{ "Event": { "published": true, "date": "2021-11-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-11-27", "timestamp": 1638057781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e2c5b61f-5424-41b6-a497-cc4dfb9e3ea5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c6b384-4fb2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638039005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039005, "uuid": "be7f426e-7b60-40a5-8e07-30ed77dd4dad", "comment": "Malware payload (Mirai)", "value": "d6c4e5ca2f7d64c13e295a1e9f990445", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039005, "uuid": "cde9f238-de1e-4827-98c4-d336b4c43e40", "comment": "Malware payload (Mirai)", "value": "00303142cbd4d0faceef710075be7b13f5e7a15a21ac22e4a1fba734e52f57a2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039005, "uuid": "43a7d9c4-32a5-4c53-9ae5-64974909f0c7", "comment": "Malware payload (Mirai)", "value": "4c89740e9fbd67a47f3ec0e8befbabdef24b513a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039005, "uuid": "39525422-3c3c-47c2-9135-5768edb73915", "comment": "Malware payload (Mirai)", "value": "b3dc6e8829845e522ff11c2ebcccd699fc4c1a8ce0ca8717dfdee5eeb440eb96b8495a5a331c38eab802d3e53d246c1e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039005, "uuid": "57bbef3c-2411-48e2-bf62-5eb0ebe7441b", "value": "T154330229DE789A81BB112DB41D765A0FD2744BFC92FFF833326C84246310A6691DD5C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039005, "uuid": "d8425ed2-d915-45ac-8195-f81e7afa79e0", "value": "1536:bPQoxMJ8WaEQ51TPvK4RZOeFrDgLyL0Z6ZnS+Qj7:jYJcTP9OeFrcLGu6Y+Q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638039005, "uuid": "aa490f6c-75d8-41da-bd5d-9056ad1ba237", "value": 53756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638039005, "uuid": "9d785e29-6c6b-49f0-bb02-14bb58c2b2f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039005, "uuid": "2b3a94f5-ea87-4d22-8bd8-9f68352d5af4", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07a2e0a-4fb3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638039479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039479, "uuid": "9385ff44-1f77-4d76-a180-a3f27c066917", "comment": "Malware payload", "value": "864058a361427e4d04e7b9fa74785590", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039479, "uuid": "53691ebe-3b7b-46f7-b3b4-e33d502e2d3d", "comment": "Malware payload", "value": "04de6272e5cc965e0bfdaf797ba8814e54949f0cd7463333fa547bb918034860", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039479, "uuid": "68d3949f-5afb-4409-9251-ce24152826d2", "comment": "Malware payload", "value": "6cab4dfae474096ccc7084b2c597601914f974f7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039479, "uuid": "d0fd0666-2f9c-412d-9519-b5b20a0d8a1f", "comment": "Malware payload", "value": "6b00d2331abb032feb4242f169abf638a0c228220956f6850c8312f7969b30b9bdceff270e49c31c95b88ab2415ae41f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039479, "uuid": "00151479-abfc-437f-ad7e-2f0bb4e7d786", "value": "T19CA423558829ED61932C19261F7E060FFD4AF888AB37D4C42EF7968A544C135CADECCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039479, "uuid": "2461faa0-d873-42db-970d-142a698de060", "value": "12288:3ob/huOkAwtQe7OFBLcTzN2Y6gE6TNQmYBi28:3obJ/kA3Rvwn6d6Chf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638039479, "uuid": "7ac30b5f-709a-4060-ac38-d341d95378c7", "value": 471709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638039479, "uuid": "9ecc104a-54e8-4d63-b454-e4d01b896bf3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039479, "uuid": "bc0530e2-02bb-46bc-a9a5-28a0ea06817a", "value": "OnetapV4.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f34c2d-4fba-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638042474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638042474, "uuid": "d7546822-316f-4abd-bd6f-6b0cca429f46", "comment": "Malware payload", "value": "497f7056a30ead819af614733efb6df3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638042474, "uuid": "b94abb50-8548-4a1f-bfe2-a76f5a88dc90", "comment": "Malware payload", "value": "05652ecf683c1efd3496fc5ab226be1f7d9175d0a3253e7458c7e777330a4247", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638042474, "uuid": "d0be6122-5cae-4e01-aa16-32b2cbfec894", "comment": "Malware payload", "value": "906129b9f090884d28ff05006805e573b58e2484", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638042474, "uuid": "76d94369-ba19-41c4-acf2-4f9d0120cb78", "comment": "Malware payload", "value": "150fc590f2660f73f23edd6e018aa67d704d4075b8eaadb998fd71617fc5dd03a43d49a5172152445ff38dcf89968bc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638042474, "uuid": "ef91dc0e-48b6-4748-bf40-3bd3b44e40ac", "value": "T19B653382E3D0AE2FC78F68B4FA41D271AF5C1554DAF8741B5702090923AA5C2DB9E377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638042474, "uuid": "b2747d28-8869-4d99-b43a-077a343f4068", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638042474, "uuid": "4d4113a3-7c39-4842-baca-7765a0623360", "value": "24576:qCB0G/63FaRbIHfkPoIugACxqr4Csycf5PE3oQXHMokdr8sS3bnkEaHNYK3dXUBg:qCBbZqjgizsya5PLvokdr8sS3rNa4+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638042474, "uuid": "8e0963a7-aead-431a-a617-5bdce7bf1760", "value": 1433856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638042474, "uuid": "4c2fcb2b-afbd-4346-860d-062eef78cbe3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638042474, "uuid": "efc1e14b-5c59-4411-87fc-d97fc1c539f5", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7592cf-4f41-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637990353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637990353, "uuid": "2ed090d1-f34c-4514-8ef0-e375ae53ceed", "comment": "Malware payload (Heodo)", "value": "59552ba435aab5e59da89306dc1b3f27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637990353, "uuid": "0076e369-80a7-46e0-9cf0-3af931fb48f8", "comment": "Malware payload (Heodo)", "value": "05f251f9b66d86646b3f9886bbb525414580cf9698cd4918ec79c706fc679a38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637990353, "uuid": "c8a2d3c2-34f8-4a80-88e3-2dfd05bd51eb", "comment": "Malware payload (Heodo)", "value": "55119da3c6ae51bde9948c930829b236dfbda244", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637990353, "uuid": "5dd850e6-ccf8-4bdd-b831-8fb50c498bf4", "comment": "Malware payload (Heodo)", "value": "dec9726e7b2e155d20797bc1996feb68939beeeb5f7ff030c5d1759ff7d8adf9a79694208caa68d2ee5f63f4d59ba0ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637990353, "uuid": "1b8c8eaf-4c34-4214-8923-93d6d1754a4d", "value": "T170A4CF11B6C29432E1BE05303978DB5608AD7D318FB4CAEBB7D82B2D4E741C19B35A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637990353, "uuid": "3c900dfe-a7db-4518-8212-42c22f5eb7c8", "value": "d2a2f4c68a7903cc45764257f8ed7a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637990353, "uuid": "a902cb17-4b30-491f-860f-00f350cf48a2", "value": "12288:+AriSOG9c0jc5mDQxqfFR4iTQG8Ht3WZ6y1zTV3z1:vof4DQxMn4iTFUVWXpTVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637990353, "uuid": "566ec223-b110-4d8d-97cb-1af8f9321451", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637990353, "uuid": "397da76a-3917-4db0-a180-880d1fd138d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637990353, "uuid": "4da9e70c-9111-403b-a8dc-d80fba411c14", "value": "59552ba435aab5e59da89306dc1b3f27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c913ddf4-4f80-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1638017508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017508, "uuid": "255c88af-3a02-44fd-bf9f-04ccf6a868e0", "comment": "Malware payload (AgentTesla)", "value": "99a672cba6ea3943bdd2b4c16d2d1dda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017508, "uuid": "54103506-5d10-4592-b9ac-800550990f76", "comment": "Malware payload (AgentTesla)", "value": "06ac82e3c0ba3a5f1d557e0922be6b684cd977c46f6bf76668edfc21a089e811", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017508, "uuid": "a693f3c7-0698-4b64-9050-9653c73a2adc", "comment": "Malware payload (AgentTesla)", "value": "17791c629c54bd1476a614885c3eab44a2b5b311", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017508, "uuid": "7b1aabe4-c346-4994-a583-078815293ee4", "comment": "Malware payload (AgentTesla)", "value": "8b8ba9cb1311c2e95fb7c6c0fd7c6f877960fb8e824888b2bf1cd679238ae5725728107c8215a744c6720bbd3694e5f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017508, "uuid": "a9c2c6cf-3b85-4f04-80a0-b59fc666d45e", "value": "T1F49423C067318B17D2DD17B154A282C913B4960FD110EB8F3DCAE1E62F6BBA54E12AE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017508, "uuid": "9654c8a2-60ea-4c76-82fe-ddde687d32f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017508, "uuid": "5be1e869-805f-4e61-8838-85817bf34eb3", "value": "12288:mhyixBFmeVRwCMyfXJ6fqg4dj9Tq0VDKoiCf:mMi1gCMyfXJmD4dj92nCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638017508, "uuid": "6aa870b3-3875-485d-a1bf-3b244c374751", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638017508, "uuid": "44d50f42-da14-499e-87d6-1bf41afd8b22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017508, "uuid": "bbf9dcfb-cfb3-4b1e-8863-1a5b5d3320e5", "value": "Regarding the issue of the Agreement documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54feacce-4f63-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638004858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004858, "uuid": "3fc40ee6-ea4f-4ac4-afb6-affbe454a2bb", "comment": "Malware payload (RedLineStealer)", "value": "cd597707fb381a907a17e77fc2732c6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004858, "uuid": "3d63c6bf-62dc-4573-aa1e-3abe116d75d6", "comment": "Malware payload (RedLineStealer)", "value": "06d4cfd155d05fddf481ceb6da93b5cf549b24f48dbb5810f2530acfb3a2db61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004858, "uuid": "b8778c1c-4ff4-4dc1-84d3-78cc822e8b4c", "comment": "Malware payload (RedLineStealer)", "value": "715b2a58529fea61d702c2e69bbe183adac55519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004858, "uuid": "e5e7cb58-7864-488a-9df2-189b677afddb", "comment": "Malware payload (RedLineStealer)", "value": "a3201ee5f5a41c841693910acb6069d7b4bd4fd2020e1d9da691c624abd2713e0205b657673747ceb022c133d911d147", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004858, "uuid": "6cfda615-7849-4d5c-ae7c-f55b6bc42aaf", "value": "T131549E10ABA0C435F1B716F889B9D3B8B93F79A16B6890CB63D516ED56356E0EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004858, "uuid": "e36b1027-7dc5-4598-817c-0599958429ac", "value": "ac14a22dc3791ebf7f4a67e197a18bc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004858, "uuid": "ac7817cd-1818-4f15-8a17-47ee12b47c5f", "value": "6144:nozUoAOEQCkuYzUQ96dYvBSXuZet0yS87Y8TgGCi1xMPY5j:nozf+QCbYzUS6dYvBSXuZet0yS87KGJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638004858, "uuid": "366ab7fc-6cab-4b71-a836-7060d33c090b", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638004858, "uuid": "0064abf6-44ec-4a38-87b4-bd286f01d54b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004858, "uuid": "f5801c6b-f1c6-46b2-8898-d2f9333486e2", "value": "cd597707fb381a907a17e77fc2732c6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a352df-4f60-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638003673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003673, "uuid": "1a17aa52-e963-4fa3-abc9-3b0de0893567", "comment": "Malware