ef403d33fce1d87730fecd9bcf158e35fbece8653bd3f041f83d6b2376570ec3cb0e6dd61e67d09d1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858728, "uuid": "5c387aaf-aca4-41a7-a7f1-cb6e0272525f", "value": "T11E027DE94852DCD4CBCCA2943D32B2885CE3795CD9D3A5C2325C7BD807CB98C5992867", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858728, "uuid": "355b1646-1205-4475-b27b-9e15d14e249e", "value": "192:dzhXmh+eCxbFzo0rJnwTyOTLeMbWfV4C5sLe5kftcM:d92ghlZrBSeMifSa5kfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858728, "uuid": "ffa3b3a0-cb1b-46d3-953c-360427a8c38b", "value": 8952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858728, "uuid": "f30e7c5a-7f8c-4a69-9f0a-a45186d8519c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858728, "uuid": "d263b82c-5e64-457e-afd5-a85b3f4e4d2f", "value": "DHL - WAYBILL 44 7611 9546 - Joao Carlos.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d362d7-d6e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652902912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902912, "uuid": "12985e0e-43a8-4296-b73d-83c0a9ccff8a", "comment": "Malware payload", "value": "0092efd3db1cc4391c7553b7e2101ac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902912, "uuid": "fea1ae57-7fc4-4563-b4eb-cd7d9e1dd840", "comment": "Malware payload", "value": "e64053dd9cc18d13a6def194c02e772e6e7120a6dabbd6f45c6fd9b3e40bb65c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902912, "uuid": "0b5f9d38-9ba1-4ead-b619-6ea71b0617f4", "comment": "Malware payload", "value": "ae407deaa1287da67c9aa13b7fd6a8030160ded9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652902912, "uuid": "4492faa7-53de-4241-9876-bf5cf44f482b", "comment": "Malware payload", "value": "30ba7ff252febd28764ba03431b10c59ef615ada4a111db4fc4865bea61ffbeadbab7ab35b02f2ba2a0ee101e6224a34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902912, "uuid": "18ed4d81-34e1-4ad1-b2a2-2e66c2fdcd3a", "value": "T1A005283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902912, "uuid": "a4c7ba97-2cf3-485e-b124-ef205b33481d", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902912, "uuid": "2a7bb306-cf8f-44e5-ad53-7af57b0bc73f", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7ympE3:BTg9UXRD2SeqfZZiWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652902912, "uuid": "70abac7c-10ce-4049-a5f9-7b01208ec988", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652902912, "uuid": "aa8ea8c2-190c-4732-a8db-e23bc392fddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652902912, "uuid": "24e1b8cc-a646-4037-93f8-44f8389e23f6", "value": "0092efd3db1cc4391c7553b7e2101ac3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc5603b-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908998, "uuid": "9933b6ff-cdc7-4e74-ba71-662e72780ab7", "comment": "Malware payload", "value": "9ec40e449e3d00fb8864b99ba479d99e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908998, "uuid": "893f1d2a-43b5-4891-9d37-73169df1c941", "comment": "Malware payload", "value": "e656a136c1250479e481aa67d2d484091ed104f98ca62fcef419d64364364d8c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908998, "uuid": "986ddc93-1c19-4827-b237-4dfbe5a4ace7", "comment": "Malware payload", "value": "8fb080fb2704f3ca8ebe23b839e679cb398f0c65", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908998, "uuid": "b12bf83b-c8bd-401c-9eda-a41d1c0b7438", "comment": "Malware payload", "value": "17b6c44ee6a06e0d4b327f388578bae6ce29d91006da0cfed7bce55c2afa5d46ac3a4c54354f2e854c6c268c52daeaeb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908998, "uuid": "f99cb5d7-a64f-474a-a1e7-6ab2b2a37494", "value": "T175A1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908998, "uuid": "12e6dba0-9cee-48be-a49c-e97f018be613", "value": "96:nRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:nRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908998, "uuid": "a890af6a-0a41-4699-80e7-4cc8726324b7", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908998, "uuid": "c4721bb3-45cd-46f4-8b81-726af2eafb0d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908998, "uuid": "7aab16e9-421b-4917-8a82-d9f16c77590f", "value": "e656a136c1250479e481aa67d2d484091ed104f98ca62fcef419d64364364d8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5087a61-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909093, "uuid": "53359104-e693-4fce-8ef9-a8bcc7aeb262", "comment": "Malware payload", "value": "fdaed60d685faa8eb3250cec93be67c8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909093, "uuid": "7adc27c9-4cb3-4f19-8b14-f16960cdc2f5", "comment": "Malware payload", "value": "e6b4c39f90f92873558201c2bfc48c270e044d2be146c349efe19d548624158f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909093, "uuid": "c921986b-b04a-4edb-9903-7b8df93c1cb1", "comment": "Malware payload", "value": "2d8e1593688aa9c4f008d3e7d4b10d88c5e29e48", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909093, "uuid": "32b0da92-bf85-4ee1-a07e-a7f594461b6a", "comment": "Malware payload", "value": "3964e3ad3a673c9d70446a57ea738728c8cf3b4eee1967dc75ba85582116b7ca362e609e54aa1104c5a11a6f10d25919", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909093, "uuid": "45bcf3e4-1f68-4660-8a7f-539ae8a4ac49", "value": "T1FDA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909093, "uuid": "4f62ea75-a176-4b1d-acb4-d57d815a2905", "value": "96:6RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:6RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909093, "uuid": "2357be11-51cf-4169-86f9-acc4a4dae385", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909093, "uuid": "d4597d42-daab-4ad9-b316-5de2f78b4e4b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909093, "uuid": "b8a36e85-3979-4bd9-8e3c-8d0f02719376", "value": "e6b4c39f90f92873558201c2bfc48c270e044d2be146c349efe19d548624158f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed22d7df-d6d3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652896624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896624, "uuid": "ddcbd977-0a3f-436c-ba0f-67b8e17bc7bb", "comment": "Malware payload", "value": "f2a5f5d7c7f5a9fbc12ce6981278ad13", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896624, "uuid": "0932e05e-1da2-4ba9-b40f-b468de4f8ada", "comment": "Malware payload", "value": "e7aea49b6af071188408c3eda80f2c5a53cbab1ceecbbd4f433e441858ac96c1", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896624, "uuid": "f290d758-ccdd-4bf6-a1fb-31d66c4d611e", "comment": "Malware payload", "value": "1dfb9bb13157bffeebff087ffc5967eda50e0030", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896624, "uuid": "8b1b4ff6-d2bb-4f65-b9d3-fe5c2f7ced20", "comment": "Malware payload", "value": "838b7f40b5c9e2a78768012c0ab4bcc7a135dcd26d958867354574f84e8ba5eb585d99533774b4594150e21f045c1644", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896624, "uuid": "b5cd1d88-c03a-4b76-9284-5ff1fa32eefa", "value": "T1BC24125C390086EEDF8AE136EA27CF1F8806BF58DD1A178536DA720CD0790D884766F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896624, "uuid": "5f6809a8-15ca-4cdc-a6a6-b83b2f7d8382", "value": "6144:mYvJO5U9OmulQITlSX7hddI438Dl2FG/YEIx:TJO+9jJIpSX7zdjtFG/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896624, "uuid": "abf0b5a6-1cf2-4f0a-b290-fa6693e3870e", "value": 229000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896624, "uuid": "752a6a89-d0cb-45ca-92c5-aa179937a065", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896624, "uuid": "2f1097d4-406e-4ea2-a5af-1699fadb4abe", "value": "BANKING DETAILS(1).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0830c31b-d670-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652853720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652853720, "uuid": "6cb362fe-4095-4a02-b20d-0b3d3ad2738d", "comment": "Malware payload (GuLoader)", "value": "3432fc2ed84456c95816cdc6b5ee674d", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652853720, "uuid": "3928ac99-7a48-4113-b128-12956b59ce90", "comment": "Malware payload (GuLoader)", "value": "e7e71fa866ba62d702c610faec93f3618e3af846f9244b11ba3bba3179b58ce8", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652853720, "uuid": "5cb1672a-23c7-49f8-bb2d-92006c414d19", "comment": "Malware payload (GuLoader)", "value": "b1fb9cadf5ed5a27b9ee05ac796c6c4e7e29667e", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652853720, "uuid": "c467cc3b-1279-475f-b76d-b31b439506e0", "comment": "Malware payload (GuLoader)", "value": "4f544ce9c8a04124cc5c053e92ad14b2ef0e35aa7b3962e31cde6c0b729096c6483a0faedc76c96cafd6a1cad33fdf78", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652853720, "uuid": "32639b13-d392-4652-bac4-96e17ce4691f", "value": "T1EB34655185B1EFC8D2F9399FCB0D0621B3028DA9A2E3F55C5BA101BD7FC36D643262A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652853720, "uuid": "b076b0db-eac8-4973-a881-6f9ec8272145", "value": "1536:VxLZWZ8YK09e/AVYziTLwO79KDBc4/Fy9Voj9q99MZkRUmQascFShGpdKSr7ueq:VZZW+d6cAVYkwyEvsywQjX6cy7ueq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652853720, "uuid": "41e16ebb-b73b-402c-94b2-1742e9ae0947", "value": 241827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652853720, "uuid": "646367bd-bbb6-46f4-949f-35defc331786", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652853720, "uuid": "a6c7946c-9b5a-459b-a029-1bd34007c6b0", "value": "doc_69551647960-81405209588.