payload", "value": "55b4c5d61a0bfcda204943f87c4d04ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003673, "uuid": "ac516a10-28e0-4178-ac5e-9a7d2cd86a6e", "comment": "Malware payload", "value": "07646fb18d7e73a63320e927b37e4fbebabe1d6c7d7e3ac40cecd8a47bd86fe7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003673, "uuid": "d9fb86a6-aed8-4601-b9d3-448b83db1fe3", "comment": "Malware payload", "value": "1e5d059ff11c5a927aa7e0ddc3c85b34aa7b94bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003673, "uuid": "2a13c970-d3fc-47c3-99dd-c21518912ea2", "comment": "Malware payload", "value": "6b65fc855cf7eea278095145ff40abec263c48e01fe27589e84572475f4bbb2f03db2b4beac8942f64e96114fde3a830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003673, "uuid": "7baee79d-77a1-4225-83df-003adb7b6542", "value": "T1E2F2E19F73646C91F500BC7E5F8A9218E6A9813A21D86FF30FEE3054BCDB2A61047556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003673, "uuid": "4bd57c32-f236-4278-8fae-d2beb494ed89", "value": "768:T89rvn2khT1uLfwXrGut6lqJg83rcDfGhfSiDt0O8Obah8T:TYvn2g1QfwbGut6T83rcrcKoaWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003673, "uuid": "47f0aecd-b667-44c6-9aca-49c056a6d774", "value": 36879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003673, "uuid": "1a435b03-0de5-4b87-8e8a-84507fafcb99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003673, "uuid": "ada97a9d-72e6-4843-9b36-ab15255b6699", "value": "55b4c5d61a0bfcda204943f87c4d04ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1946e553-4f60-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1638003470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003470, "uuid": "ff206561-647c-454d-b10d-0e97584f325e", "comment": "Malware payload (AgentTesla)", "value": "5721a6fb9fa63d9dae7fe7174eabca46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003470, "uuid": "89bdf2b4-7241-40d6-915d-0f64019627df", "comment": "Malware payload (AgentTesla)", "value": "07c7fed6cbab81abcbefbb26528c467dea34f0d3311ced2b6fb3b9d880cfc35b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003470, "uuid": "e7578020-0fcc-4c59-9684-b23f84a4787c", "comment": "Malware payload (AgentTesla)", "value": "6bf938155765548e92b4ab728216c86fddc86075", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003470, "uuid": "71d6740d-77a0-47c6-bbe1-7edcdda70c87", "comment": "Malware payload (AgentTesla)", "value": "c256deed075acce86bf16a8a2af0dccfe034068ed1070739bb273771ca9dde97f331b4638cd1504db9c83541b87a39d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003470, "uuid": "c86c4f86-327c-47ad-9f8e-143173304de1", "value": "T105F3013EDF336629CFD99F3F01D3398658A500A13AC0D0FEA505E77A46BA4D46250ADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003470, "uuid": "0a0fd5e5-1c0c-452b-be92-cb14e8886da8", "value": "3072:JTkdLlXbO63/WbKfnRbUj1BLI1cf8wyYFBPAHz:+dLptDfnRyOdCF+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003470, "uuid": "2b88c833-7539-40bc-a953-cd0a0afb9ae3", "value": 164940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003470, "uuid": "e350db63-501d-466a-a344-df3782926c50", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003470, "uuid": "e5cc7a05-b2c9-49f1-8dab-eac123c243a3", "value": "invoice#6317236-booking.com,pdf.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c44978-4f1c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637974548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637974548, "uuid": "e1e9bf22-c4af-4973-bd19-65757d268ecc", "comment": "Malware payload (RedLineStealer)", "value": "bf1c0c4be6f214d0f6228fac5ded3f58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637974548, "uuid": "657d07e7-59f3-4b00-b2a0-b104153dc778", "comment": "Malware payload (RedLineStealer)", "value": "08381d5b4bffb1a943f62143f1dcd3ca6ff468e62c3499869dec4e4072f44bcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637974548, "uuid": "071fb22c-29b5-4deb-96a3-380037126f58", "comment": "Malware payload (RedLineStealer)", "value": "0df09def83c4996e423de4861827cf94861ef10a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637974548, "uuid": "2e3f7b86-c3c1-4f6e-8b05-c2bfb71b8bde", "comment": "Malware payload (RedLineStealer)", "value": "3383ff9eeb16602f07e36c1d8ac196f0cf98f4f0fe30c52035b74bc19e6d3f6989a6b177df23a5048e29ee60e6dc50a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637974548, "uuid": "32526ecf-712f-40fd-8b20-def6ca7ac98a", "value": "T1916533638609BD07CD0CEF7035F58A71EC297E1587946309F83A1B0ADB65638A3291EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637974548, "uuid": "380509b1-9bf6-4916-b689-c19b04917fa4", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637974548, "uuid": "7f57ddfe-9a25-44aa-a8a9-776161b81045", "value": "24576:FGtZ6awX7xCZ71vGVSiqRjv3DlQSK8ZesJuqjuXSU/wy6/kEaHNYK31/8:st+1CfG9A/xZpO5/w1/NaT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637974548, "uuid": "8f3e2d7a-a4eb-48f6-be47-6469dd4d8188", "value": 1466952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637974548, "uuid": "98aa3c01-1584-4837-bc02-dd65235dd889", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637974548, "uuid": "8ade7c4f-1210-4e32-a40b-8c805e7c73cf", "value": "bf1c0c4be6f214d0f6228fac5ded3f58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a16fde7-4f99-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638028167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028167, "uuid": "0467efc3-2ec7-4c41-b985-df4285f7f3c2", "comment": "Malware payload (Mirai)", "value": "336d0cb579ce4ca4e00195d5e7d21bf3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028167, "uuid": "64966548-d5ab-48e8-bad5-f54d62e0b2a1", "comment": "Malware payload (Mirai)", "value": "0af339fc0f868db9c9336971efb968dd707009939e6a20a134d8910eae8d3ae9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028167, "uuid": "e0e46bea-d09d-49b8-8a76-a437fd856f94", "comment": "Malware payload (Mirai)", "value": "4f192acd1f33db4be5acc43db3e9d600a9641a95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028167, "uuid": "98d59048-ee72-43d8-951f-619473363e87", "comment": "Malware payload (Mirai)", "value": "158d89628656a88ca11cd180d97b5037e0c0ea835c5de72f29c36fd8107255ff36cd87c960d5dd4a2180731d9b2d318f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028167, "uuid": "19a8711a-af2b-4d2a-9305-1fa1762e3286", "value": "T11C135BC9A683E8F5EC570571117FAB328772F63A5029DE83C75CDA32AC12A01E51B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028167, "uuid": "771c22f2-0535-4268-8bba-121c3228ca79", "value": "768:bXtDayI5AUH7s5d/dOOTC8d/7VXl2j5306VCxe78NXSmI4:b5ayI5vH7CfhT1dR453JExewXSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638028167, "uuid": "dedd3ac5-76b0-4ba3-83bc-5f247b590482", "value": 43700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638028167, "uuid": "3538d1cb-5965-42af-8725-8d36026f70fc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028167, "uuid": "467fa87d-4024-4c76-826b-1483cb083d96", "value": "336d0cb579ce4ca4e00195d5e7d21bf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce89ebd0-4f24-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637978004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637978004, "uuid": "13f45dd8-ba57-4f8a-b549-a4165bf57b55", "comment": "Malware payload (Heodo)", "value": "3501751984581cb78d43e413d2a91b07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637978004, "uuid": "4efebcb8-8450-499f-8952-81ff3c1db6f9", "comment": "Malware payload (Heodo)", "value": "0bff5abcc9bd52b0c2f69975a1f95c89e950eb0533503d827ca5362b6e10dad8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637978004, "uuid": "ad51d04e-bec7-44fb-acb6-681ede306fe5", "comment": "Malware payload (Heodo)", "value": "fa07dfedb7586cc71f45542a8ce063cfafeb71c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637978004, "uuid": "30d4fbfa-39f6-4762-afae-adb808a1e9e5", "comment": "Malware payload (Heodo)", "value": "b5c7398cbd7b12d37128f423d05713ce6ac9fc6e3fed62b57356ca15cfcb3d7ebac8318bd38b88d2b7ca55e48ff7d4a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637978004, "uuid": "12fc3390-baec-4b70-8abf-b95aee51e91b", "value": "T1B8E4AE1273D1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637978004, "uuid": "e8cf01ea-7ca1-471b-9e0f-971d0082a15a", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637978004, "uuid": "ae61c7a9-2dde-43a5-a28e-7e1b5cb5bb58", "value": "12288:WKEUkuAOLka1miSmuYr1V7uAobS3qTHPR101D:TEQLka1nBV6AoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637978004, "uuid": "27569acd-50f7-4516-931c-fbe7681e8904", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637978004, "uuid": "2b300652-3021-491a-a052-caf588b98215", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637978004, "uuid": "f03f6826-ed03-429d-89fd-b514f81a7642", "value": "3501751984581cb78d43e413d2a91b07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510ce7e4-4f8c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638022461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638022461, "uuid": "ed1f21dc-cbd7-4d2f-b9ac-ab2eef9948d5", "comment": "Malware payload (Mirai)", "value": "29cb03edd8b97afe1d3d95c0fc6fa249", "object_relation": "md5", "Tag": [ { "name": "BotenaGo", "colour": "#A337F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638022461, "uuid": "6591b562-3321-41db-b3a2-f5ce74351c91", "comment": "Malware payload (Mirai)", "value": "0c395715bfeb8f89959be721cd2f614d2edb260614d5a21e90cc4c142f5d83ad", "object_relation": "sha256", "Tag": [ { "name": "BotenaGo", "colour": "#A337F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638022461, "uuid": "c7fa867f-7455-4c2a-91fc-589577e2ca99", "comment": "Malware payload (Mirai)", "value": "01dc59199691ce32fd9ae77e90dad70647337c25", "object_relation": "sha1", "Tag": [ { "name": "BotenaGo", "colour": "#A337F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638022461, "uuid": "995985d4-ce4b-4cb3-a5f5-815c355b8cd5", "comment": "Malware payload (Mirai)", "value": "ab5301c62d1ddfc503dd82322005097579a0d2eaece2515050214393700832f0f68dd8284a0a0b1779f4daad6d58ba73", "object_relation": "sha3-384", "Tag": [ { "name": "BotenaGo", "colour": "#A337F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638022461, "uuid": "d2fa89ff-ef85-4299-a61d-dd52da815e4b", "value": "T105E56B16FCEA19EBC1BEF1348A9252627B717869433077D32F90997D1A29BD46E3D300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638022461, "uuid": "4f2685e4-3f61-480f-8e2c-12bab44659c8", "value": "49152:ybs5PbEK1vyChImkmtwmQ1He75nfX2/saawmWByFKfqI6TG5+C:2s5DDvyGmmFBPaa2BymYGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638022461, "uuid": "ea7c0c6b-7998-4f1a-a6b0-fa3d4a1d8a85", "value": 3241164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638022461, "uuid": "d15a24eb-9f20-4133-937d-ed3c0e09eb72", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638022461, "uuid": "19a9be1e-70a8-460a-bd3a-d08aa67fe91c", "value": "Linux.BotenaGo.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf1bc12-4fac-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1638036356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638036356, "uuid": "c7c03d03-73f0-474a-856d-6c2386351c0a", "comment": "Malware payload (njrat)", "value": "23fb23c32c346850115102c7c51d59a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638036356, "uuid": "82a52591-bdcf-454d-a3c1-b0934a61e26d", "comment": "Malware payload (njrat)", "value": "0cc7d034e9b01b5f02d0843e62c5ce0c79dc380fc3c126be71c8ad31ab8acad6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638036356, "uuid": "de649fe6-0e2c-41ea-9ee9-7c38b2cf5b8d", "comment": "Malware payload (njrat)", "value": "10d8d48501447675facadf07a656aaa9668cad5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638036356, "uuid": "021c467e-73ea-4236-896a-f562818d750a", "comment": "Malware payload (njrat)", "value": "d9e477a2549f20ef72ad439722c952f1f9f328505bf6ba8c4a82f0ac6d20739a936925ed09337dff46639cb15301534c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638036356, "uuid": "d234a6ea-47a6-4fbe-847b-f642664c0138", "value": "T1D9740145F2D246F3DBF54C3102E5A26EEB3923389350C8DBC38C29425652AC6A77D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638036356, "uuid": "2b4e4c02-c7c4-4e1d-baca-8994f6b8e8a6", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638036356, "uuid": "125da5e2-fc02-4e30-b85f-fc9d1ece5fcf", "value": "6144:a5aWbksiNTBGW3WuZoVPnbCuEng1y0Vc7Huk+3Wus6cuZyi:a5atNT4vTZEnb0S7Ok+VsuZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638036356, "uuid": "8b90ccc4-c4bf-40fe-8a0d-1bc722572bdf", "value": 364264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638036356, "uuid": "1b900040-26db-4603-b0c0-30b7e45a712e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638036356, "uuid": "40c9434f-0768-4d0a-be31-c21e14a0796a", "value": "0CC7D034E9B01B5F02D0843E62C5CE0C79DC380FC3C12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05bc49ce-4f57-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637999571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999571, "uuid": "09fb8415-649d-4802-803d-ba79371cf58c", "comment": "Malware payload (Mirai)", "value": "759ed43e05c2307fd0241a56f826d379", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999571, "uuid": "549fdf79-f976-470a-ac31-c451681935c7", "comment": "Malware payload (Mirai)", "value": "0cf14b5c6ebd2405a7a42eb6fb9fe3a9aba92246cc00ab17f48862c36c66bfbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999571, "uuid": "c0e85836-a19f-44f8-8d58-2bee6c88c6b3", "comment": "Malware payload (Mirai)", "value": "d3b49f7a23b82028c0caef3ec0586f607ba3d37d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999571, "uuid": "7765a741-f14b-42b5-be49-b8a41fde1c7c", "comment": "Malware payload (Mirai)", "value": "8a8483a4aaedb105d7f457e85d23818252a815de89543e019a11aa6fdcc6813a607bb4488a0c39d418744a8da5509fdd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999571, "uuid": "b51759a1-77af-46b4-85ca-93f961c6a3f1", "value": "T152E2E15E68E43CFAEECE483E12DE0459ED9B5495430ADFD9236244C0AE2F86DE59C43C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999571, "uuid": "db658f48-2c40-4670-a40b-7b4a90b829e4", "value": "384:e3fpCLrsjHIX69URc+hmnulY1qHprFKt6zNJpRwD9MH+Duvira0xda3lRWGVCz0v:SfpWcehzJFYKn7gMHRi3a3TWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637999571, "uuid": "abf13a12-320a-4466-9a74-1b15b3cafc69", "value": 31976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637999571, "uuid": "4ebb5334-9b2d-4110-804e-e29f636211b9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999571, "uuid": "fd71f6af-07ab-423e-80e5-0016eaf43167", "value": "759ed43e05c2307fd0241a56f826d379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ccc1c4-4f61-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638003975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003975, "uuid": "4b829d33-fe04-4aee-9484-edf96af14307", "comment": "Malware payload (RedLineStealer)", "value": "d5039ace0bf17c9f55a90224a4eb0f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003975, "uuid": "127ee972-ec73-4c67-8904-3cce4267872d", "comment": "Malware payload (RedLineStealer)", "value": "0e162233b79a835f69c38cc9a5c6e19e83b48ecefce9f1e22d41b44e5150cbfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003975, "uuid": "05427908-0175-44b0-999b-f6f6cc2070e6", "comment": "Malware payload (RedLineStealer)", "value": "ed15c1c1eced5f7fe76ec849fec49f00749f8ce2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003975, "uuid": "5bc150d8-e690-4c8f-9419-fa8846954aaa", "comment": "Malware payload (RedLineStealer)", "value": "40c891fd209b79df7ff14cd3a77ec25875d66c76683a8c7cdeee27ccb1bf1fffb320a7c0b3a45baa162046b96b125769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003975, "uuid": "f99359de-245d-4bc0-abeb-2d6afe55ba6b", "value": "T1FA548E10A7A0C438F5B756F889B9D3A8B93F79A06B68D0CF62D516EE5635AD0DC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003975, "uuid": "e418773a-4b03-4792-bab7-054db3c2f194", "value": "ac14a22dc3791ebf7f4a67e197a18bc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003975, "uuid": "f6d4403c-1d46-4318-97c9-6f5d50544c09", "value": "6144:ByC9y6O4mPaqU/ukBwTCm46dYvLSXuZet0yS8UY6p5iui1+Ml5/9YC1:BlRlmPLU/ugwTCR6dYvLSXuZet0yS8Ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003975, "uuid": "5f54d052-e2ca-4c30-9b0b-fa8b7ad9e276", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003975, "uuid": "3c60d33c-cc56-466f-8eb2-7371c3422117", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003975, "uuid": "6713f412-3fee-4921-a972-bb7806e80c12", "value": "d5039ace0bf17c9f55a90224a4eb0f14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48dd449c-4f5a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638000972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638000972, "uuid": "a04a22cf-52bc-4eb4-93df-2ba62095926a", "comment": "Malware payload (RedLineStealer)", "value": "6f3b838d4c7e9e6e628f88461245d8c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638000972, "uuid": "016278e7-8508-4120-b1ce-b4d9fa22da47", "comment": "Malware payload (RedLineStealer)", "value": "10bda8cde03ee5b25fdc120ee28e335de54de0c8afb18aee1dda4b302110d542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638000972, "uuid": "4f9669bb-07bd-428e-ac5f-66f6d747223f", "comment": "Malware payload (RedLineStealer)", "value": "87527bae4fae51331a3a7796bbbeb84493e38821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638000972, "uuid": "3c93afeb-1cd4-4d47-89ce-3d95ab1ec81d", "comment": "Malware payload (RedLineStealer)", "value": "66acb96435cd2e541469161e4a375b6358899bbb1cd1c82065843bdf6310b5af180f259a6b58f7a0db079c78b1265445", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638000972, "uuid": "b5b4c481-5d16-4abf-9ae2-0a29852c2ea9", "value": "T132549F10ABA0C435F5BB16F889B5D3A9B93F79A16B7890CF52C116ED4635AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638000972, "uuid": "f7331a72-0706-41f6-a527-c0d655571ae4", "value": "ac14a22dc3791ebf7f4a67e197a18bc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638000972, "uuid": "8bb6d1e8-7971-47c0-98c1-295485dc19bb", "value": "6144:cvjHm+R7N3Jahk0/jCGb6dYvrSXuZet0yS8/YJ0DrCni1XH2Aujj:0HmiN3cx/jCe6dYvrSXuZet0yS8/3/CT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638000972, "uuid": "6eee7181-fd7a-435c-b299-d8e21f59ab5b", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638000972, "uuid": "0912647a-f29b-4402-994e-b6e514d8c96a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638000972, "uuid": "7b33a73e-bf9c-4e62-a62c-2f0bc1663540", "value": "6f3b838d4c7e9e6e628f88461245d8c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a261ade0-4f8e-11ec-843c-42010a9c0014", "comment": "Malware payload (IcedID)", "timestamp": 1638023456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638023456, "uuid": "cc2adb6e-8d62-47b1-be43-6e9bef792f97", "comment": "Malware payload (IcedID)", "value": "5cb0eef07236f9c8e1a283cad056d234", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638023456, "uuid": "b5c33546-ca1e-4335-b61a-3b1d3d454af7", "comment": "Malware payload (IcedID)", "value": "14d95ca0c65a501530d76e66ac2d0afa0711e352476bd58e0204534af400fe08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638023456, "uuid": "203a9f21-ee2f-4dd5-b2bf-6cddef0d2b7f", "comment": "Malware payload (IcedID)", "value": "c5a03189baae18cc31b41c4c6aa77b60cc34f423", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638023456, "uuid": "55df57bd-9d7f-4cea-9b69-1c95e3047bc7", "comment": "Malware payload (IcedID)", "value": "d30330a2aab13e5f5e4cdc63bf0177270ecf5ce53aea251a790117bb9b6e6a3662c96082107f321fbf1296b543f65439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638023456, "uuid": "2c03beaf-dcc4-4426-895e-a1005d7576e7", "value": "T1CDF38E03729500EBF5718971A8A35604E372B96217389B4F93909B3A1E3FBD09D9FF64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638023456, "uuid": "81a8eb75-d48f-465d-9de9-20211e30e26f", "value": "7a8f5c045c96b48f56193a62510f2131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638023456, "uuid": "f80e2939-8517-4574-82d1-61f863a90d7b", "value": "3072:9wZDE3irQ+r+4rLczkGq9n7zCXCdFMYNzomW+pt79s2:nirQ+r+2aTq9CyYYNzoP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638023456, "uuid": "4370f328-3a61-46ee-b7f0-c55cd058ec3c", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638023456, "uuid": "c62675f6-eef2-43a2-ad4f-3dcc5998f219", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638023456, "uuid": "9797d67f-261d-4e6a-a812-4cd884fcc93a", "value": "14d95ca0c65a501530d76e66ac2d0afa0711e352476bd58e0204534af400fe08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840cc5e2-4fcd-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638050464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638050464, "uuid": "72158ddd-385b-4f59-b782-df6fdf00cfc6", "comment": "Malware payload (Mirai)", "value": "9cb9dd0ac2e453db3c104e34c51ee4e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638050464, "uuid": "dd09b268-707e-422b-a0dc-4d60222cfe18", "comment": "Malware payload (Mirai)", "value": "159f100e995e597a957cbfcd7f5dde261dee42f7fe14e5d545e90f525991db31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638050464, "uuid": "64edba0a-5a32-4806-bbe1-e6e820c72d25", "comment": "Malware payload (Mirai)", "value": "01195ad763cc7ee2f42ea5f66b955a674d3b66a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638050464, "uuid": "beb1e0fa-fd0f-459a-b025-d338320b2cb7", "comment": "Malware payload (Mirai)", "value": "c639ca9d4809e950b63cfc32a447c281453b633081ac223f59ef9fe2c108d4e390f24da58ea3ebf52c7f84a10b45c216", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638050464, "uuid": "611c81fc-06ab-4032-8e9a-dd06b8d2ad3a", "value": "T1B0F2E122DA6DB6E9E5B01D364C3CCF82B3824BF6C47D79A629FD1B052C428511E6C1D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638050464, "uuid": "64dea6e6-4cf4-4670-9e2e-ba34a538321e", "value": "768:XzNtpmCzcmI0b7a3dNfgaZs6Zgfoao1rADwdr9q3UELHX:XnpR5I0b7INrZs2ggV1ruL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638050464, "uuid": "6f5008d3-041c-41bd-a7a1-1ee218fedbd4", "value": 