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d7fc0a-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908962, "uuid": "d82f1dda-2e19-4f49-ab7c-3e8d6690c85f", "comment": "Malware payload", "value": "c6b6fc2c10e574df4245fd5cb9259b31", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908962, "uuid": "8446219f-aa31-414c-a5bc-cb857f98f6dc", "comment": "Malware payload", "value": "e8481c3a1556ff2229286c6ba5ed55d136dc18c6bb67a68a4ca4bdb82af217de", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908962, "uuid": "341fcdf0-e912-45cf-b6bd-0b10d3793c14", "comment": "Malware payload", "value": "69c9b90e0e7faa68a236bce25050e5200d031e29", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908962, "uuid": "a903f216-f41c-46a6-9b1e-595c55e860fa", "comment": "Malware payload", "value": "2f5a8af31a812425de227c9132f93c9024b323212331e1105eff6bb904a3801741fc5e2fe13a3194fe52ed0bb0e45e88", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908962, "uuid": "9babd07b-1f77-4a46-990d-f1b28e920742", "value": "T1564144D50302C5722D96997771BA0806F1CAD19D64DD2F88EEEC39F954CDD487493B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908962, "uuid": "c3e9de1b-5627-4bee-b7d5-b5da56e78214", "value": "48:vMYMY4UMY/YqUMYMhY+KWUMYQYNKqAUMYhYmUMYiYOUMY7YOUMYJYGUMYgYqUMYP:vMYMY4UMY/YqUMYwYjWUMYQYgqAUMYho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908962, "uuid": "dab3346f-518d-4dae-b3b3-b47cbb230d6a", "value": 1933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908962, "uuid": "bcb3da8a-6e75-4579-a566-642f153026d6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908962, "uuid": "c5f2c1d1-98f8-4c3e-bf76-6fe01ff63c16", "value": "e8481c3a1556ff2229286c6ba5ed55d136dc18c6bb67a68a4ca4bdb82af217de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a316dded-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908955, "uuid": "e41e9dc6-4a84-492d-be26-ac0db536b2d9", "comment": "Malware payload", "value": "c7866a6bf93fe47bb819d8f5d379e353", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908955, "uuid": "8d0de05e-f8e7-4b6d-a213-103258cdd97f", "comment": "Malware payload", "value": "e8527836291246c811470f46bcb9e3785b01d89f842e64d67f778b194a049c1f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908955, "uuid": "69765f84-1139-4c2f-889f-6339eca9a382", "comment": "Malware payload", "value": "757fb6c3a1aa19e129b3ea3fef1da5bcfe70e55c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908955, "uuid": "96a94258-d44e-4b48-8e2d-f17ffe1bfcef", "comment": "Malware payload", "value": "337961d36bfc9909aae8141ce783e7123f892a7cfa0cd9a6ea36c0458f7510afcbe722279bd29c1a02976766adb52933", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908955, "uuid": "65f24838-ce61-487b-baad-fec08109f98c", "value": "T1674154D512910BFA6ED9B921B2B50114F48091E529C82DC5E3EF2AB7B94CDC47180F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908955, "uuid": "53a3dae4-2719-40f5-8e0c-80663054c9d7", "value": "48:vCqX4qXeCqXfqXPoCqXa3qX+CqXheqXhVZ0hCqXhvqXheHCqXhwqXhpGCqXhJqXS:vCqX4qXeCqXfqXQCqXAqX+CqXgqX+hCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908955, "uuid": "4463a480-a991-41db-9073-0363e38ae850", "value": 2083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908955, "uuid": "f99476df-2fd0-4956-9305-96493abddd6f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908955, "uuid": "54dee1aa-557b-4aee-8cfb-82a0ec67b37b", "value": "e8527836291246c811470f46bcb9e3785b01d89f842e64d67f778b194a049c1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d813597-d6cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652894773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894773, "uuid": "e214c254-67fe-40a0-9f5d-81a59e616c92", "comment": "Malware payload (Quakbot)", "value": "392a95f6cb028405f06186bb5a545970", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894773, "uuid": "b6543a07-c005-48c9-87db-09aef588efa9", "comment": "Malware payload (Quakbot)", "value": "e8c5d670a76219016a793eb9e28b06a77eee9a60b2cca4b7570e798488e0522b", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894773, "uuid": "e4e15583-d01d-4d4a-8f3d-38cf1a1c8b61", "comment": "Malware payload (Quakbot)", "value": "beb8da7e4f84506aa56cb2187868d555bd749693", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652894773, "uuid": "97dbd806-53fe-4bde-a3f7-62385b1d15ab", "comment": "Malware payload (Quakbot)", "value": "dc76ed5fc69b5be7891de33cfe0e99c9fe6ddd4bb20cce608921ea8e880c6319ee7aaad4b113c039fdebd2bc95ca65ba", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652894773, "uuid": "6374199c-88cc-46be-808c-0009091db692", "value": "T176D4AF22E3F04833D173167D8D6B676C982ABE513D389DC66BE41E4C5F392813A26397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652894773, "uuid": "4ddfb507-a9ea-4a88-99d5-b427bf6591e2", "value": "ff450e39c2143a90380d4f56a4259383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652894773, "uuid": "9f98f11e-77a0-42d0-b9b4-34ba45c46a12", "value": "12288:SHppWamOEUPrsLSyyGq5FXllT1/BI8VwSi9NJIksifQuVS:wsdeQLSAi1qMi9TgiJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652894773, "uuid": "31df6df7-edbb-42b3-b84d-e0530364971c", "value": 631671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652894773, "uuid": "814c8ec0-1c6a-4d0e-bc8d-ad2b1bd5492e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652894773, "uuid": "d9d943e1-cf82-49bd-992e-39ce30372334", "value": "e8c5d670a76219016a793eb9e28b06a77eee9a60b2cca4b7570e798488e0522b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b882053e-d654-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841990, "uuid": "b62b086a-756b-464b-8609-72dab12c8a5a", "comment": "Malware payload (Heodo)", "value": "3733d83103335132d1e99acbaff5b390", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841990, "uuid": "d0d3b288-d8da-4685-9d42-bfe6546f3bc4", "comment": "Malware payload (Heodo)", "value": "e90ff8b3eadc5541ed597f590c059e3869d6610751616f6ffa3e72ed8e15748f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841990, "uuid": "d7c0df6e-6390-45b8-bac8-bf8d11f50eb0", "comment": "Malware payload (Heodo)", "value": "76901d5bfdbe223c2fe020894d7de27d393b030e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841990, "uuid": "7ff4bba9-2db4-441c-8d93-a7ee1f374d22", "comment": "Malware payload (Heodo)", "value": "a8acb3ff6980baecaebf82ffb8a43d0ef03c820312b7399237d59c782be3be859d70bc73b6e80ec4788de56141dd9536", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841990, "uuid": "31d508a5-ec87-4457-a415-0dd86854a549", "value": "T138A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841990, "uuid": "427bb6d0-e610-4392-9fc7-4777aedeee10", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841990, "uuid": "1c8ddd24-0348-4119-81d5-a5f66864d6c9", "value": "12288:uS4BnAed8BK2o0a4a5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKza34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841990, "uuid": "29087959-e75e-402a-9c18-eaa56be75508", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841990, "uuid": "de9ff57b-3e2a-48ed-b0d6-a4d18dd378cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841990, "uuid": "acc8623c-cda6-4a7b-99de-883d698f7ad7", "value": "3733d83103335132d1e99acbaff5b390", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74bf7db2-d65a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652844453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844453, "uuid": "d3a1bad2-6e1a-4dd9-9cda-bca18c62af56", "comment": "Malware payload (Heodo)", "value": "b8930b54cc1c4349ad790f35e8af6e2e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844453, "uuid": "0a5fd7e2-6c5c-430e-889f-beacf3104dcb", "comment": "Malware payload (Heodo)", "value": "e9a025a436d5e31580e0bfabc20457464331054503fdd9dfd58ac4780ac928e9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844453, "uuid": "d71b052e-b7f7-4456-83ca-33627f6475e3", "comment": "Malware payload (Heodo)", "value": "f8c5574ca7f1939b803a295a638f361057834c26", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844453, "uuid": "31ee619c-5d96-425d-b04b-3c4525a790b8", "comment": "Malware payload (Heodo)", "value": "fcba72696dce0165d22893fe0a51b97d97a0c7694f8f18c8a03a021b0d709e08bc83735e74a142fa743f2a3500887dc9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844453, "uuid": "380c8e78-f876-43e2-9926-931c355e97b0", "value": "T18EA48B4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844453, "uuid": "254d08a4-6bd2-4500-9d5b-badf768f63a6", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844453, "uuid": "06a230d3-ddf3-4fbb-a2a8-f72fe24d422d", "value": "12288:uS4BnAed8BK2o0afa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKma34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652844453, "uuid": "f547c0fb-97e9-431e-bcfd-afaa1f5a0140", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652844453, "uuid": "3055f28f-38c9-4122-975c-33df6707138a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844453, "uuid": "a3d9f090-e63e-4563-90b0-36b929e27536", "value": "b8930b54cc1c4349ad790f35e8af6e2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8992028c-d6b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652884431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884431, "uuid": "c84e8629-5652-4e36-bbf6-600a8e6be50f", "comment": "Malware payload (AgentTesla)", "value": "55d8a0869cafd95a1c004e78e1de3c7d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884431, "uuid": "aa68955f-5630-49c4-94ae-a8f044918e6f", "comment": "Malware payload (AgentTesla)", "value": "ea036e229b606c5ba247854bd37c2dba7ea2c244ea587053d534b352c5058336", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884431, "uuid": "1da1c770-b5d2-4a7a-920c-c9cf3ada6aa5", "comment": "Malware payload (AgentTesla)", "value": "f6e0328447a0bb5fcaf6c0c6b23d630372579b22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652884431, "uuid": "ea228f51-3a7a-42cb-8ad2-37a8d5cb81cc", "comment": "Malware payload (AgentTesla)", "value": "ec733c03c5a8935f3bd1d29b565f81cddc361783623c954d3866aee7fc96e6abce707fdb489993d04f0e5049041847af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884431, "uuid": "df18176a-6b30-4833-8418-33ed27f7c6f5", "value": "T10913A5437F1B4875E7948A3BC9AB92412770975AB337C69D3C463319E8A279BCE0A5C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884431, "uuid": "d044f788-2f53-46e9-9a0a-759ae37edd59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884431, "uuid": "9f9f516f-7cae-460d-8578-3ef83b3ba7ae", "value": "768:3IGNbHg31bGMcF4omWDSi33ozeA3teuytYKey:Z9MG4WDX389eR+KX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652884431, "uuid": "337ec97d-8bb6-4475-9d7c-27d184cb63c6", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652884431, "uuid": "938a3d78-aeeb-438d-9207-efc5411345a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652884431, "uuid": "5b391dd4-2567-4916-a492-5ffa48ca5e76", "value": "SecuriteInfo.com.W32.AIDetectNet.01.25927.24182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2528a8b-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909088, "uuid": "63f91ab6-d291-4334-8cd4-1f0670d2d928", "comment": "Malware payload", "value": "c4f959b0811f6aa1b8b62258b969349c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909088, "uuid": "b5292a4c-9683-4eed-90a5-f7135c0c1788", "comment": "Malware payload", "value": "ea140785ce8121e4ae6a0299e59347d82dbb4cb05c7946c0c90eeced40a8b288", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909088, "uuid": "fe7df136-b9d9-4193-b5ea-aec03714afdf", "comment": "Malware payload", "value": "00d59c42d0f5621380482105db7e58f1ee5685fe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909088, "uuid": "b989a35f-854f-4186-a3c4-964e3a9bd745", "comment": "Malware payload", "value": "d75c797a39d752c2de938ba65104cc3a62b123f82ace7a8f2dee843b0eaf42985e7f5f3ae4d4ede68474236ba5c00934", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909088, "uuid": "1b29ccfc-d71d-4d25-b0b3-b953f69a62e0", "value": "T19D41A1D6B09104B47C5294B7B379AE103598A39D64C57F4F7BEC38E5088CEB9B832682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909088, "uuid": "dbe046df-5e8a-46a1-a10c-ce89cef8aa9c", "value": "48:vr0th4t/rIaLaMalsrCHdHp4H/3r5c9orbQfEruja17rcfQ9rolkXrRA/Fir/szH:v4th4t/MaLaMalscdpe/9c9ofQfEajaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909088, "uuid": "a8237e17-d1fa-4fe5-bf7a-813e255b6903", "value": 