34472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638050464, "uuid": "c249407a-6f7f-4f09-8186-b1f89d6d686c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638050464, "uuid": "ccce4d13-b16c-4884-8329-24fec932020b", "value": "SecuriteInfo.com.Linux.Mirai.791.16681.31108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc91355b-4f60-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638003770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003770, "uuid": "e1718788-bd6f-4695-a68a-57d8486bcda5", "comment": "Malware payload", "value": "157534e3ffabdab40cc2eaeb2c1f8927", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003770, "uuid": "a276fdbd-579a-4c64-a9b7-9d6c494dce0d", "comment": "Malware payload", "value": "1753115b8f7f3c97a2be7be49357e317faf83fad7baee960ec4e995b6a6382f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003770, "uuid": "4684263d-4883-46d2-998e-14a6be712b9f", "comment": "Malware payload", "value": "0d5160666e71dd146e5a5d74faa4ceb4b3016eb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003770, "uuid": "a5a28284-093e-405c-b298-a7f40440f430", "comment": "Malware payload", "value": "e8f5451c312de14939e804594d9c930f066ab8a87748199b29bc5be82d94fa44e5d097a63bafee82cc712eeb97d2193b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003770, "uuid": "bb36f18c-1cf5-47a2-8679-6136d497a991", "value": "T1D3D28D84AF356633E248EF7A0F1597152692B47E43B42C39286C7CF49E7028127FB99C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003770, "uuid": "1c3b5b56-c2b4-43fb-8149-3c2a50a48c1f", "value": "768:8R/+dwu8+AZOkFtEP6bvFvpcIwpBmT6D5xOMf:8RWdX8T3mkAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003770, "uuid": "0fbb1b68-aafe-4d37-9505-e7366d0f5f29", "value": 31089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003770, "uuid": "1573171a-20de-4083-9b87-4e873f881c19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003770, "uuid": "b7f56299-cd66-4f51-9b73-b535b7c9ae3a", "value": "157534e3ffabdab40cc2eaeb2c1f8927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beab3d84-4f5f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638003318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003318, "uuid": "fb6572d4-df3f-4ce9-8620-88fbcfdcf23a", "comment": "Malware payload (Mirai)", "value": "b7214351e21f0b1324b556809a1076ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003318, "uuid": "ee4d3c70-134e-4731-a9ca-6e8c13f777f4", "comment": "Malware payload (Mirai)", "value": "17630ee801f5665c5ef5eb8ee41b20c793a25c9a5ad6c4f32905d6e509c1d9ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003318, "uuid": "8bd80d64-3d2e-4186-8aed-613e889b3b2f", "comment": "Malware payload (Mirai)", "value": "5fa7c6800b00f5440472aa525d42b2efd30bb79f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003318, "uuid": "d278dea9-ab52-4ce4-af9a-65e6a5a06afb", "comment": "Malware payload (Mirai)", "value": "f7cf14c84e76deb266bc3305ea4839753c1518f1685c55db4d343db955b158f66d92cd65ec70f788c11b956320ceab38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003318, "uuid": "b1f58e73-1a9d-4bd6-88f6-ad3a835c799e", "value": "T16293744D3E219F7DFFAC823887B75A21964823DA66E1C585D05CFA021E7034E741FBA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003318, "uuid": "0503ac02-7457-4121-bef3-c41f31e1e118", "value": "1536:4YRS2cWY6f6utWSVSDYFMMwqZ9adit0vf7y9vnk5zlf/A4mq/rrb9IK2M:1I2cWRyutWCSDU9a20Hm9Azlf/A4mur7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003318, "uuid": "79324e83-2370-4c60-9f35-c9104915399b", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003318, "uuid": "4b1efe9d-77ce-4bd7-ad20-d21aa2207b0e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003318, "uuid": "f891d5a2-7f51-4b15-8f3f-1da030b23696", "value": "b7214351e21f0b1324b556809a1076ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4a796c-4f5a-11ec-843c-42010a9c0014", "comment": "Malware payload (TeamBot)", "timestamp": 1638001272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001272, "uuid": "5ebd7ae7-313b-4c58-a002-3516c1e26fd3", "comment": "Malware payload (TeamBot)", "value": "5863ee77bdf2f8fe7955b4eb9e8e2b69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001272, "uuid": "bebb30a3-d0bc-4eab-b766-b2af5296da32", "comment": "Malware payload (TeamBot)", "value": "19019311222c7226c5ed48eaec321e411b836f171be5d0f429bcd3914ff2ee8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001272, "uuid": "d96a6d70-d2df-4ada-8b2f-c746092ce152", "comment": "Malware payload (TeamBot)", "value": "4f77690cd21d3779846c6f72c74702563a554e45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001272, "uuid": "79b76015-bcd2-459a-9355-29ca7e892e0e", "comment": "Malware payload (TeamBot)", "value": "058966fa9805d67a64216373b388e4b3ee8013a0a368d2a4bfc9620610b490603d16243c51478728944c438be2159948", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001272, "uuid": "71477cd2-3503-4654-b910-015b941be371", "value": "T13F549E10ABA0C434F1B716F889BAD3A8B93F79A06B2890CF63D516EE56356D0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001272, "uuid": "b2b535ca-8170-4a39-93e1-5d610046c09d", "value": "ac14a22dc3791ebf7f4a67e197a18bc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001272, "uuid": "21931fda-34a0-4363-b6c5-78f99d4f0529", "value": "6144:jLfQGqOBk+wDXG8D6dY+rSXuZet0yS8HkYqTqCui1zhSyh:YeBDwDXN6dY+rSXuZet0yS8EmCNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638001272, "uuid": "06619007-f46e-4464-b354-bae801db5710", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638001272, "uuid": "3e14b206-2b59-46fd-b718-c712d37840a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001272, "uuid": "cb43d099-52c7-4882-8e41-a8a2508a3110", "value": "5863ee77bdf2f8fe7955b4eb9e8e2b69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec4366c-4f5e-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1638002647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002647, "uuid": "f595c26b-6725-427f-84bf-d18854b6b9fb", "comment": "Malware payload (SilentBuilder)", "value": "221465ff1ee6ff1bdd0b86481ca23aff", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002647, "uuid": "7c4baedc-8417-4945-ab35-fecb1d3406b8", "comment": "Malware payload (SilentBuilder)", "value": "190367cbee3b5c9dc2ffc43fd566aeb40028ce674dc86af50df938be94ef78af", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002647, "uuid": "2b08dcf2-7c1a-4904-918d-f77887498ccf", "comment": "Malware payload (SilentBuilder)", "value": "6161e166a3d6c6efff737aa6de5645b81c63e35c", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002647, "uuid": "42375ab2-4541-4fa1-84f4-27c971082dfa", "comment": "Malware payload (SilentBuilder)", "value": "a1af02dc0a6e5379405dd61232802de91ecc99d8932c6c1eccadfb63e333f969b59c41c2d14dd7efaf996137c9b33b11", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002647, "uuid": "8ca3c10d-e592-4cb1-8dbc-892700545e00", "value": "T1E434E046796CC8DEFA57833148C75BAAA333EC204FD71A8769C9722C6FB4DB47912006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002647, "uuid": "c656d3d5-73fa-4ca0-ac2e-71f576c4ca00", "value": "6144:MKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg0cfZw6th1j7kVWyOqMg63OjzmvN8DMdP:tZrth1jE7XriNl8DaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638002647, "uuid": "2fa0d766-6add-42a6-9ebe-ef6f01c6e93a", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638002647, "uuid": "1a8bdbb2-3df3-4b03-a73a-bfc86d799e79", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002647, "uuid": "834bbdb1-54ff-4acf-9c30-35529986b9b1", "value": "research-1186335980.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64b9ff3-4fb2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638039005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039005, "uuid": "5b0df0aa-9801-46d9-8a1b-718545602b6c", "comment": "Malware payload (Mirai)", "value": "48e5b6262242fe9f7f16f818d4457079", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039005, "uuid": "767c2166-3c2c-494e-9f14-acec89766f89", "comment": "Malware payload (Mirai)", "value": "1942ee8f1640ac90db55793c7865d9864e569458842ebe209d89ab468e32688a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039005, "uuid": "45ee0ad2-dad8-4538-aa35-a0e82990297b", "comment": "Malware payload (Mirai)", "value": "c72dfe76a73c64a6c64ca75a3dd9c83af3007d73", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039005, "uuid": "19465b57-fd11-4c2e-9285-68a4bd4a5cbb", "comment": "Malware payload (Mirai)", "value": "12d0c39dd88433f39ec04c2b88e7f40fc018c280e379e52b4fb1ad199abd63f17fc80422f6edf621b719353145ec98c2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039005, "uuid": "aeed49c8-0066-406a-8e15-ae34dc294c5d", "value": "T133D2E1E1EA01E0B0E7B16876E258C6CA1F2797B5C4FF303231155BB856D622A7AF4313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039005, "uuid": "c695daf0-6d4c-4333-a7dc-a5e1954b1fc2", "value": "768:WDbWUQ+4hTbBbxLLQ/3kz6PLSeLgs3Uozg:WD5Z4BA3oazg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638039005, "uuid": "8495ac0c-f434-4808-9124-1d242bbde4c6", "value": 29852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638039005, "uuid": "07fc8e3d-0b41-417b-9c3a-2b07d0c69a7e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039005, "uuid": "41466d65-8a6f-4dcb-a526-d7871a82e8c7", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d32d89c-4f7c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1638015690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638015690, "uuid": "6b08d763-c6aa-45ec-bad5-cedda12a8fe4", "comment": "Malware payload (Dridex)", "value": "0f1d208f14588d32e416bc2ec977dd45", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638015690, "uuid": "ea9b04d6-22e9-4053-9f36-8316cb77ba32", "comment": "Malware payload (Dridex)", "value": "1d9299ca6494ea38d568ed081637abfa3dc0e49fce1b37ac327b2f37a9103e44", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638015690, "uuid": "4d21b9c2-8859-4545-a384-aa1150b97f8b", "comment": "Malware payload (Dridex)", "value": "dc288d5be0d26317ffe25d661e453e1c285e7144", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638015690, "uuid": "18b2b2e5-4772-4188-bff7-11d7bc57a3a6", "comment": "Malware payload (Dridex)", "value": "9d256234bd1084b5e6df8c8ae2aa1d7b1d592bc0689992c14dc7b0d9a9a9f9b04995959fc0f29caa47fd21cbbf60a5a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638015690, "uuid": "18acd419-a3ea-422d-b01b-c2d9e45cec1c", "value": "T15973F11D85A575B1EA81FF3DCF0D28E299562F668D006E4B148DEADC0276183EF4B70B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638015690, "uuid": "68adb862-3594-4310-9239-50ff4530c3d4", "value": "1536:UWyPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5hTyhYVJ9aJoTIANk3Vgdpt:Vaqmc3/q0dfaguKyTiQ/Vk3Vgd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638015690, "uuid": "c4e6aeb7-2abd-435e-b289-b419a7d6759b", "value": 79701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638015690, "uuid": "7a1b84aa-c491-4620-aa06-e89bfb3d228e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638015690, "uuid": "e943de99-f3b7-4f10-802b-856c3750a7b0", "value": "sale_coupon_59686363.