1994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909088, "uuid": "7ace78fe-a75a-480e-9dee-fed9169f6795", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909088, "uuid": "665e3431-d567-4efb-b89a-12b9ddca4cd5", "value": "ea140785ce8121e4ae6a0299e59347d82dbb4cb05c7946c0c90eeced40a8b288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90afe2b6-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908924, "uuid": "d26f09ec-1e87-40ec-bb52-6ff4992db607", "comment": "Malware payload", "value": "04fa3eb2ee9bfc264aace87f08bd6082", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908924, "uuid": "64b919e1-736e-4b9b-93b9-dccebf1f88a3", "comment": "Malware payload", "value": "ea5204a03cf90f63bbb0a8d871417b5277dfb69fedf5749bbbc2e68289821181", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908924, "uuid": "f2e1cf48-cc5a-43fc-ac39-177c73c2b0ca", "comment": "Malware payload", "value": "5e3b409f6fd31ed1b9298928947436a715eb0da9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908924, "uuid": "f8b54af3-f57a-440e-91d9-9317cae75fd7", "comment": "Malware payload", "value": "e765c9877815aa00843c9bc3de3a7280776930a3a9460b6316233e382bd843b50d5f1188f11b737e44b1bbe83b1e2fc8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908924, "uuid": "7368045f-e491-4354-b98c-7caba9140b55", "value": "T13651B18A227143743E657CB2F1E5491235D0E0A998C17E566FDC38F5C8FCE5036AAF52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908924, "uuid": "cf084b06-dd6a-46cd-88ae-a6e237c09f45", "value": "24:vZfXsZ818b8ZqiV3TaJZDLolZ0moLZki9KNksZ9M9shUZ4jZDOZSrnZpKZRcDZ8k:va+S4AgTAtslJoLQNJToshUOAW+wDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908924, "uuid": "e4d56293-ae02-4253-9273-acd6804af9ef", "value": 2622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908924, "uuid": "f008f04b-f074-49fa-83e9-12a5109b9f8f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908924, "uuid": "52d342e6-ea90-4112-99bd-e61ae21aa927", "value": "ea5204a03cf90f63bbb0a8d871417b5277dfb69fedf5749bbbc2e68289821181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9414e8fd-d65a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652844506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844506, "uuid": "9f1d5a1e-1945-4b48-9fc4-92e22ce8995a", "comment": "Malware payload (Heodo)", "value": "96e097a899a4b8a19ab4e15aae4f267a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844506, "uuid": "7033dbaa-a153-4192-80cf-022efdba8dbe", "comment": "Malware payload (Heodo)", "value": "ea808b7cd000f3c6237f1074d7dc5175398cae7b1725d8ebdc9f712cbf91a8d2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844506, "uuid": "b6a205f1-9329-45c7-a856-ace93fdbd7d8", "comment": "Malware payload (Heodo)", "value": "b36422940d0f7e051bbe09a5214c9d25600aefab", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844506, "uuid": "42e3842e-82b6-46ae-969a-7691f8df79bd", "comment": "Malware payload (Heodo)", "value": "be07a3f809a853a7a67a0b04c1613934d5577369d86e20b85908d097ef7cd0ea8806fb6e1457a71240e3c209338f486a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844506, "uuid": "c7eeea77-51be-4f50-a64c-5b6d869c9549", "value": "T12D94CF1572A50CBAEC779239C9434A06E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844506, "uuid": "076c28b7-9a04-4283-80bf-e5203ae24589", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844506, "uuid": "5c3ae4c0-97f5-41af-9a2a-d6cc01f60552", "value": "12288:M3hV6Pw4aT23s2obd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ai3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652844506, "uuid": "ed737f6e-a329-4e62-8603-31de92b8095b", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652844506, "uuid": "58f487ab-830b-47b0-8b81-b1b8ac4562d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844506, "uuid": "3821fa4d-1446-4d0c-8ee6-d5ef3bbd28e5", "value": "96e097a899a4b8a19ab4e15aae4f267a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa1413f-d6d5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652897138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897138, "uuid": "b6c5ef0d-4155-4e0d-bf45-855c88870316", "comment": "Malware payload", "value": "deb546428871188c27f77c7f3f509f2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897138, "uuid": "4229c3a7-44ce-4d4d-be12-0374e908eb64", "comment": "Malware payload", "value": "ea8543ab2c443b999af41fa3d7f912ebf4febe1eeae1f8a36e927705fa841886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897138, "uuid": "051a0389-8d62-4447-8666-e6177518f7a2", "comment": "Malware payload", "value": "2adfc43e8ec34eee18802067208717100d0d4a94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897138, "uuid": "f0822787-0cd9-4d8a-8091-fb30ffacbc14", "comment": "Malware payload", "value": "b5b144221bab0b251dbf96d7081da249b540a1a941c6d38b66699bbf4f1f621caafb94285dee48d07dc0394fe8da2182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897138, "uuid": "10498441-6e0e-4bcf-b623-a91fca3dafb1", "value": "T1C405273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897138, "uuid": "9e29fa87-f0bd-43ce-8aee-2a54018b623e", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897138, "uuid": "44da5e1f-fa2b-495d-b15b-f06ba27d4cca", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oAaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7mUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652897138, "uuid": "aa155229-96be-418d-99b5-c15336e3e8a8", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652897138, "uuid": "87c7f90f-0218-4583-ac10-af66ed7e7f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897138, "uuid": "0313c25c-64aa-4793-bd08-db30188329d9", "value": "deb546428871188c27f77c7f3f509f2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f7ab6f-d6da-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652899479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899479, "uuid": "4aba0c1f-2a43-4e63-8738-92df78f268b6", "comment": "Malware payload", "value": "0908d567e0bcbd6c1c774fe5cf6408a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899479, "uuid": "7dfda3b6-532b-47cf-bcce-f41e4331a394", "comment": "Malware payload", "value": "eac3905ad73fd40904c78250a66f960fd1814e3d0abc10301f13f6e17bb079ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899479, "uuid": "c1d03751-53a8-431f-bd06-a8e1dec3a3bf", "comment": "Malware payload", "value": "742ae3df153ce4ce4e10cc7a1f2ac072d8bacc43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899479, "uuid": "a48a4853-5de4-4d1d-82d5-0c7603b920c5", "comment": "Malware payload", "value": "dcb9aaa433dcbe0f7b5ee6a05a9aced807cc434129d2cbbdc58a705c50a5c979e19132f75a241f4fcbf74487e16feb39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899479, "uuid": "462bff94-dd22-46fc-9413-bb415e527c60", "value": "T11915CF5C3650F99FC4578E36D8A41CA0A660BC67970BE307A047399DAD3E79ACF106B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899479, "uuid": "0fdfd8e5-633d-4c05-9df3-830f30241233", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899479, "uuid": "1ef7e2d6-b79b-4edb-9a36-fa2a9bc9388e", "value": "12288:W/moESDw4VO/HmAnOJve+LPKFBlj+qDiwe6WGIkywYrvqLSQPEROV0dSRjCrITLe:WfVO/7ClKQqD7/IlwmviE80dz0Th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652899479, "uuid": "d3bbe15b-c643-4eb0-b41c-be741ee6c19f", "value": 937472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652899479, "uuid": "466f0ffc-7fde-4f19-8c0f-ca0627adf202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899479, "uuid": "9d67078a-4864-463e-b1b8-4db85a96c8f0", "value": "SecuriteInfo.com.W32.AIDetectNet.01.22666.11344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3744bdc7-d674-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652855517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855517, "uuid": "947c1934-1f0a-4110-9411-b9c71794b5a3", "comment": "Malware payload (RedLineStealer)", "value": "cb4f5b131158c205eaba40892f9d23ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855517, "uuid": "76f49f3c-7274-4793-9372-1199eb84b11c", "comment": "Malware payload (RedLineStealer)", "value": "eb0db3cef92b2c3e69831542b3f7fff1f14c74e580a720a80db5ec5119bff530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855517, "uuid": "110b58d2-59ad-4ca4-a633-36f265253649", "comment": "Malware payload (RedLineStealer)", "value": "c9d3a2fdc5cec6aab8da4602c1699f43d2023393", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652855517, "uuid": "32bea7eb-e267-49f9-823a-6424f5a32ed0", "comment": "Malware payload (RedLineStealer)", "value": "8d69985b4facd7c72631f339b38aaa7999180869a73af1ef8f3d6302b6c8cd940210cf531e821d1b30d38e0007bbee51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855517, "uuid": "61d3d2ba-9eaa-447f-8577-cba99078b65d", "value": "T1B1A4F110F790E836E0911E349472DBB2573BB4322631A94BFB906B9F1E733915AB6707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855517, "uuid": "28ee9915-6e86-417f-9564-929b905a000e", "value": "0d686c4364bc2c7f3a384024716d37bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855517, "uuid": "6a52607e-69d7-4eb3-b7dd-505dc8742b73", "value": "6144:YkMdILcMuZOdWMa5hpLKcE6T8H73Czur7y3AyAiga3wVf+:PMdILcMuZbMal7K3RsVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652855517, "uuid": "9f85356d-d330-4d05-bd0d-f7dcb4067f7f", "value": 453120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652855517, "uuid": "1e87c33c-e876-42b7-9238-f1f5fff48d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652855517, "uuid": "f8822f9c-9d47-43e6-b273-01f620794f16", "value": "cb4f5b131158c205eaba40892f9d23ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3c289a-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908949, "uuid": "d5ec079b-067e-49b4-b370-477db2a830c9", "comment": "Malware payload", "value": "b7ecb81273eabd2344561312a1c60ad3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908949, "uuid": "5096c573-10af-425d-8fc7-11fb9f4480f1", "comment": "Malware payload", "value": "eb514fd0803c2ccbfeaa3389be629abe7822235c4021c1c000786f06202139ce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908949, "uuid": "39ec35ac-abeb-4479-b9b7-4e30507f935c", "comment": "Malware payload", "value": "141b38f4a92c1272feb69e20ee09d4df7c5e6e17", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908949, "uuid": "64eab4ec-3f38-4b17-98d1-4ed263a94ef6", "comment": "Malware payload", "value": "36b7b5e61f8d1894b2f9701945305d78bac19829aa3384a7f16626b00a247c74ade90da80424b2d5ac1897e5a7d8fe53", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908949, "uuid": "c4b2d71e-4f10-454c-b956-d131cc89695e", "value": "T1D0A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908949, "uuid": "5dbc4ed8-06e1-4087-863f-1e28a41ac900", "value": "96:QdRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:QdRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908949, "uuid": "8b02701e-3b7e-46bb-b022-bb79e1806e28", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908949, "uuid": "109ac87d-d9a9-4958-b46d-ffa74a9ac8ca", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908949, "uuid": "f64f6ad5-80ed-4006-b2e3-556897c478ec", "value": "eb514fd0803c2ccbfeaa3389be629abe7822235c4021c1c000786f06202139ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7f87af-d69a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652871843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871843, "uuid": "9a892229-b2ea-4188-b258-994718dfda57", "comment": "Malware