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c93f465-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971370, "uuid": "429324b3-2a70-495c-9313-bd365735aca5", "comment": "Malware payload (Heodo)", "value": "432bc0cbb56dbaea15a4545fcac2ef65", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971370, "uuid": "7455b2e1-e7b7-4777-8ca8-f851c6fd3b30", "comment": "Malware payload (Heodo)", "value": "1da480b7cd1f6753c8b8889d3e30fe16c320ceeadb6d9e401011d0688b6a76e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971370, "uuid": "6bf824e1-c060-489b-b064-f022b56396f5", "comment": "Malware payload (Heodo)", "value": "75af00dd5431c3fa938d9d2a4631c336bbc1609e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971370, "uuid": "bc6082e8-9b57-47b1-8e0c-0e440ddb4a0c", "comment": "Malware payload (Heodo)", "value": "88f76eb8cb451e6ad4751ef7c9bbff5416a93c01616a11c25134d0738036bd47f0818f28efae84d17f8f377419f3d119", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971370, "uuid": "5b55d1dd-a5a7-4a2c-ac87-3992ca02a0d6", "value": "T179E4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971370, "uuid": "03d167bb-7439-4097-ab47-bff86438b5df", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971370, "uuid": "e9820014-468c-49cc-931a-add31347bde0", "value": "12288:FqQlvIOH0GCTBHmPt4eBQh7ico09cDlB4Vx/ID:0uH0GCNeQFi7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971370, "uuid": "977edfff-e1f6-4b90-b7fd-abecb17b0eeb", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971370, "uuid": "88d66628-57ec-49d6-af7e-a53a91e2af81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971370, "uuid": "40d6a40b-4b60-4d9a-a1fc-4983274b3c3c", "value": "emotet_exe_e4_1da480b7cd1f6753c8b8889d3e30fe16c320ceeadb6d9e401011d0688b6a76e1_2021-11-27__000244.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92bbb019-4f41-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637990359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637990359, "uuid": "07990bba-83ca-466a-add4-0f52b2049fda", "comment": "Malware payload (Heodo)", "value": "fd67a2687bfce53ed2c3ba0aef4c23fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637990359, "uuid": "70673f2b-9500-4278-b98e-4f3d204fbacf", "comment": "Malware payload (Heodo)", "value": "1ebca21b3440fbcffb821d7719d58bb741345cdaa80c018063ce4a758f967759", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637990359, "uuid": "d9f02037-348e-4758-b193-78ba63cb26d4", "comment": "Malware payload (Heodo)", "value": "b4f9e019d69d43e74cb8fb6375357101b68de9cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637990359, "uuid": "a8c4229c-53ce-494b-8a6b-2e420ce93a96", "comment": "Malware payload (Heodo)", "value": "afc34c147023e1973a2cbba667207c8d07da59fb2b289e0214d40d1b0318417e3694c5cd1a46d1a5c38bab5aa423f886", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637990359, "uuid": "563b9d09-11aa-4b00-9ab7-d7ff724398f9", "value": "T195A4CF11B6C29432E1BE05303978DB5608AD7D318FB4CAEBB7D82B2D4E741C19B35A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637990359, "uuid": "700c69b9-9785-4c80-a6b6-a24f3c57676f", "value": "d2a2f4c68a7903cc45764257f8ed7a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637990359, "uuid": "dfe4f5a8-e882-4841-9939-22a3e181a254", "value": "12288:+AriSOG9c0jc5mDQxqfFR4iTQG8Ht3WZ6y1zTV3z1:vof4DQxMn4iTFUVWXpTVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637990359, "uuid": "61e73e87-8b9a-482a-8cc4-cb7dac3ba2f1", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637990359, "uuid": "838c7323-429b-49bf-a41a-51d5bde58494", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637990359, "uuid": "f3ea22c1-cdae-4bd1-b316-4cea5106eac5", "value": "fd67a2687bfce53ed2c3ba0aef4c23fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2691f12c-4f5d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638002203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002203, "uuid": "092e6039-18fa-41ec-8376-90d7693a5ede", "comment": "Malware payload", "value": "583759b841c9029be63fb1f81cdfb443", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002203, "uuid": "27201941-7d32-403e-8625-4142b46c9337", "comment": "Malware payload", "value": "21b4d82fafbaeb8b0b9ba45ccfc7538986528cd9c279425fa4cbf15e8dc0fefa", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002203, "uuid": "21a69daf-bf74-482c-9366-0d6dda60c772", "comment": "Malware payload", "value": "eaf476e635a5f2eaae402cf941fb1e847be1ef6a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002203, "uuid": "49691965-bc5d-4e4c-9f20-00830543869e", "comment": "Malware payload", "value": "7b0be6d605a79efc89851928783157068392e36e7295544deea94e7a79beb39eca1cc00e3ae46ac4bc76415323bbbbf0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002203, "uuid": "e30b8b39-674b-442c-8c65-c481112bf55f", "value": "T1192240A4484685A0F64758C028AEFB3206F0F0DBF4D568732BABD871DFA55152E918BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002203, "uuid": "474e8ecc-084b-4ef1-9afd-9fb61a8d091f", "value": "96:MuCpEMvALqmwEzBUG5VoWx2BAMyRFVSiklzx8EpqOfNc/eGy4hOk1Nxr7G:zCpEu5mwEtUGZxEmVSdVoC2NZwuNxr7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638002203, "uuid": "6afa4979-fa5c-4906-aba4-e0cb1b733517", "value": 10813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638002203, "uuid": "e11d969c-ca89-4715-a023-95aaf6048e12", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002203, "uuid": "944709cc-df80-4fb1-bc38-e634a89d6864", "value": "Payment.Doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a429f9e0-4f62-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638004562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004562, "uuid": "bda80829-9ce8-42d8-a0d2-fa05548a4775", "comment": "Malware payload (RedLineStealer)", "value": "ee24dafeff5800cf27ce6db371c17843", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004562, "uuid": "f30004e7-c537-4757-b618-862b03580f6c", "comment": "Malware payload (RedLineStealer)", "value": "227f7e0b6720c0efc709d592a59308bc60df849b1adb3b7336659aeda72b597d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004562, "uuid": "12f09ef8-26c3-47cb-a745-3865718d582e", "comment": "Malware payload (RedLineStealer)", "value": "cbaae7d83abff37acddfcdcc7349f8c0a3562ef3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004562, "uuid": "8201d2fc-6303-4795-9ea3-21bd7236de91", "comment": "Malware payload (RedLineStealer)", "value": "c706370ba21b21c0f3786457d9f76b6d230d01509950bbae6e84310df8015ca14ad2d298033e03245005db3c5d7a6fc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004562, "uuid": "bc441e11-672c-4597-ad58-35f0f98afaea", "value": "T1AC549E10ABA0C435F1B756F889B6D3A9793F79A16B2890CF62D117ED4635AE0EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004562, "uuid": "02033188-130b-4d67-9e52-333456e9e2a0", "value": "ac14a22dc3791ebf7f4a67e197a18bc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004562, "uuid": "40010ff9-9038-467c-a068-9f83071f35b0", "value": "6144:7ANJgBNYRbAJyqjtzwkqpw+hmQ6dYjLLSXuZet0yS8SYoXviui1KNF3xik:kgHYYyqJzwXw+hJ6dYjLLSXuZet0yS8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638004562, "uuid": "43eadae2-4ddc-4684-a27a-f24b68b7eb98", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638004562, "uuid": "a153bcc4-3efd-4421-928a-22c31ca237b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004562, "uuid": "08cb6bc4-c21e-4252-942e-f3719a8dc819", "value": "ee24dafeff5800cf27ce6db371c17843.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73b21f4-4f7f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638017130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017130, "uuid": "49c533da-f8ce-4789-a3e4-acdb7671f8c2", "comment": "Malware payload", "value": "bab31b2d9e47a912c6ba4409708c2f08", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017130, "uuid": "b75aec26-9f54-4c42-bc97-4ffcc69bbb57", "comment": "Malware payload", "value": "22f2217318eb3f90e119e30cf30908ea3f3ae7631fcb4102d666761b297aeb49", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017130, "uuid": "b6aa80de-0d7e-4515-bfec-af05be3e273e", "comment": "Malware payload", "value": "6995b7958d784fe4dbfe8288c17a4dbb3f29f58d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017130, "uuid": "30822820-dc61-4ce4-919d-6738cc0b9ecf", "comment": "Malware payload", "value": "1ac75f164613b95618d7721790b5efb5ae2e19f596e97244dccc49da9145eb2e79c59b7251d343a7348028156bd9ac7b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017130, "uuid": "902b704d-2911-4c21-9ae5-52e99a4c7533", "value": "T16F64AE5276C2C0B6DAB311B18A16A33EB3F6A6004B3B69C75BD51C205B355C3E73E71A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017130, "uuid": "d2f7a3fb-497f-49f8-91d3-be9d2d892990", "value": "6144:WKEUPDI8HTI4IPualOM8Vka11WqQtXwpomuU3rNOW1V1y:WKEUkuAOLka1miSmuYr1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638017130, "uuid": "299b907e-69af-4572-9fd5-1786d660c6b9", "value": 327272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638017130, "uuid": "e38fa170-1dbd-4e8a-88a6-866fe847d49b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017130, "uuid": "bcdb5cbf-7d20-4e49-8f17-be08fc32bd6e", "value": "emotet_exe_e5_22f2217318eb3f90e119e30cf30908ea3f3ae7631fcb4102d666761b297aeb49_2021-11-27__124524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58be95d8-4f2c-11ec-843c-42010a9c0014", "comment": "Malware payload (BlackNET)", "timestamp": 1637981242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981242, "uuid": "cc3532e4-b2fe-4eb1-a647-a0137457be50", "comment": "Malware payload (BlackNET)", "value": "a0ac9c83e1bc5eaa9b38110495271fca", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981242, "uuid": "02884754-befe-4f4e-9f6a-5bf4aee721e2", "comment": "Malware payload (BlackNET)", "value": "244334e5785b37a3968287bf88eb6ac6ab2715126af65c4797aeb4cb5e11906e", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981242, "uuid": "26d8e637-10a1-44f8-b615-56dfad656ced", "comment": "Malware payload (BlackNET)", "value": "1b97e08bd3c91554b3c06335bbc6dc352c46854e", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981242, "uuid": "40846dbc-0075-4200-a5a0-d8513b698a27", "comment": "Malware payload (BlackNET)", "value": "61decd14ff510a7d20b5f07f74c398f6573a847400f8b6fe2c8bbe6e06c09a1b6baec6086e35154700ca81c8337e02b2", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981242, "uuid": "3f1f4a58-8cf3-4669-a527-2f73fad16e50", "value": "T1BFA3C50377ED5C59E0BDDBB4EB725280C7B5BC265A22C66C0CC560AD16BA742BD01BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981242, "uuid": "37301d11-8ddc-4baa-92b9-b1e43b6b860d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981242, "uuid": "28adb337-992b-440b-b41f-2a7849e2501e", "value": "3072:DdiJbUhy+ReTTYB+eztx3be/EKygFnaO:pEWyfPYB+eztlboS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637981242, "uuid": "e35c7551-3e12-41ce-8c1d-274d9716f82a", "value": 101888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637981242, "uuid": "f4308738-33ed-4f4f-bf70-dc6721aa86fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981242, "uuid": "1a6a8c40-a0cf-44b7-b3f8-92f116864612", "value": "a0ac9c83e1bc5eaa9b38110495271fca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfffb6a-4fd4-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638053403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053403, "uuid": "02a542c7-2fc8-416f-8931-dc9755c2543e", "comment": "Malware payload (Mirai)", "value": "48e854e8724224e13c91de2b771873d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053403, "uuid": "a7ee0466-7e2c-4595-bb74-1448d5826f46", "comment": "Malware payload (Mirai)", "value": "26923dd93ba61804596afa035f57f547c614edc57e0e7ecddcdfbb12eb1f4e7c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053403, "uuid": "7252a36d-ec5a-4e10-ad78-9e894e5df308", "comment": "Malware payload (Mirai)", "value": "c07afd37b780deb173ac34e2d9a454f0ec17d57c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053403, "uuid": "5809096c-f832-470a-8b30-a402461decf0", "comment": "Malware payload (Mirai)", "value": "bb9fbaf49cfad361361663d7b20e051a1c100c202ad8149b64ae1a7e738df23929bf8b39bb4d9af5443a21959b1493e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053403, "uuid": "6f08e45a-7727-495e-8da3-c58c3f720b68", "value": "T1EBE2E16986D7420DDEDCB7F3E4CCB4A20CE2155127BF8F612D2D48C6225B1D963D0EAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053403, "uuid": "c677334a-71ee-46ae-ac0d-5bd3a31344a0", "value": "768:Wq3yhi2rg98FdmvPyQw7NABkcEfwVyVVtXIXJ4N9VcaHEbKc:ViFdmvPgACcEfwVOsXJ4uUqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638053403, "uuid": "77441e75-5b83-4549-82db-aa3dfabbc0dc", "value": 31336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638053403, "uuid": "e5d19942-5bf2-4fcd-8fa1-6d864a5351f0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053403, "uuid": "953c38f4-d6e2-44e8-a4f1-c6ffcc54e272", "value": "z0r0.