payload", "value": "08aeff698aeedbe11aeba2107f9e33bc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871843, "uuid": "486252bd-d603-48fc-93b7-b3e50bd21caf", "comment": "Malware payload", "value": "eb57c81f26966cf594e60d5dea4ed16640dccacdab3adb11126273017b30b3c2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871843, "uuid": "e38f26fe-0323-43da-a785-7d50ca11b176", "comment": "Malware payload", "value": "e1ca34ae01d33f94ae4f44da8941f9ad8eed3c08", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652871843, "uuid": "3165796a-c79f-434b-adda-d10c7028315a", "comment": "Malware payload", "value": "147325969e8fd16ad60cbd7f2db9b743fce5b0488eddfc202b41117bba3fb49e95f4f390e395c7bf7e3733a80ad0f71a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871843, "uuid": "cbb2a3b0-f551-4ade-928b-fd45e0ac01bf", "value": "T13C63C489830BD36FA45F18EFEC4A595323E50E26E8FD4185D3F8049E2ABE55E64E014F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871843, "uuid": "91b9c47a-b375-4875-92f9-98cc1f323446", "value": "1536:ae9x15ppeyORyOwaZhDAIycT2CpAV1QGHJ:/5pp4oOBDAIGRHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652871843, "uuid": "af148152-850c-4803-84c2-ad4f6f8e7c3f", "value": 72472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652871843, "uuid": "b6fdfe50-3712-4b42-98fc-b272dd5a1cde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652871843, "uuid": "b61ab08c-d1ef-4f53-b97c-1905454479c1", "value": "54wwvqxwdp.PS1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6639011-d695-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652869904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869904, "uuid": "eebe59a3-4d50-4a64-a015-4ffe4d49662b", "comment": "Malware payload", "value": "e5598e4d7b60d10c8b5449188fa13c8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869904, "uuid": "14e49128-0923-4924-b77c-4ae584bdb066", "comment": "Malware payload", "value": "eba009319ed5e3e7a1350fc1464cc99aafb6405f0db3385c080cd0db10ce97c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869904, "uuid": "97585cde-406e-4eae-ad46-b74d9785bff1", "comment": "Malware payload", "value": "0d1d2108daa8f35348a632e7f41b6d979bb80e97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869904, "uuid": "ac6543be-8779-45a0-8026-a7a3bea7ecb3", "comment": "Malware payload", "value": "8f0bfa8c63ac4d871e9ee7e2dc6016bf13dbe36ddf9b88cc009f11cfd05192f80d923971481db100dd0f876ee68639ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869904, "uuid": "adc68d34-b7ea-4f69-a10f-fb910167e505", "value": "T1D0A50309A147E27BFCED18B3095081D0C29C7FAA7B528DCDE93AD686140F542F7B6D86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869904, "uuid": "d8819673-5f1f-4d1f-95e6-d54c0041e0ff", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869904, "uuid": "14851dcd-78c6-4eaf-85dd-7c228fdaa2aa", "value": "24576:VJr8tEZgHqfQYQVw178cEM+qtHQMdHgL+czmjHd+/Jb/k:VJ4o6Vi9E72HQ4czmjHQVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652869904, "uuid": "1be09ce0-e292-4f32-97ed-5d21a98caa98", "value": 2063889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652869904, "uuid": "a310a8cc-2d0f-4698-8a83-843870fb60e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869904, "uuid": "e355289f-c5f5-49a1-a6e1-623e0dff7b25", "value": "e5598e4d7b60d10c8b5449188fa13c8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc43592d-d658-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652843714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843714, "uuid": "3297f447-a6bb-4d4c-b23f-a9996142d5c5", "comment": "Malware payload (Heodo)", "value": "923894bb10ee04c4e96a0f970004c720", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843714, "uuid": "318a5329-4048-4636-b7dc-f672ebd5761f", "comment": "Malware payload (Heodo)", "value": "ebe6fde3d59ab74a2497617cc07464bc5e3c340d0ac86c2e9299808f981559b1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843714, "uuid": "792ffaa8-498a-4f34-94c3-5890802091d7", "comment": "Malware payload (Heodo)", "value": "cb38e70baca2b7e6763b2051a8bca8ce01740c74", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652843714, "uuid": "d7766851-fa90-4a35-a6f2-2b6709d8c4ca", "comment": "Malware payload (Heodo)", "value": "be3dd0ba45ea6daaeacb11151c929c7c066605af3052f93973762053ad6e524d2bc831df595fcdcd13ef640bc17c8f6d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843714, "uuid": "d10bbe1c-b123-447a-a983-027fb146bbba", "value": "T1CD94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04766DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843714, "uuid": "b79ef352-448f-4191-832c-fb5e119bfef3", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843714, "uuid": "401b1eb4-a2a0-4702-94d6-a180d0be09a9", "value": "12288:M3hV6Pw4aT23s2oHd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Wi3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652843714, "uuid": "07992c58-d25c-4644-93cd-8abb3b618e37", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652843714, "uuid": "7dae4b96-5885-40a1-bfcb-c80e197439cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652843714, "uuid": "d1c1aca7-cc31-4f82-b810-c9d50a6e5b71", "value": "923894bb10ee04c4e96a0f970004c720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973744af-d6db-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652899916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899916, "uuid": "0e665870-e2b9-42ff-9f9a-d93dde3d556b", "comment": "Malware payload (Mirai)", "value": "d1a38e34a9e9dd85a6db706b31bba24b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899916, "uuid": "efbf2771-98b9-4608-828e-0af2dd8382f2", "comment": "Malware payload (Mirai)", "value": "ec8411e6d749d2b631404810e79c84cf092ad3ffdd71c6dcf05fd01bf86d9303", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899916, "uuid": "8ac3876e-d2c1-4649-8ffe-b59e2125026a", "comment": "Malware payload (Mirai)", "value": "4c11e2ed77f2d943d0b0e23ac2be68f471ebacff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652899916, "uuid": "7e8222b5-3905-4043-bb92-64d1bc5271ac", "comment": "Malware payload (Mirai)", "value": "88673719ea84524239d83ecf2816e43a1264f9a24e46041514199f554002a0f71eedcf778eb3c0e63c3822dbf1bf166b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899916, "uuid": "33693d8d-86c4-41bb-847b-eb8f6236ebd9", "value": "T12923940B3E658FEDF76D863487B78D21A748338226E5DA84D15CED005F6024EA41FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899916, "uuid": "d5ec858e-65c2-49ef-80ce-15d8633191cf", "value": "768:J/h8/rNMNcN1amamwEGX2mPqgZ1eb5f7K4S7t9ruhbz/gb1bdhb3hbabQb0KkQrg:kDOONF/io5DKprudfYLnmCg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652899916, "uuid": "f212da0b-e017-420f-86d3-337635570050", "value": 48532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652899916, "uuid": "9f4aeb11-40f7-4c7a-9c55-e394a4da7883", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652899916, "uuid": "3f7a69ee-9475-46ed-a848-d765b62e1c28", "value": "d1a38e34a9e9dd85a6db706b31bba24b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a83aee1-d703-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652916913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916913, "uuid": "387e4ab4-957a-4c82-9146-8362c0e10096", "comment": "Malware payload (Mirai)", "value": "254e0afdbee16ddd05f436087a7d8281", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916913, "uuid": "9f3d6b76-626a-484b-9361-26a68919f1db", "comment": "Malware payload (Mirai)", "value": "ecff025c5d931ec08563d47abeff44ae043d02e21ce0467cfc1505ede76a6d38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916913, "uuid": "08b7ada7-0112-4c3b-b75d-58ae9754b4b0", "comment": "Malware payload (Mirai)", "value": "55c7afcf94ff978dc66f717050710f4b7bba1e29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652916913, "uuid": "f58aad62-55b5-44ae-9c8b-23b48cd8a94a", "comment": "Malware payload (Mirai)", "value": "638b8e1cec0c5d7cbf60ab3baa8d36043350f69a670d1d795d41d0ae01898cabbf1d697cbba19953a13a1f29e8e8bcc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916913, "uuid": "44787b45-5eee-4e8e-8691-a609be2f36c6", "value": "T17E535A21BDBA2A27C0D0A57A61FB8765B5F503CE26A4CA1E3D720F4EFF215405603AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916913, "uuid": "12cd58be-d882-40b4-ab86-f7bbba355310", "value": "768:QroKQQs8sVWgdDZweJ6ls0m7hCGB0irtLeASpFpcVqO+A7gnCgN:QrcQnsVWgdDZwm4FC/B0i44V4ANe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652916913, "uuid": "2da58f3c-bec1-482d-81ac-3e862c33ee6b", "value": 63936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652916913, "uuid": "81b053a9-412d-4ff5-9c77-12448862bde4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652916913, "uuid": "284359e2-43cb-408f-a3e1-f24b314eaedc", "value": "254e0afdbee16ddd05f436087a7d8281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28c1c5c-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908981, "uuid": "b6253d8d-9269-49f9-a7e6-6c68c092c12d", "comment": "Malware payload", "value": "ed9f169bd16febb771b0dcdefcfd1184", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908981, "uuid": "54a1d17e-d519-44d5-ae04-468712ec7add", "comment": "Malware payload", "value": "ed72b171a6feed898e8b449fed8445061aff5b3983c7358ed6ef3df745ddf573", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908981, "uuid": "45617fe3-455d-45a2-a660-b782216a4532", "comment": "Malware payload", "value": "f79b6bd404c02706fb47a0c6fc0b2c819e30e0d6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908981, "uuid": "508c7e03-e37d-4b85-9338-9f7bb4d31834", "comment": "Malware payload", "value": "f62120bc4d4e18219641f03e135ae0b4fc4be0951ff67268f04f3055212a4511125c94b3f8c4171eb4147898cbc24dfc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908981, "uuid": "883a9578-a61c-4ba1-b965-1103f2784363", "value": "T1C70171AE27921209B5108E1C3566FBB2D008FD9C55ED5F6DF49B4539CA847142738E4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908981, "uuid": "19eab3c0-3311-487c-ba4f-656d3ff1e603", "value": "12:56f2UAkNICqzMPIKzMSIyFiIQgd6ADjsF/FAtDBbWDsNKAWRr:04kNIN7KzMSIyFiIQgd6AXkNAZBbKUOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908981, "uuid": "6e04236d-5b48-460a-b610-4d94b2c5aa7c", "value": 788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908981, "uuid": "eca1f235-2828-40fc-b63c-6460851ef316", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908981, "uuid": "152c9014-302b-4a13-a8b8-8064872b47d9", "value": "ed72b171a6feed898e8b449fed8445061aff5b3983c7358ed6ef3df745ddf573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68330c9d-d6af-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652880939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880939, "uuid": "699839f4-bb34-4fb2-a629-3a202edcd056", "comment": "Malware payload", "value": "f2447ed61f7659e73c372413e8aa442b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880939, "uuid": "1426b859-1e0d-452c-b8fa-8bd8787b5816", "comment": "Malware payload", "value": "edd1bd53700e305b3e477d2cc8e9e3cd7e06deb6ba493baed338c9e899b74d86", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880939, "uuid": "f7956303-bfd5-44df-a98f-2525ec1e420b", "comment": "Malware payload", "value": "c30e87ef35773812964d910411db7d685df792fa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652880939, "uuid": "efeada27-5e4b-447f-998a-7559304e8a2e", "comment": "Malware payload", "value": "189d1b93652d40a6f5a4e1e64c27ddc40716972bd36810822d18b0d613c1ce10e4140fe79d40e64382ebc12b69c92c1c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880939, "uuid": "75fd7a4a-7273-4364-bd04-14f031b23b0e", "value": "T19A953311ACC91FEDC77E22F5249F920C2312FC1C9725C43ABEE27676B13AA54B21D548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880939, "uuid": "fd1ee38b-1e05-42e3-b6d6-0e62b868241f", "value": "24576:kmtJbtaOFmAsjEQDTnRZ8BWltKwBKXHxbZL/FwBJlH6vIZQ/iNkKBnv/EX0Aw+6y:b7taOnsjEQHoBWqwsXxbb0HVEX0qMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652880939, "uuid": "5a69c517-9eb0-43c0-ad7d-d40aa3263388", "value": 1984000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652880939, "uuid": "41057804-b6fd-4c63-ac16-ac63a0b1a330", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652880939, "uuid": "3a411cf9-d8ae-4a65-989b-b3d563196272", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.21097.31146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9639b9a9-d654-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841932, "uuid": "cc51a36c-9894-4b23-a5ee-dd92fbddddaf", "comment": "Malware payload (Heodo)", "value": "d2efbb9fa8d9fb07f2da2124d828cc81", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841932, "uuid": "0cc774a6-b449-45f7-ad57-aa16d887bc48", "comment": "Malware payload (Heodo)", "value": "ee21ff08c2997683a39d06c1594e8b8bab1290bd8dfc6cc82cacb3f81acc5fcb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841932, "uuid": "d998be63-8fb0-4357-8c20-e6d2660d7c99", "comment": "Malware payload (Heodo)", "value": "97990f92ed0ea2c6d1b9fd8f2badeba5a3e68723", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841932, "uuid": "390b358d-a3b1-4602-8db6-4b0bb4a69622", "comment": "Malware payload (Heodo)", "value": "3787c07839c155be5957d19c13999de3e3cdcc52479ad2e24abd0c1469fe5f0558ea3cb3dc5ea3b7631eb305199b64db", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841932, "uuid": "502f0845-fc2a-4806-9ce5-a66ac8b6cd89", "value": "T163A48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841932, "uuid": "851f9464-8238-4936-bcaa-e567cb6d32c1", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841932, "uuid": "c362d50b-7e55-4623-a368-e83fff75f5e1", "value": "12288:uS4BnAed8BK2o0aSa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANK5a34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841932, "uuid": "8e243044-c8f2-4597-8ea4-4f606fe2704f", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841932, "uuid": "38575a61-1e38-48aa-89c4-06ba7883a59c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841932, "uuid": "97f8f160-aa35-4999-b503-92687dd1337a", "value": "d2efbb9fa8d9fb07f2da2124d828cc81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721ed6cc-d6d6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652897706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897706, "uuid": "c65dc205-f98e-4901-aa9d-6ff05e9d3db1", "comment": "Malware payload", "value": "57d5a8f8fdd09080d20d3e02e9b38e39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897706, "uuid": "90eac90d-9f99-4967-813f-164d4c526df5", "comment": "Malware payload", "value": "ee87094c1f1aa17c4fa85f40bcc253e02ed4b5cac439d8f5091ebfc3b4d242c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897706, "uuid": "d72ac952-02bb-4e4a-a29b-856963d85753", "comment": "Malware payload", "value": "d55a7929e08b7bb6d8c33f9b771d2e1e24dcc903", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652897706, "uuid": "dece50ba-5835-4635-b34f-6b3212192501", "comment": "Malware payload", "value": "faaf2f53a603b8a9d5722b70d9a4eb4399288c2ac3c3c53b29c4dc732e031ba6efb90737af7585f614445f7dc73a34d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897706, "uuid": "2db3cff5-02a5-4d86-9227-15b40bae25dd", "value": "T17AB423CE226C672BC63D53F629220A4963742124A4DBFB3E0CE750D55637B544AF2F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897706, "uuid": "74256fe7-6e79-40fc-a2fc-6068262761fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897706, "uuid": "9d27f357-e5a0-4a90-b3da-d0dc0c3cd551", "value": "12288:us2iN90HAM3No8jfiDZ/jBu76EocaROuSgfkUfJclf:51D2LNo87iDZ/jBk6Eoc4O/dU6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652897706, "uuid": "25ddd902-58cd-4f8f-bace-b052b03a6096", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652897706, "uuid": "35114159-bfd5-4dc5-9bcb-8e4ba709ba40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652897706, "uuid": "37eed964-5c39-46f9-94cc-33c42fe4d859", "value": "57d5a8f8fdd09080d20d3e02e9b38e39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912c6791-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908925, "uuid": "f6d679ad-164f-4e51-84d7-1a53b49bf571", "comment": "Malware payload", "value": "10f14587c00b5a54bf3e5c481feae057", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908925, "uuid": "3d16ac3e-824a-4306-a71c-56a0f7ada3e8", "comment": "Malware payload", "value": "ef519a29ac895ca7a93ce8a8fd12d051a82081752f4b33cc093c18c85371c1fa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908925, "uuid": "b1684b7f-abf0-44d0-ba1e-e9d0603d2cc2", "comment": "Malware payload", "value": "d8bd11e911d35e25aeae1cd6cefdd16269efbc9f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908925, "uuid": "676282d7-7031-4235-a0c8-d578852d76a9", "comment": "Malware payload", "value": "e95519bdb33885d9e43870e2c3756c4063430966306e450e8174b5b30ea874c8e95ec725bbf887e48bea538d8bce89ab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908925, "uuid": "e4b0d378-0e1a-4b9d-a645-12712ecd30fb", "value": "T12EE06869607C103421EB8E11FAAFC01C2664D9C780B74754BB9859358034C28C3870C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908925, "uuid": "522def75-4ae2-4f28-887d-4895e397746d", "value": "6:z3w/DLU/PuZDIdkr4znIRhLEuuTapkdCibKIYFc60rYy1K3:68a9MrALcTe0hbv6Ty1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908925, "uuid": "bca06a53-64ee-43f0-8452-b5eec9ca07ff", "value": 339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908925, "uuid": "09687440-fcf0-4c96-a743-423cf7864c8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908925, "uuid": "64763b44-38b5-4c07-8be1-a687ad03389b", "value": "ef519a29ac895ca7a93ce8a8fd12d051a82081752f4b33cc093c18c85371c1fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97ff449-d6c0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652888484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888484, "uuid": "39e11210-26c2-48b4-9404-bc272d9bf9a4", "comment": "Malware payload", "value": "bf499cce6a2a72378b8c12581f980aa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888484, "uuid": "15c38498-1814-4fff-8f0d-f8af1cab0bf8", "comment": "Malware payload", "value": "ef5c28e513a34c57422b84073a329c1395e431e036e1ff43d9b7e7de41cd25b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888484, "uuid": "61b20a6e-7bb0-4111-be11-5dc08649112b", "comment": "Malware payload", "value": "7de63458737f8447a6873b7cb5788863a895c31d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652888484, "uuid": "bda33b5e-e363-44d9-8bac-a45c5320989e", "comment": "Malware payload", "value": "de39ff745ee161e907d3dff951cdf4148949f7dba610bd3cf2cf353320046968c7e4f67d788f56fc5cc6c430b885cab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888484, "uuid": "f1ccabb2-7b6b-4683-9a96-5efd9f013c68", "value": "T129816F07295918EAC08FC3FE1E26855C179402530B6281FB4E6A9CCB4EFEBC6503B66D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888484, "uuid": "c50e2d0f-4552-43d8-9cbd-40f16fafa984", "value": "16efc89ecf5fb82f5dfeff229e3622bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888484, "uuid": "46dc7a70-2e47-4963-8ebc-28c118295bea", "value": "96:B+QeV7hNkzNkQRS7ptx9HKvhsxnM5uKHn7:8n7h6z6iStD9HKpUFKH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652888484, "uuid": "0e90867f-dba7-4053-94f8-cb555a63d49d", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652888484, "uuid": "9054cdec-3f6f-4da0-8751-a4f1cc1b6f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652888484, "uuid": "4b31bfae-3715-439e-9cfa-342c909f9290", "value": "SecuriteInfo.com.Variant.Ulise.361632.3042.21142", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13313ff3-d694-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652869200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869200, "uuid": "86c720b0-c8f4-4617-868d-6a09be21f563", "comment": "Malware payload", "value": "409e7c4186ff65be8abd24bbafb3dbfa", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869200, "uuid": "d7669cb9-8066-4eb6-a4fb-408a21a48548", "comment": "Malware payload", "value": "efbb5a11b6c8f84fefe932652396aca72b588966f2d6acbe95c2dd4165b417ee", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869200, "uuid": "e4f86510-aa90-4998-9944-2e5491e429c6", "comment": "Malware payload", "value": "acace558345f19eb2c3f22e65773a7defb3ed315", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652869200, "uuid": "185ee391-da51-46e8-b628-dfab0884886f", "comment": "Malware payload", "value": "5c698dc11ac92dc0258a34c000bcbd55571363858ac81919e0066ca7fb7186e5981275ce1412b41ee09b112a046a9a36", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869200, "uuid": "9cee5daa-026b-454f-86cf-fbbc08feb7dd", "value": "T1E394CF1973A50CB5EEB682368C434B05E271784507B1FABF03A4475ACE2B3E1A57FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869200, "uuid": "b34c9747-8798-4979-831d-4403d7892ff9", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869200, "uuid": "b87647cd-bf2b-4277-8094-97105ca137ab", "value": "12288:43hV6Pw4aT23Guolv91Wuwf07EIvH3+38+:sb6Pw4R3GuiWlcogm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652869200, "uuid": "c061fd48-c7cd-4e06-b6a7-469abc180fe9", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652869200, "uuid": "186ccf1c-8521-4ce8-9a2e-5a874d9cf629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652869200, "uuid": "ade18854-bfaf-4039-8b04-66ffc10b88b0", "value": "TzF8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947e7afc-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908931, "uuid": "0deaaa29-9c0a-4a7c-a943-ebf99ec83c86", "comment": "Malware payload", "value": "72b41a04e6ebbaabcf0b896f9b344f6a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908931, "uuid": "ec54b568-857a-4333-ac30-10517b0faa7c", "comment": "Malware