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49030c45-4f3a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637987229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637987229, "uuid": "2cdb1a07-9f68-4328-a24c-597cb6541866", "comment": "Malware payload", "value": "8d1961a42fe5ef99d1ae6e09f5affdda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637987229, "uuid": "38a906de-9f20-4426-9367-e24a04f09f99", "comment": "Malware payload", "value": "28261c8182fce1052d9269f162bc6ede6fea144eb71dd73c914442bf01190555", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637987229, "uuid": "56d83e4b-d7ad-4b4b-920e-c0176193ecd6", "comment": "Malware payload", "value": "4bb9ad845329385497d16b34ae439152b9fb469a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637987229, "uuid": "1b80961b-fce2-418c-addc-d3d54e55d565", "comment": "Malware payload", "value": "9ef842aa8054d2a064eeca6c7abae92caa58983a0bcce9291d164c265dc40ddd3c67b3306ab70dacedeac9b39e76aa64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637987229, "uuid": "1cb8f946-512e-4be1-b2c2-84da9a348ebd", "value": "T11692C090D6986EF7D7AB2FB81E91D7463F314DDE11720DAB119A7F4028128360706ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637987229, "uuid": "1cd2013b-8a23-451f-8f8f-75599d860623", "value": "384:0kNNVQLdfKM9+nSWS+MQBMwZxgqyHh9h9HE/OAozMqzM4uVcqgw05VxJI:/shF+nSWIQBMwZxgtDHVMqw4uVcqgw0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637987229, "uuid": "48d52510-100d-455f-bad1-c07143b531ec", "value": 19676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637987229, "uuid": "71dc2655-0f42-427e-8b4f-b3d9472819d7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637987229, "uuid": "3c853429-fd67-49ca-8660-f248169aa26a", "value": "8d1961a42fe5ef99d1ae6e09f5affdda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e43a356-4f3a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637987238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637987238, "uuid": "e6cc14bf-4d90-4ac5-802f-4e737fc8022b", "comment": "Malware payload (Gafgyt)", "value": "9e47ee0b4957759c4d0a4666714490b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637987238, "uuid": "10a2c0d3-1503-4edf-9418-1d7478e91cee", "comment": "Malware payload (Gafgyt)", "value": "28d1c99deca60938d203b4fa72f24b9abb66864d49790738ec24be732e9f703d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637987238, "uuid": "53669d62-5d14-43bc-b765-1a080b235337", "comment": "Malware payload (Gafgyt)", "value": "85892e6b7e1bd9064274ca2a21b0ef80f0676b30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637987238, "uuid": "2ee8f76d-4233-4757-ac25-ab701c652e83", "comment": "Malware payload (Gafgyt)", "value": "3b5a27a3677f94ea20d81cc5f8ba04339637b0b3aa78308dc80eafc2b4473eb12c1fdc422a44b89979ef1b1bd5d9266f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637987238, "uuid": "332d77ff-a3da-400f-9965-8a6e2c0464f4", "value": "T14913F8D7F901E9BAF81DE73B8857040AB230F296069217723767356AFC761A40477F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637987238, "uuid": "be417967-d87e-4a9d-9a44-f06fc3514819", "value": "768:uorEvv6Af0Rat8OiAuOyOGWxODW8Re/u1EYCeh5rIah:Yv63Q8PiyO/xOaye/u1EYlhh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637987238, "uuid": "a0b4b64b-bf56-459d-bf5a-0c137ad9aade", "value": 41896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637987238, "uuid": "0ea74120-8c17-4f1d-bd0d-962d66acbb74", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637987238, "uuid": "bb797ac2-7154-4995-ace4-8af330b5f2f2", "value": "9e47ee0b4957759c4d0a4666714490b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870bb784-4f60-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638003654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003654, "uuid": "cd6bbc1f-0913-4efa-9498-fcb7a1a4b2bb", "comment": "Malware payload (Mirai)", "value": "7dd9c88d18374cdd457f15d1de3f8b49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003654, "uuid": "f4e324d9-a70a-488c-aca6-693b0637ddbb", "comment": "Malware payload (Mirai)", "value": "28f13802f1d53809f4904c2fef08a6c3702fe029d12b96fd3d922ddc304f65c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003654, "uuid": "fe6e0790-570d-45bb-b07d-1128430af728", "comment": "Malware payload (Mirai)", "value": "f1528d695b01479f5926cfa86c5073628392deba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003654, "uuid": "976417d0-ad10-4adc-8b64-598e044866d2", "comment": "Malware payload (Mirai)", "value": "1af00b8a3ce05fe690d9e4f70d815a2e75d391082260bef84138a9333b03739517539d7495f21de07a7b0222e257354b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003654, "uuid": "c9368896-f07c-40ef-abfc-4faa95bd03b0", "value": "T11E534B0277584F0BFAE61AF0283F2BD483AEED9025F5B585690FC7454635E33498AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003654, "uuid": "f120ad22-df01-44d4-9d65-00df58ee1184", "value": "768:mqtLpKS5kki4+uIioJXYRbviJZEYEk5V3teE36a17W2WHa8f4qqDA65PEBXsVW:B9pJEKbk5Kibto03DT5PEiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003654, "uuid": "3013bd44-725c-4477-a80e-9ba7be464ac7", "value": 66476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003654, "uuid": "4e697ddc-44f7-4067-9358-a718d9b3585e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003654, "uuid": "ae1a000b-9f68-4571-b7ab-164ac420554c", "value": "7dd9c88d18374cdd457f15d1de3f8b49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94536319-4f99-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638028157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028157, "uuid": "0951aa02-509b-4d3d-b62f-ed6d95dd6a46", "comment": "Malware payload (Mirai)", "value": "62bc0831d048a1b3bce374d48c0b8186", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028157, "uuid": "b685ebaf-3614-4ea9-984d-bc4ea53edf02", "comment": "Malware payload (Mirai)", "value": "29511710378a51f4b143efa9fce9d19390788419b73250ee7138600b81db66ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028157, "uuid": "81f5c64b-e1a8-48bb-8643-860f4e7c0a86", "comment": "Malware payload (Mirai)", "value": "92822b41ab53fae22856edba451b1acbf9608de1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028157, "uuid": "2ca799d6-e7c3-45ec-b98a-a6b5e381828b", "comment": "Malware payload (Mirai)", "value": "3deda0dccdb31d27044210f2985ba05dc5c8b8d11badd89ca46a00933bc0c94c05edfe564da2c5e961808af6fc5152b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028157, "uuid": "a5d3d07c-fcff-42a3-a2fb-98d84ed66cc7", "value": "T1A5333B81BD819A13C6D0127BFB6E028C372617A8E2EB73039D166F11778796F0E7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028157, "uuid": "43a2e601-a7ee-423c-9088-a53c35943e12", "value": "768:zMq+bmaEfvHA1wq656+nvw8mLFOPNOokWkTMoJRW6d1RF5pVupiHv+Ii:H+mnHAyq65w8mJfOovV1RVpHv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638028157, "uuid": "ab6cc329-cdd1-4c41-862d-6f1c4eb42f00", "value": 54680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638028157, "uuid": "f711f9e6-7fc7-4c91-8c8b-4d864685fdeb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028157, "uuid": "c7a54baa-18e3-45bb-9c6f-fc295fbab58b", "value": "62bc0831d048a1b3bce374d48c0b8186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886fde4b-4f99-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638028137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028137, "uuid": "d6c6a2ff-fab5-4945-9300-324008da972c", "comment": "Malware payload (Mirai)", "value": "a1a6831d41f2e4bb56aefe25a7aa4f1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028137, "uuid": "3841c128-16ff-46fa-8a87-00af54959315", "comment": "Malware payload (Mirai)", "value": "29b0df1a62e2f7c6fce490fbc1265b7c492fe7623d1f2cf3da09ed28cca863ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028137, "uuid": "b2affdfb-3a55-4727-b60d-46326e906011", "comment": "Malware payload (Mirai)", "value": "702400a1cbe322521c0b620fe2dfb20ec1946e30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028137, "uuid": "8a469045-e712-48cb-abc2-470e0578374c", "comment": "Malware payload (Mirai)", "value": "a15348523facd7341a3d83929257001fbef6478bfb3c37ddf0f43388dc7d320394264bce50fcdd9f35af426ff6f65b4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028137, "uuid": "b4214157-34a7-43aa-ba0c-6d9b113a7120", "value": "T12A532956F8818B12D5D512BAFE1E028E33131B7CE3DE73129D15AF20778696B0E3B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028137, "uuid": "f4b0e62a-e05d-44d3-99dc-bba85f16db4c", "value": "1536:04n+gwxGMedXQwViF7uxUfCDFaNPXQ/MYicaRdI1bXR5IYpC:gGfdAwe7uxrFaeaRdI1bXRmuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638028137, "uuid": "56d0f1d3-79da-4780-a7de-cf797912b426", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638028137, "uuid": "e5b958fe-bfb2-4fb3-a9a4-a8ab5b800ccd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028137, "uuid": "8ed915d6-203d-44e8-ac26-ff793b299ff0", "value": "a1a6831d41f2e4bb56aefe25a7aa4f1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6365ab-4f57-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637999609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999609, "uuid": "fc5aa997-3d08-40f7-8713-32c5e2feebc5", "comment": "Malware payload (Mirai)", "value": "73d52f527fd5a3cd7bfaf44165943ac1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999609, "uuid": "439466c5-c4e7-4cf1-9824-0f483c911228", "comment": "Malware payload (Mirai)", "value": "2a072d834a637c7501cec09652cc2084975d5c0fc1578c57d74aef2df76056ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999609, "uuid": "d772b310-1924-4d2e-afe8-e2b97d0f8e00", "comment": "Malware payload (Mirai)", "value": "befca283eaf569525cb650a6105cb2b983f00106", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999609, "uuid": "5c3d01e4-b9cb-4fbb-ab0b-38c966645305", "comment": "Malware payload (Mirai)", "value": "924efdec33952cb0f9a74e7911ff385c95d4587af7d37d60ca0e6bd3e0fb447f75b911797da7001e2667ace36c8004bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999609, "uuid": "439b5454-d641-44ac-aa31-d0984c5eaf47", "value": "T1F233F216A2321F72ACB8CC77F5A401566ED9877C51CAF6B38208C99C4563B4BF06E4D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999609, "uuid": "1f6e2100-4cf4-48b4-ab3d-09d78bdda5b7", "value": "1536:bOIlMtSFSIhqUXKpdhi41Hf/ZV9Lv8WHr:bOmMoBlapbief/Z7LFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637999609, "uuid": "ae14e24f-7459-4ee7-bf74-48659c3b725e", "value": 53636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637999609, "uuid": "149f2015-9cc0-4e74-a5ce-a93848c38f62", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999609, "uuid": "c81d00ad-054e-4216-9928-84fb5422604e", "value": "73d52f527fd5a3cd7bfaf44165943ac1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d906333-4f61-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638003906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003906, "uuid": "6a575155-3891-4592-af21-e7eee50ec167", "comment": "Malware payload", "value": "71239ddda3f7d13e9be46602543e7ba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003906, "uuid": "1837f6dc-f65f-4ddb-9c3b-1f689812f0fd", "comment": "Malware payload", "value": "2a2b1de937271d64fc665bea79922ad5795a4fd7e46922cce7b2dd8257b98e0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003906, "uuid": "30aa8562-afaf-499a-a2b6-1b34e6efb10b", "comment": "Malware payload", "value": "663fbd7cc26de8439548fcf2a0de8834d975fcc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003906, "uuid": "d430a847-cfde-494f-bc63-f5a79645917c", "comment": "Malware payload", "value": "60553d4b0632002f25c3651e3ae9e916c5b40dc91c5f2b535322534db7421a4861ba9963d12d36728804a065ec5eb952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003906, "uuid": "00ad8f61-7ccf-4485-8b5f-4c370a904499", "value": "T11D032B08D783D2E0CAC240F421AFA777F679150A9F3CAADBEBA05F909204BE1D977545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003906, "uuid": "e96e2dc1-e221-451c-b8ef-d3dfd2d01101", "value": "768:Jwo7Ft+bwYyMpFjFMmiGaMn4Wxaw7nHF9PE8EYYBvy5govpaWYE:N8vxxawjF9P0y5ZxxYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003906, "uuid": "ae4b8dce-32fc-470c-8442-89cb0a4858cc", "value": 38769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003906, "uuid": "46b6abd8-b269-47f4-8227-dd8e7fe6e0e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003906, "uuid": "ce9f2a52-f4aa-4259-aea1-1ae35af930e6", "value": "71239ddda3f7d13e9be46602543e7ba0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1bb023-4f60-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638003449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003449, "uuid": "994cf74d-e5aa-4688-95f5-ce0465161dbd", "comment": "Malware payload", "value": "942da0481107584e68c66b4fd21e027c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003449, "uuid": "b5b61950-fb7b-40f7-87e1-deeea8e942a7", "comment": "Malware payload", "value": "2d17eb52a18b0932e89c81b0efae344775d37ab5a956e02a930404f0fa969633", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003449, "uuid": "f0709b3f-b8f6-4e07-bf22-78d2e3debd35", "comment": "Malware payload", "value": "165afa27ad057cd45e5842d4f0ff3ae8277b9348", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003449, "uuid": "5b3249c1-2622-4861-b27f-888e7ec55f0c", "comment": "Malware payload", "value": "45e0b08922b04c9a782e481dd598152376fa9b94bd0a1420256b5ac6e0d29a0a1204b943908d70f36fba00153f2278d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003449, "uuid": "dc429ead-ae55-4909-98fe-4f7d83012785", "value": "T19963D0003BD4983EE27E09726BD1C547663993421C62C9157FBB948B2DA334E4FF8A4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003449, "uuid": "f42483ac-95da-425d-a732-692db2185cd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003449, "uuid": "8d1ad051-58b4-416d-ba51-30dcddbabfd5", "value": "1536:pWbAoVCQIA1IMgs0VXdNKQuDUaQl+kzdC9GiZQWSwi/fUpS/fX/MN+:pWESjz1Ils8QQuis1Jy///f/M4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003449, "uuid": "735d451b-6fd4-4b9b-8ef7-773546853015", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003449, "uuid": "0f9461e9-7a69-4ea0-a421-e6b629ff6889", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003449, "uuid": "57debf69-eb70-4ceb-84ec-368a5b695adc", "value": "PO 4500151298 SIAM RRJ 38 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455e36bd-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971331, "uuid": "624d29f6-f521-4c19-a943-b1eef21cbea6", "comment": "Malware payload (Heodo)", "value": "63ce1d690e91b57416cc09347b0022fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971331, "uuid": "94fffc5c-15af-49c5-a397-78faf6c9e3f4", "comment": "Malware payload (Heodo)", "value": "2f48be1b232884f4499457a3ff98de04f1e76161bee3c2eaf32452469a0a3e81", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971331, "uuid": "85a5d3ac-77be-4826-b9ef-cf2373b20407", "comment": "Malware payload (Heodo)", "value": "28cd6cd2f891df53a73419a92c4fc0351aac70a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971331, "uuid": "f10e9144-9df6-4ae6-a035-54afc0eda740", "comment": "Malware payload (Heodo)", "value": "d3b8b8fb5e24271342ceffc1dd53d5a51e21a53b39450b87b379589a09bc6a54a52777c14e978cefe8ab7d52d68110a0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971331, "uuid": "be907139-53c0-45a8-8a96-40a5ceb182fb", "value": "T180E4AE1273D1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971331, "uuid": "abf0c30b-9085-4c62-9c8a-2813f34a1738", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971331, "uuid": "2caf224b-46df-4564-aa6a-f3656d19290f", "value": "12288:WKEUkuAOLka1miSmuYr1V7QAobS3qTHPR101D:TEQLka1nBVsAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971331, "uuid": "53a99950-a71f-40d6-8293-335951b2af10", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971331, "uuid": "84f10de7-42aa-4882-ae01-95daf0b75e13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971331, "uuid": "0982f60b-9353-4225-b060-fb1677dfc0f4", "value": "emotet_exe_e5_2f48be1b232884f4499457a3ff98de04f1e76161bee3c2eaf32452469a0a3e81_2021-11-27__000206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a1a5d3-4f3f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637989604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637989604, "uuid": "4e211a20-4c55-4bcf-9864-2c3375047d72", "comment": "Malware payload (RedLineStealer)", "value": "a1b25faad612cd37440d579eef5f3222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637989604, "uuid": "9f6ca7df-c75f-4f33-abcd-9fc487399bac", "comment": "Malware payload (RedLineStealer)", "value": "3191e1008260d148e2c34b21d7772e94e66d231bf6c4fd0e0435edd5a7055d56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637989604, "uuid": "ffa133cf-3244-48ed-bda6-60fffeb28532", "comment": "Malware payload (RedLineStealer)", "value": "7c54fb478b7e8c88df666a021767fb568875a321", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637989604, "uuid": "219ddb66-1a9f-48b6-9b23-e21faa0b4c9c", "comment": "Malware payload (RedLineStealer)", "value": "7ca26b598a2a107358bf24158ac4fce221c8f05e0465d4a90df22e2365b07ae5419ab74580332f2d8686eea66453c9c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637989604, "uuid": "43a32bbd-400b-4d3c-a20f-7d34059b5bc3", "value": "T168C4DA032DC8F718A4955D3782CF6E291B926CD28B7285466B49FEF112E42422D7BF3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637989604, "uuid": "70996cd7-0b19-46ff-8e50-40f69093a155", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637989604, "uuid": "af5b27fb-ab63-4280-9b4c-c6ef222a35fd", "value": "6144:3v+KgejoMoRghhS40VyUtiizAa34V6hlXCN7EQ5LliTkws1uviexRvHi38giF7T:fBpMMP2QnYPpCN7h/012uvba38gC7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637989604, "uuid": "614465c2-d085-4dac-bd9b-c52e8571bdc8", "value": 572312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637989604, "uuid": "3660fb78-16cb-4a74-9ca0-bc30e85188bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637989604, "uuid": "782e5df0-8417-4ec2-9ce5-f19798f36831", "value": "a1b25faad612cd37440d579eef5f3222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6d58ba-4f99-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638028142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028142, "uuid": "0ae63d2c-9ef1-41ac-9abe-4bb1acf447b5", "comment": "Malware payload (Mirai)", "value": "75c60fa5c97c834a66108a68296cd9b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028142, "uuid": "4a7aeaac-c9a9-449d-82f6-b53565d35570", "comment": "Malware payload (Mirai)", "value": "336bcbd139836f231483ad1117e17973852558f49ba841d68ffb02eeacd364f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028142, "uuid": "e4c00ca7-fa23-4d92-a170-23cec8142f5e", "comment": "Malware payload (Mirai)", "value": "c251dd83b06b052948fe7b64a2126676648e0125", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028142, "uuid": "ba36bdc1-f42f-4e23-8c7e-a3658d68d8bf", "comment": "Malware payload (Mirai)", "value": "864a55d048b385a2ebb3ce650b0664e6ddf3665af0a8c7ff6178ce1530482e7df7d7649cf30c73789350e472d8db7adc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028142, "uuid": "7a3e56bd-11a9-4b4a-a694-5d6cf2fb3111", "value": "T10F432ADBF800DDBDF81BE77B4863050AB231B75145830B36276BB957FC721A84926E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028142, "uuid": "7ae5f2b3-adf1-45bc-af5d-36e7a98174b5", "value": "768:0VenUkKqMN473kK4sVaR8tnjEjXX1bcMiQwmbrDOgO7PO9Jzo9TIa:acMNQ3kyk8tjE71bcM9w+fhO7PO9J0VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638028142, "uuid": "92d6d2c4-2f7f-43db-b97b-677a3aa76428", "value": 57324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638028142, "uuid": "fd010a55-cb28-494f-a41f-641c545be28b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028142, "uuid": "563232e0-ef00-4194-91e7-c773107debe4", "value": "75c60fa5c97c834a66108a68296cd9b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb88301e-4f5a-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638001165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001165, "uuid": "20370466-3d5e-4ac3-9439-95721829489a", "comment": "Malware payload (Smoke Loader)", "value": "19fce54b9f93e3e9708cc01edfe3f8e6", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001165, "uuid": "55ffd1db-f388-429a-aee3-e03b19de138f", "comment": "Malware payload (Smoke Loader)", "value": "34465bae61fd35873a9288c0c5ae03b284cd308788258f2f5ca434f46739b8ca", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001165, "uuid": "aa525cba-b9d7-4a0a-8c88-e6d48a38446b", "comment": "Malware payload (Smoke Loader)", "value": "cec7390edad255ad5a8149ff72cc900bb0f87fb4", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001165, "uuid": "f55d29de-40d4-4854-a084-b76fbb66133c", "comment": "Malware payload (Smoke