payload", "value": "f07f73d23ab5c46654283f29267572895e8725b8eb15ebc77e3178ffd8b0748e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908931, "uuid": "6ab9031c-9ca7-4a04-838e-ba383f546f2b", "comment": "Malware payload", "value": "ba647ac02ca6139c9428227023e2bb57bf77c034", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908931, "uuid": "2229dcc5-51bb-406e-8c44-ce5c85f30b17", "comment": "Malware payload", "value": "fc03ac47ee610e29bd66f4b88d83001ddb8661f0b1c47da1bfdf2d3884aeb4f1532d214ba75ee6121e726d93b193e691", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908931, "uuid": "c2a51e92-f57e-4550-a2a5-3c9e082ce1ad", "value": "T136410ECB62620A7D6C91E967717948083084D19A50C9AF6FADFD34FC81CFF397448A97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908931, "uuid": "d3e300e1-f7ba-4649-a4aa-4ee520759b5f", "value": "48:viuCTGCs3+2oJf9eHBf+v8YLf/wJdJfA4ge3:viuCTGCs3+2af9eHBf+v8YLf/wJrfA4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908931, "uuid": "87ed174f-c8f1-417c-892c-a817f6d4c81e", "value": 1897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908931, "uuid": "935cbaff-ac95-4c0e-a687-9e567ed5c399", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908931, "uuid": "544862d3-16d8-47c7-a195-6ba62b2293aa", "value": "f07f73d23ab5c46654283f29267572895e8725b8eb15ebc77e3178ffd8b0748e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c7c3a3-d67c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652858944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858944, "uuid": "c1fa19f3-d364-4fd1-803d-756d2423e57a", "comment": "Malware payload (AgentTesla)", "value": "c3fdbf296ae6b149af0096a661909470", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858944, "uuid": "12eeae6a-8430-4c1c-8516-59c17d693090", "comment": "Malware payload (AgentTesla)", "value": "f08425c7e0062ece72520530562144189647150bc1fc59a14bfa208b49ce5ede", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858944, "uuid": "3e4a03b7-a11e-4fde-ac15-b153310c4387", "comment": "Malware payload (AgentTesla)", "value": "0b1ee3a10f2a26c8961374e5510a945c9d8a9e9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652858944, "uuid": "5afe3c09-0143-4f16-8484-d8b048832278", "comment": "Malware payload (AgentTesla)", "value": "b760e1d15dca3d01fee53ac3ee4378b76454943082a009003f0c392fa0496c69edd026f1e36cc5256e85df88d79be4aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858944, "uuid": "eed90954-e52f-4596-b200-00e79cf838fa", "value": "T103B42397A705E2BFE5480623D312FB6ED7A3BCE9378A143AEE546B144500B95C490E3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858944, "uuid": "94d65536-d7c9-4f97-a630-afa4f8e58306", "value": "12288:QNX7yjdhBqPGiNvjmzWG02UR5Ub3Hey5uH5gUWmXHic:aX7mMe48WGURmb3ey5Ha3ic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652858944, "uuid": "5a982147-afc0-4f6b-b29e-5dfc7698b647", "value": 496899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652858944, "uuid": "e29ba92d-9e81-4ea0-a1e6-e078f272cab8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652858944, "uuid": "61dea0bf-3cea-4e14-8bfd-c3340859756f", "value": "NEW ORDER.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a03bb7-d6fc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652913946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913946, "uuid": "ccf808d7-59c7-47af-a012-de28dd9be6b3", "comment": "Malware payload (RedLineStealer)", "value": "ed95ef755c9630597869f93f5a63ab49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913946, "uuid": "bfef5ac3-5da1-4914-9e21-a50e076c967f", "comment": "Malware payload (RedLineStealer)", "value": "f08e837a882f870323a6a862dd0485965d03e4a6a6494ffa08f9f3d93b210561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913946, "uuid": "ee9986f4-5526-4c6a-8f75-80e4061be8a9", "comment": "Malware payload (RedLineStealer)", "value": "6b1766876d5f3437af113db1b75dfc1e516dfa44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652913946, "uuid": "ace0a51f-d376-45e5-9c8c-6b2d2c438305", "comment": "Malware payload (RedLineStealer)", "value": "1ac3500cfee0e000bccfc750e3a2cd5a6be4b5f2b9648ffc3bbebf25a9fb99aeaca17f7709aa348944020734a40ab8b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913946, "uuid": "5de98662-be70-4db1-9fbb-abb868a4c017", "value": "T12294F110B7D0CC35E1671E749870DBB11B3BB85299B0984BF7945FAE0EB33919AB2316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913946, "uuid": "b5c36fc8-b06e-4649-bc51-7fea4e911709", "value": "151adccff5e70213fb31de55ca880f7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913946, "uuid": "af9ce795-24be-46f8-9bec-46b1897817d8", "value": "6144:hPFS7ih0ODazsIjurv+q7sKYhbkpjztx7Wiga3wVfN:FFSWvGzsBR43hbWjDv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652913946, "uuid": "2721c221-e3ad-479b-aa58-cb6088844247", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652913946, "uuid": "f093b3ed-bdb8-44ed-a820-5a5e6efaf3f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652913946, "uuid": "ab347be0-bd4f-48ee-b78e-3dca6dbc2fba", "value": "ed95ef755c9630597869f93f5a63ab49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef347938-d652-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652841223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841223, "uuid": "be01de7a-3169-4fa1-b662-a7a809987baf", "comment": "Malware payload (Heodo)", "value": "80f61f0a3fc11293593250c3a9577464", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841223, "uuid": "87faa3ad-db12-41e3-a018-ec531db7ccaf", "comment": "Malware payload (Heodo)", "value": "f179b661d9837176ac98f0d3a4497ef6c54048c5aa1a7dc8e39b676287e51dc2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841223, "uuid": "5228629c-0f87-4e1c-bccb-f4d003ba9df6", "comment": "Malware payload (Heodo)", "value": "c7ee59d42524cf06300886a5ef20dd3c0c8905b2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652841223, "uuid": "fb6ca2da-463e-483c-9392-3f4c83adce6f", "comment": "Malware payload (Heodo)", "value": "f05d9dfd41780f574c33b5ad29335115a5ac33a934ca1fb5f7c6056fcfbdafff25471f2ae3695fd4fe92dda662654079", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841223, "uuid": "5776dbd7-999d-4d6d-92d3-593ec0275770", "value": "T15F94CF1572A50CBAEC779239C9434A05E27378250B70EB6F03A04756DF2F7A1A57FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841223, "uuid": "92d32a45-25ea-4a4f-a996-ecafa55328bd", "value": "dbde2cec49d02964ab0aa40b1f723aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841223, "uuid": "0e4dc8dc-e236-4097-8022-8a32aafc4e29", "value": "12288:M3hV6Pw4aT23s2oBd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2Ui3fUZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652841223, "uuid": "f594ae67-28b8-48e3-a45f-2fbb60eed7b3", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652841223, "uuid": "a14c504d-08a8-4227-8609-af1191b17a11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652841223, "uuid": "3b230d48-f7be-48dd-be52-38dc5242184f", "value": "80f61f0a3fc11293593250c3a9577464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff47fc4-d6b4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652883127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652883127, "uuid": "99dac431-921c-43f3-93ad-e1bdf192f698", "comment": "Malware payload", "value": "bd4741c5f468ad89aa4b6aa237b75027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652883127, "uuid": "a97b21eb-0fde-45b7-96c6-c3ea616b2370", "comment": "Malware payload", "value": "f1aa901cfbefbf00e206851ea8da56362e8edbad4416383e175a90e5ee15b54b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652883127, "uuid": "e01bfdd9-129a-4785-b284-3710494a2a77", "comment": "Malware payload", "value": "c664193356a7c1523ca49017dec5677862392556", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652883127, "uuid": "20f43256-7f5a-45f6-a7d8-9eec2cfef41e", "comment": "Malware payload", "value": "41f228ed824c6775403fb8d514b1a9c9e45b614fe6d918ce86da108230e1c70ff5a43ec94d4e8d809f84a5751b895edc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652883127, "uuid": "924fd8f7-a09e-4b22-9c44-34f7470c7f44", "value": "T18EF3BE02D91E1036E9665570AFA61A1BD77A72605F0031EBB7C289BA0B72CF93C715BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652883127, "uuid": "3e0b2d90-7374-4ac2-820d-6f787c5ac7f8", "value": "23c751ae9c02945f8d146a6490f2d56d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652883127, "uuid": "50f92489-6a56-4515-8bb9-10f73718bfcf", "value": "3072:WCrIvgURbVCVf/bdIwtGdpgZXUMOdU48u1pSXCG3176t:WCrRUihtIpgZkn1wCu16t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652883127, "uuid": "17704977-d9de-4872-8647-b66786f6eb12", "value": 159144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652883127, "uuid": "08ad00d9-f1b3-425a-92d3-200e98e4390a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652883127, "uuid": "8ef7a041-bac8-4f36-963c-b72907c18c26", "value": "AutoInstall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f267725-d6d4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652896815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896815, "uuid": "cff303ca-be01-4f9b-a61e-c2d5182c8308", "comment": "Malware payload (Mirai)", "value": "377f745f5b21abc5c09c3cdc9942985f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896815, "uuid": "b318d5c9-cf87-4740-ae67-32ccb5d2a32c", "comment": "Malware payload (Mirai)", "value": "f2826ac7a27141837f8b5bdba4f901511f2914284638127d1689ed537c2938fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896815, "uuid": "d7ce22da-31ae-4301-823a-b382141436c3", "comment": "Malware payload (Mirai)", "value": "315d4c3fac78b9d635790c7e9bf8f1e2d0e20831", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896815, "uuid": "5819e06c-8688-434a-897e-35a29c23db51", "comment": "Malware payload (Mirai)", "value": "361b0bbce983e5ffc4df8e7b9f3140f703cf75db6f8b81f99acc2fa64e14c949ec3af6d40da99a2d2949030aa132261d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896815, "uuid": "a772f842-25f9-4c4e-9445-561b9526233e", "value": "T1B0033F8CE969A77EC3E172FFE79902CE623E07D86BD3B525CA35464937C8354A825130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896815, "uuid": "ab3722db-d135-4441-9b9a-6354bc6dafd6", "value": "768:NzcXCBEq8A/OEQYYFnOCkhtgk0EuT3bkD6upc/C:NzcXCBv8AVQn0gffL+c/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896815, "uuid": "229cb7b6-720b-415f-83ae-f0ed11445978", "value": 39787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896815, "uuid": "cd7fc7b6-d081-4675-850b-00d60d0984f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896815, "uuid": "d2bf0900-6fc7-4ce3-ad70-2a9a4fca5536", "value": "miori.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca6b94d-d6c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652891443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891443, "uuid": "cd2f2475-6c2d-488c-8462-c4459bcf3704", "comment": "Malware payload (Mirai)", "value": "a3deb9b3c911037e534666bee9f129d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891443, "uuid": "45a7b861-07bb-485d-b18c-6c257aea8b7f", "comment": "Malware payload (Mirai)", "value": "f30fea9b800762a09097405b31c935b73572ba844d6b4cfbd6331ba2609235be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891443, "uuid": "9d13bbb0-234a-4654-9a44-92cac0b5e85c", "comment": "Malware payload (Mirai)", "value": "a99ee79b8a8aaff6d57e65d3abb7aea47d8025d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652891443, "uuid": "b8dea7a8-3392-4d8e-98b1-e991ad33fbe6", "comment": "Malware payload (Mirai)", "value": "b9776fdc08c065ff98721e2f3969d948668200c2c4e7e89945a00b512a8ba94ae8b2a1b4d03787f82783daddc1f97e40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891443, "uuid": "259bcaf6-6726-4cfb-93de-6177c3bb99b3", "value": "T150539EA5C4AC9D98C6264678F614C839AB23A00C62A33DF6DA57C656841FDFCF01C7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891443, "uuid": "8e4f0d92-bac0-4261-a823-d85bc89d4ee1", "value": "1536:K/ue90IlCalyZyuhx+vACs2U/SO/Sfs3zO/QSwtPlCXFi:KGejAGyZyuhxaU/Sjf+iYdtPl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652891443, "uuid": "3f95e617-461c-42a0-9dfe-b47a80ef0ff1", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652891443, "uuid": "3a3cd3cd-5f1d-4e4d-8910-f08aea6b3e9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652891443, "uuid": "7ddff8eb-6994-4ab9-a99c-2421b5e7d437", "value": "a3deb9b3c911037e534666bee9f129d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c26063f-d65c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652845190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845190, "uuid": "613e34c9-5413-4b31-ae96-101c893810d1", "comment": "Malware payload (Heodo)", "value": "598fd0c076fffbbe4433c525d5304823", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845190, "uuid": "bbfcfa73-31bf-487d-be4e-f77d89032c14", "comment": "Malware payload (Heodo)", "value": "f3189994d02379d288a71039441cfa5d8bb68b4cc076843f9aadf053db1e6f4a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845190, "uuid": "de1ca1fa-7e87-4f98-aa85-c4a0f02f5853", "comment": "Malware payload (Heodo)", "value": "04225bd957765ab731d44ad909b9809e1ec2f614", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652845190, "uuid": "cf34b01a-c65c-4b53-a26a-8c37427657f4", "comment": "Malware payload (Heodo)", "value": "0f77d2668fb99cbf4dee29395931b28be3995ba8efa577c9781f25af58ab8bfb8fb812c0284bd30b7886001c21f42816", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845190, "uuid": "ef676351-77db-44d4-a849-179e7257db69", "value": "T13EA48B4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845190, "uuid": "dd18b210-8f90-4d9a-9675-cb836aa4deb7", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845190, "uuid": "250f9bc6-87cf-42fc-80ac-9668bf37e0f5", "value": "12288:uS4BnAed8BK2o0aBa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANK4a34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652845190, "uuid": "87a66858-3945-470b-a05a-46418a491699", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652845190, "uuid": "981630ec-83ae-4e45-93bd-62d505cf38be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652845190, "uuid": "152c3145-45eb-48fe-a44d-7169fc40afd3", "value": "598fd0c076fffbbe4433c525d5304823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c625eaa4-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909014, "uuid": "79c816cc-16cf-4943-9d8c-e76a3c865f96", "comment": "Malware payload", "value": "959a3f0dd0a657865c7fdd238f84fa63", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909014, "uuid": "81ffb9c2-7f23-47f5-a33a-a74c8a85a156", "comment": "Malware payload", "value": "f32802f8f443058737d153d919daf9384368892faf7b6f6534286fb5abf29b31", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909014, "uuid": "7acbe0be-29cc-4dd7-9628-a53dcabd5b37", "comment": "Malware payload", "value": "23579fd8ddebabe238d79e67f92e6cf8b78868a1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909014, "uuid": "d24d4140-a6ee-42cb-9502-bcdc5a06f74e", "comment": "Malware payload", "value": "3797758f7db5c6d70847d228b16b9e1af31b8565471c5467737642cb9aed25cf7041fb940a36bb5d8b4d76ff1e9cb746", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909014, "uuid": "fde3f69b-e451-4419-8880-f354f187815a", "value": "T177A1F850112C1AB07246597AD26FFA52B40EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909014, "uuid": "fe155fb1-d131-4e2a-aa59-b63802dd5a86", "value": "96:YRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:YRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909014, "uuid": "dc86fee1-6c37-47c4-b402-6341abe42a91", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909014, "uuid": "19555d9f-e503-463d-ace5-20b037400e56", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909014, "uuid": "2da96f7e-7782-4500-94ef-d40b0d737380", "value": "f32802f8f443058737d153d919daf9384368892faf7b6f6534286fb5abf29b31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9de82f8-d696-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652870446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870446, "uuid": "671d72aa-e03a-44ec-9a53-11aeb78d6260", "comment": "Malware payload", "value": "d1ffdeafb01b7f28f67f3b25d8f28258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870446, "uuid": "39bf6dd2-5cbf-42aa-ab17-0c9b3f606543", "comment": "Malware payload", "value": "f340d458233c3c543e3c5ba63702679c64372275e528388f1ca098560c01f52e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870446, "uuid": "fe0f5557-b4ab-4e2b-8588-66280ed4bb80", "comment": "Malware payload", "value": "8552ff3bfb9124df807811bde63c40886fe3ee59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652870446, "uuid": "c865ef7a-53e1-45ea-839e-686f92029f75", "comment": "Malware payload", "value": "bdbace39773084eed17b131e72fa4948a95e05ce33295b5289aaf5a27ce8c89e232912117573d1f4240a1fdcc34ea9cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870446, "uuid": "4270dc40-74a1-4ba6-848f-bfad4c016798", "value": "T1E105AE5C3690F99FC457CE36C9641CB4A660AC678707E347A05739ECAD3E79ADE002A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870446, "uuid": "6390d447-6a58-4562-8be4-5167f518fe92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870446, "uuid": "58a10304-1b07-415d-ad05-efcae05db521", "value": "12288:NbWkRuA5hR0t7CIvuFUHDAS1CTkN9KaZzM2ZGOtauOn3oN4NxOgS+BDK08rvGE:NzN5hB+tN9KaZY2DtLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652870446, "uuid": "f440e3ff-b5e4-4da2-9b50-4d7ddce9930b", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652870446, "uuid": "5cf907e1-fe45-4dab-9097-4dd00c7c7ea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652870446, "uuid": "144681ef-ec77-4266-aea8-9a53ad3d6b78", "value": "SecuriteInfo.com.W32.AIDetectNet.01.24493.29321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a541179-d689-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652864515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864515, "uuid": "6ed3d381-521f-406f-baca-1eace75684a3", "comment": "Malware payload (AveMariaRAT)", "value": "4c86de3ecf018c944d5d92fa8e65a568", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864515, "uuid": "30d81ee6-4c0d-4d40-9480-fe5387655386", "comment": "Malware payload (AveMariaRAT)", "value": "f3617039d91185cb87c871b81601241371570366e47992c94434f494e3133648", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864515, "uuid": "ee85d02c-37bc-47ac-8fce-6fb9018f1ba1", "comment": "Malware payload (AveMariaRAT)", "value": "d701a76b3dd8f474b7b0e2ede1e86a0b70b399c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652864515, "uuid": "99c0c8bf-cd29-4102-a36d-47d7470d8f13", "comment": "Malware payload (AveMariaRAT)", "value": "c5af4378f8745d40530b4802631344a54edc9d5c6847bb700b4c3ec6bafd5c6b286d7db66b9e1549ba3d147e3b129ec0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864515, "uuid": "44b93520-97e3-4b28-a745-e6ae58065903", "value": "T138D4F1A9BA95CE23D35803B2C0D3552443B1945BA773E74B2F8D02D61F06BE19DC9B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864515, "uuid": "92fb5559-f580-4e3f-91c5-df87490fd3ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864515, "uuid": "4a37ffb8-1889-4df3-9f9b-88e34df88dac", "value": "12288:odkiI5nXFmYw+gVYG9osxl+/SyhBGmF62M43EhrvzorA:kI5XF+LJl+7h/F6273EGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652864515, "uuid": "abecd704-0ed1-42e3-9fae-c196c90ffabc", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652864515, "uuid": "11bd6ecc-fcb5-4391-98d5-6f28639377ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652864515, "uuid": "c744eac0-d436-46ba-97ae-8941b15937b1", "value": "4c86de3ecf018c944d5d92fa8e65a568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64bc896a-d6f6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652911428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911428, "uuid": "a0c06bfb-6fac-4571-973b-dd5331af4335", "comment": "Malware payload", "value": "f87c7516f3c41a5db61b91c0ede4bf18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911428, "uuid": "166490e1-6d1c-46db-81b9-c208cb8d10e2", "comment": "Malware payload", "value": "f43d109f41f6f2f533be554241eb75bd337190cbd0704cf71f3a157b96f1b1e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911428, "uuid": "f08b8fab-95d3-4f08-8a94-6a7336c1a1b5", "comment": "Malware payload", "value": "b68053f52c4f91c8f16967fbacdabc74f2203b97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652911428, "uuid": "456cbbcb-0ee5-4741-8897-321866af92b5", "comment": "Malware payload", "value": "d905d16c2721e1d58e7d35c3ddc1aefa69032bc8bc90dc9b72138074687bb44df361f24648c1bbe2600f8ab456b6eab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911428, "uuid": "63ab51ad-db2a-4a90-9fbe-2975a510629b", "value": "T19C05273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911428, "uuid": "8c81a5d5-0244-4177-bf6f-3df94099730f", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911428, "uuid": "620770fe-d3ae-46b6-8105-dc9e8d62c75a", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oFaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7NUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652911428, "uuid": "17b6eceb-14d0-44f6-adc6-05167d103e62", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652911428, "uuid": "79c46937-f8a4-40d9-afe9-cc45fceee84f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652911428, "uuid": "ecd83c97-8321-4052-8f8a-fddba8108e1e", "value": "f87c7516f3c41a5db61b91c0ede4bf18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803b1abd-d65a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652844472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844472, "uuid": "692886b7-8bf8-4416-8c2c-833586534b5e", "comment": "Malware payload (Heodo)", "value": "04556138eb51630dfba83a628db18bce", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844472, "uuid": "ce1f1340-544b-4c78-8bb4-a22ada7f7340", "comment": "Malware payload (Heodo)", "value": "f4b7f98ff3973a81bd699f3a6cf70fa431a878b6308fb86ef92c5c93c443fc59", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844472, "uuid": "2aabceed-29cb-46be-927e-1f7454c20744", "comment": "Malware