Loader)", "value": "77dd3d8d1d5381956ddca3f1a32ce57934b8f7a138268ec88dffc54a9645923cba6e4ae1accb62fd4b36adcc6da6aaea", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001165, "uuid": "8b8eedb5-4e61-4bbf-965a-26c6690cc370", "value": "T110F3AE013AE2D476E5B795323878DB601D7BBC33163455BF2B642A3E4EB02D08AB9357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001165, "uuid": "9f405dac-1977-4116-bf7b-58be59493ba3", "value": "0870c1337a760ee1593b3bf581332ebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001165, "uuid": "b739b7ee-d52d-41d8-8904-7d3e25efa47c", "value": "1536:ZyNeue3ri+yinTo7e/8hQnugBc8T27w0ttSyMz6fyAQukMl3YJm8AbaAeEScV4vE:ANeuwwwF/zBc17weSWyAXJl3geaUCd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638001165, "uuid": "121f1356-fa26-4108-9b28-b9851a808616", "value": 161280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638001165, "uuid": "ec6ed6f2-9a07-4f24-857b-9512efd656c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001165, "uuid": "3b920463-5657-4fcf-9d88-1e3a60d50f75", "value": "19fce54b9f93e3e9708cc01edfe3f8e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e41e02f-4f99-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638028147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028147, "uuid": "a9401e2c-6925-4fa9-b381-d9c1a682bf8d", "comment": "Malware payload (Mirai)", "value": "78ca373e04b351fcb79cff66ae97dfbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028147, "uuid": "9564e0e9-3ab1-4e1b-9fb8-bc5255164c78", "comment": "Malware payload (Mirai)", "value": "34e3af7802975dfc9267a2f11e817d763fba5bf350e3f7b3bfdc3b8fc2a84a4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028147, "uuid": "e8297286-18b4-4777-89b2-bb2d3ff4265f", "comment": "Malware payload (Mirai)", "value": "e3cabde7929c018f74fbdc5b047fd7e74393f3bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028147, "uuid": "87e917cf-5c54-439f-901a-d5ef2f3c5da4", "comment": "Malware payload (Mirai)", "value": "d1964d87ddbfcce28d6a211a23a82d435c90dfd5f8a9f4285944b2c96a55170fc6b8b27c39ea00c4fcd0920f6a2fccfa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028147, "uuid": "d0123fde-c0d6-4680-a785-8340ce35043b", "value": "T104333A42730C0947D5A35EB42A3F17E1D3BFEA9120E4FAC9651F9A8A9271E324185FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028147, "uuid": "d2032d27-df8e-496e-b3a6-0881ae762c37", "value": "768:8f2RSPy4TVaiYpxl3gq999P28izIIoGI4u5qFy2ta/8IW:3KkpxlBPxOInGI1p2I/8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638028147, "uuid": "186238e8-50b8-4b70-b9bf-c0e2f1c0ae84", "value": 50684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638028147, "uuid": "d6fd6815-f55a-42ea-8fd9-3830339f2403", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028147, "uuid": "9f0771d7-b6b7-4d6d-91a0-49dbf39eb744", "value": "78ca373e04b351fcb79cff66ae97dfbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0a9ef6-4f99-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638028174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028174, "uuid": "7aa677b1-6917-440b-9bc5-4892d5a13648", "comment": "Malware payload (Mirai)", "value": "0c247379ac769e99e429604138da1608", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028174, "uuid": "0afabe8c-c744-4b60-9693-c03e300d9333", "comment": "Malware payload (Mirai)", "value": "35e9b6668f4db43bb764512ff184740fac3664455adefc4d38cbb7747d849a23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028174, "uuid": "65fe868e-6ab5-4a79-848c-7a037d14fa8f", "comment": "Malware payload (Mirai)", "value": "e16c0fa343db9bdbdbbe0d601921bb51c04f0905", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028174, "uuid": "c4a90d04-d604-4106-9bb9-a7c461497b65", "comment": "Malware payload (Mirai)", "value": "aa223d5e79cd7b67e972c8758d16e5fb779b59c85a49daad4d8ed07fe0e6506539af01095ea08a16d114f13c1fd08a28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028174, "uuid": "5d7782d3-0d5f-47c3-bf0d-77673e334096", "value": "T18863B41ABF654FB7DC6FDD370AA9170135CC650B12A83B797538D828F64A20B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028174, "uuid": "c2f990ed-97af-46b7-a20a-0e4070152ba0", "value": "768:Kx09zF+0d8eep52CeLeVNemtPaobUmwntnOsPeCZAcbXiQgptBOACR3I:Kx09zFTWp2gN3QtRXZAcMtwAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638028174, "uuid": "7b3c631e-c0f2-4854-ad0c-eb1fb014fcd9", "value": 68304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638028174, "uuid": "6f6503f3-447c-4c68-9760-38fafce953c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028174, "uuid": "dc6705a4-6472-4f7a-a72a-4243456b5c0c", "value": "0c247379ac769e99e429604138da1608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f739cdf2-4f5b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638001695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001695, "uuid": "624c4f9b-0f22-4e1e-9d8a-6a09a66f9116", "comment": "Malware payload", "value": "8f9f8ea2b8a31aaa69dff3d0f5561bdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001695, "uuid": "d041b88f-c6e0-4142-81fa-ae72cfabca35", "comment": "Malware payload", "value": "36170d266c20fc2965d50a42f15e7447e15ff3424aa13d85171ac7f83d47714b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001695, "uuid": "6d81cf75-a5ed-46ef-8ba1-28982e2cc23d", "comment": "Malware payload", "value": "22b54fea4fff6f6a52c84b308dc7801e3c06ac39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001695, "uuid": "2c30f9c2-8aa4-4591-b987-ca5d5ac22936", "comment": "Malware payload", "value": "bcc6a196c9bdf0f9feaf58a436771ea53de15484e1b7dc9302f74f6c564e2fbbeac438f702922a672f60bcc24f382f19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001695, "uuid": "90b5ccf6-bacf-4d61-b140-d70476189a5e", "value": "T19BA4022017ED1727CB9C47BB90B59341933EA13ABA0DCB2977C365AC18DB712D70299A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001695, "uuid": "039a869b-416d-4265-b08a-51b69c41b114", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001695, "uuid": "164cb68c-c2ad-4579-8abd-930802c5a941", "value": "12288:T01ixBFmSve3yOWh2oItfimZE1trdLkF0VJLzmT:T01i1Vve3E2bfi0ETGFS5zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638001695, "uuid": "ff6ecb8d-f72f-4383-9d94-5741add2f913", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638001695, "uuid": "05d2213f-a368-4646-98a3-6e44657e048e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001695, "uuid": "6a5f21f8-b6a1-40b5-bb0d-455f52c3dbbe", "value": "WAYBILL 44 7611 9546 - Joao Carlos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0f27b7-4f9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1638029006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029006, "uuid": "11441588-98b6-4ad6-beff-560e960ee88f", "comment": "Malware payload (Gafgyt)", "value": "255478911a571a9e0ed17360e7f2a285", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029006, "uuid": "6a9f899f-7681-4ade-a9fa-7a9c0afef20f", "comment": "Malware payload (Gafgyt)", "value": "363132045b7f9970055cfaa5d937b7aa065162ee0a9958a48a015f32c7785b7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029006, "uuid": "3362c886-d466-4269-847f-7c1506d95285", "comment": "Malware payload (Gafgyt)", "value": "80d55aa25002a2ad45b8ceb3985d8093f69ac84c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029006, "uuid": "e11d3e8e-4296-44c5-b64f-bf9fbe4222ca", "comment": "Malware payload (Gafgyt)", "value": "8b01622f692e990c72cf4407295efc362e14b1b8eb910788c676d491b3043e651035c99aae15e8941e20f3e3f1c09219", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029006, "uuid": "3c17c2a3-f4e6-4e79-b402-638de106a080", "value": "T17ED32904F8458767C3E327BAE79E438D373617A467D733116938ADB42BC1B982E395A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029006, "uuid": "e31d84e4-fe19-4b57-ab5c-4390e8909793", "value": "3072:bAynayCyD35ZaKzvoS5henIX/jMSha8m63QQAhP5+QD6q:J6kzaaoS5heIX/vm63QQAhP5+QD6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638029006, "uuid": "87b2b9f5-fa87-45bd-8221-0c6e9a69ffe7", "value": 135122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638029006, "uuid": "4d08cb32-9331-48af-b8eb-3554ba1f935e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029006, "uuid": "4adb739f-9c9a-4d17-b699-2fdc940e3f1f", "value": "255478911a571a9e0ed17360e7f2a285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d715916-4f4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637995773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637995773, "uuid": "ad574662-deb5-419d-b815-c6819ba55046", "comment": "Malware payload (Heodo)", "value": "234a9fafe4c18729bb30065ba918d2a1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637995773, "uuid": "4862ad86-b0ee-4a71-ae8c-6118d94746f9", "comment": "Malware payload (Heodo)", "value": "391d4efcc16fd0e9f70c3e98c6eadf562b3e5ea95f74de4a763021b9bbfac1c4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637995773, "uuid": "371557b5-ffbe-4b1c-ae29-314fc425cd4d", "comment": "Malware payload (Heodo)", "value": "271a8b1328231f9f174e9f155ce9823663c9967f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637995773, "uuid": "9f23cb46-a429-48ec-b9bb-7826c63dc972", "comment": "Malware payload (Heodo)", "value": "989d2d4b7083f99c94eefe88cded8512e0123378db802bd514f82efa22f4c80a2beef5e45c34e24906cf9dfae23fa5d4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637995773, "uuid": "420878f9-3e4d-4fe1-bef3-2a778388d6b0", "value": "T19AE4CF0177D1807AE4BF16392A7593582AFDBD118B75DADF63D03A2E0D712C09A38B27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637995773, "uuid": "2c6c6657-3e95-49b8-8f9b-ea94fe158be2", "value": "12288:WKEUkuAOLkaumvJtoFRqu8UD24nA3p2NNHPR101D:TEQLkaumvJeUoZnA3p2XvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637995773, "uuid": "b5855a74-2bb3-4db4-8c56-1d88800c0c1a", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637995773, "uuid": "2d83ba14-64a1-435b-8d39-fb86d8e8ae14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637995773, "uuid": "534c3f84-1fc9-4208-bfa3-ef4dd8161cb0", "value": "emotet_exe_e5_970beaafd11d88d084632030ef2bf9721737d2e062582d977be9abff11b0c2e9_2021-11-27__064927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830a7435-4fcd-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638050462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638050462, "uuid": "30ebb378-6bfd-45e3-abf3-e01e604ef7a2", "comment": "Malware payload (Mirai)", "value": "8c58fc1f28a64faabe87494e0e7ee52a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638050462, "uuid": "8ea10498-1b41-4ddf-af0d-43051aee45d0", "comment": "Malware payload (Mirai)", "value": "391f708e777f87e536f16dd98978b5331dfb7ffb49627974b92f45494091677a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638050462, "uuid": "47bb936b-8cda-4bc6-ba1e-94ed03a4e558", "comment": "Malware payload (Mirai)", "value": "f15a65180df786e9060408e94cba393a237306c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638050462, "uuid": "fd01ddb2-ba5c-4087-b9fa-edecc2e1876c", "comment": "Malware payload (Mirai)", "value": "1d485770764a7c5d1bd27b20c17282a715977ded174cbe41fd1066ccd3c6753af7c49b85a8089063a8ba4ffea4c83ede", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638050462, "uuid": "44690dbc-4ad7-4a40-8062-01205b3fd829", "value": "T1CEE2D0AED2E073E2C1BCCD7E7ECD56BB94C0A00623B55B785611DC8CB675900B6894A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638050462, "uuid": "a195650a-eb07