payload (Heodo)", "value": "b14dafb42a8501c6af304946999e4e96843e3024", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652844472, "uuid": "fcc48052-62d1-4b0c-8027-22371daaeaf0", "comment": "Malware payload (Heodo)", "value": "59436eabcda755733cd83336ef4baca9c85ee584f164f8ee9ac5fefd4d792c1175c0a8b10b5ce4127bc35dbc44e2fb0e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844472, "uuid": "22a576e5-6f76-4364-b9a1-fc51009652bd", "value": "T17DA48C4AA6AC58F4C477D13C98A3621AF7B13CA64734D78B56A0466F4F237E0AC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844472, "uuid": "e3384152-b61f-4934-9c9a-07082adc2f33", "value": "dfaffb91ffd6ccb2db2dd7341b2d718f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844472, "uuid": "c1df527b-53cf-4e42-8b9c-34719f11230b", "value": "12288:uS4BnAed8BK2o0aQa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANKna34dmyL0E3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652844472, "uuid": "ea34b554-80d5-4c30-bbf8-c39c48f2048f", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652844472, "uuid": "99c667a4-f38a-4e87-98a2-32cbd7ee47d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652844472, "uuid": "319fc51a-c162-410f-9578-b2020f165ded", "value": "04556138eb51630dfba83a628db18bce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938cb46f-d6dd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652900769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900769, "uuid": "0de23b94-1157-40b8-8bf9-3032e0579945", "comment": "Malware payload", "value": "248945de3163cc416e0499fd63d5622e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900769, "uuid": "fe0a7cff-7a46-48e5-9dd3-93cc9b64219f", "comment": "Malware payload", "value": "f50a84833a17ab976661dd1750e8f0ea4d214267a28e4143b34de37fa7a024a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900769, "uuid": "8719d284-f762-45c9-b072-2f4735c6356b", "comment": "Malware payload", "value": "6b2ff0d42eec4e655f8d3c0ad5398d6d35415859", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652900769, "uuid": "108e4f0c-f41c-414e-b143-829668af3fa2", "comment": "Malware payload", "value": "f7a70326f3a02ad3b444f144e8dc44a2997a5b721d3bbad5d6ecca4cf2a0acc3ff7e38e9fb9d435573e7b22be5bfd14e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900769, "uuid": "99740735-ce5a-4166-9f91-8d2dffff19cf", "value": "T13605273FD6584A22FC1F0235C642890BF191F90227145D9EB3AE4A59DF3BE58FAA5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900769, "uuid": "4dfdee4a-6865-443e-b42b-c394eb62ae07", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900769, "uuid": "b96542d1-9063-456c-b407-1b014b5c7f03", "value": "12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7oKaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7MUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652900769, "uuid": "0d4104f2-6e2d-4b5e-b746-fde344c786ad", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652900769, "uuid": "a5ac2b9c-5fe2-48fe-83c3-82ac914feaa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652900769, "uuid": "10583467-46e2-494f-a520-61f02bcdd9da", "value": "248945de3163cc416e0499fd63d5622e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a948e60e-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908966, "uuid": "dc4d6494-60f4-4059-adb0-37119c8d8bde", "comment": "Malware payload", "value": "d3ad60d31c5ec8c46ba9d7e9da9c86f1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908966, "uuid": "062b9704-618f-46b4-a5ce-a9ff2ccbb1fe", "comment": "Malware payload", "value": "f50deac00f61e1a3d803c9760ae27b5a45a267249aff75f0673176e12dfdd177", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908966, "uuid": "15d9b602-7a3d-49af-a7d7-436589b55e62", "comment": "Malware payload", "value": "469d99192b661a8b9e5cb6d47a9a4cad42fc0d6b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908966, "uuid": "fa337cab-4897-42b5-b35d-f908201dc7d0", "comment": "Malware payload", "value": "4edc645c4a0d8b2e5d4cea685a9e0f484a09dbc09ec6d7fc73f9a49348db9bfdb6e38882365c2c9bb608a20af3e0105d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908966, "uuid": "7c135347-ca10-40c6-af0e-4c8c9f36347a", "value": "T1F5A1E850112C1AB17246597AD26FFA52B90EC81B0A777B358873A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908966, "uuid": "db93d797-c1e4-4e14-9952-76143d89d861", "value": "96:cRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:cRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908966, "uuid": "aba49f6b-cbfa-4e6c-bf5e-2b674e78b323", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908966, "uuid": "ca374d8d-da30-4660-b20c-8cc9c6a7539a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908966, "uuid": "37e4f799-dd89-46ed-a9af-027af22de677", "value": "f50deac00f61e1a3d803c9760ae27b5a45a267249aff75f0673176e12dfdd177", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec50b2e-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652908921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908921, "uuid": "e4987e73-aea9-448d-93b2-fc8bab2dbf28", "comment": "Malware payload", "value": "5b342076248d40842960edc3b65313eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908921, "uuid": "c2d6177f-b633-4333-9f82-c1f77fc38b03", "comment": "Malware payload", "value": "f52ad1140338c08445fc38718fcbfc2e0c409f6d11594f02206f01124d420c77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908921, "uuid": "df101397-2e52-4eea-abf6-e50ffd5a424b", "comment": "Malware payload", "value": "a7d22acd9263f37d40c34f4c64566ca6da164ee9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652908921, "uuid": "fc82fe2c-d40f-4d6d-afbb-908f437f85a6", "comment": "Malware payload", "value": "fb955a6a253ed38a03cbe66288cabd6f18ca269b31929cad908c458c6390adcbc83f5d53e20191b11cd613ebdbf8eecd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908921, "uuid": "2bd00e85-34f1-4f73-80fe-77019c3595ef", "value": "T175213E97A6CB5D54FF28E53859700750BB07DE39C28BD38F4F048442392728CB7B80A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908921, "uuid": "9eeede1f-0fa9-4dfa-b13e-337829ea91e4", "value": "24:XL8wdGtCyDQUpnVpsDQWplE686EktmEjomX3GBkC7m1fJNfLa3:7zdR/UpnDpWpi6aEjomHGB772BNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652908921, "uuid": "09684087-9912-4481-9e35-f0967d3b710a", "value": 1176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652908921, "uuid": "eac3c707-e641-499e-9bfb-dd3989a8b6ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652908921, "uuid": "6b5443e7-7cea-4865-b285-cef46ff45bfd", "value": "f52ad1140338c08445fc38718fcbfc2e0c409f6d11594f02206f01124d420c77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3e40ce-d6d3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652896651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896651, "uuid": "8dd53e40-0c12-41a7-ac1e-0a28b012e71c", "comment": "Malware payload", "value": "ba4ad9ec486498805d052b456e464b1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896651, "uuid": "a4eb126f-26f8-4260-a613-5ba26872f9e6", "comment": "Malware payload", "value": "f534cc2a5641f0799c6ea6d7375422cab86873828c7fe044f8049b60e1ff730a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896651, "uuid": "9ebd9dad-8d20-42d7-ab93-9256b1eb69e5", "comment": "Malware payload", "value": "845781afb16ad1a8924de86b7d7f214a9afb2918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652896651, "uuid": "a460624a-d9d0-434c-a7cc-76c1cb73029b", "comment": "Malware payload", "value": "2adab51abdf0eabf9233dd3bcb08348c3168d25a7978f4eac13e64bd0f45571326179bf4f7fe6d63d1384ea49d22212b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896651, "uuid": "1f67e0cf-c37e-4fab-9905-c0e97b9c0aa7", "value": "T10305283FD6590A62FC1F1235C642894BF591FA0223145D9EB3AE0A58DF3BE48F9A5F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896651, "uuid": "6062453a-61d3-4721-8d2c-1a72edef63fd", "value": "5c49ce3660f3f487a221bd7888983b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896651, "uuid": "2b89df2c-b560-46d7-87dd-dd5b213f4679", "value": "24576:sPMTg9U3G0ISDKvSeqfZaePWAy7umpE3:BTg9UXRD2SeqfZZiam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652896651, "uuid": "e499c0e7-86cf-47e5-a25d-680363b550a3", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652896651, "uuid": "a70ebdaa-07ae-49d3-a92b-c3bd022f6eea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652896651, "uuid": "efe08069-eee9-4915-adb9-f4736d15b18f", "value": "ba4ad9ec486498805d052b456e464b1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c5bd5b-d6f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652909064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909064, "uuid": "b1db6538-5175-4529-8c79-4701a4afc120", "comment": "Malware payload", "value": "81573f2716ee9261ba69a5a7b1d4230e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909064, "uuid": "f9d29384-e112-4f77-bf7a-03920870ba0b", "comment": "Malware payload", "value": "f535c2c5c250e117fac18dc9b4387f18b527c1699fb82fdc32b8feacfb9bd7f2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909064, "uuid": "e077e243-af02-452f-b59a-ef6fae01268b", "comment": "Malware payload", "value": "eb0636a40234327a991f34a0b166de103b5d4aec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652909064, "uuid": "4f8c3fbc-41a3-449a-8adc-f05d72348138", "comment": "Malware payload", "value": "459cfb9aefdd4554506dd538349b30919ced991d0f27c68c7bac8ed465d3f09d1ec433fc050e22575919e14733451ce2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909064, "uuid": "d5f9d796-61a1-4207-a92c-6928ebfd5eff", "value": "T130A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909064, "uuid": "b251ca65-0f2a-4b4c-8747-588c3d776752", "value": "96:wRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:wRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652909064, "uuid": "02b5dcee-a28e-4bec-a3c0-9ce39e7173f7", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652909064, "uuid": "29b3d9d8-50c0-4313-aaee-f555dd63bd24", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652909064, "uuid": "3fcb9247-24cc-4f74-9dc3-7211b7bb4ca7", "value": "f535c2c5c250e117fac18dc9b4387f18b527c1699fb82fdc32b8feacfb9bd7f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8e8924-d675-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652856249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652856249, "uuid": "da7b61d7-5a0e-464f-861d-b84e6d8e1d9d", "comment": "Malware payload (Heodo)", "value": "07d7414b31bb09d9f9d2a21531b887a3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652856249, "uuid": "5e531a5c-3431-41a1-a99a-2e0283f719ce", "comment": "Malware payload (Heodo)", "value": "f53907c830e4098f76b822db22748b439db833ce5b97359e20e31498b6b4b655", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652856249, "uuid": "55fbddbb-e226-43c5-b82f-11e8779a5e52", "comment": "Malware payload (Heodo)", "value": "aae6ac5f9b70acfe583aeef5b8cd979c04c5490f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ]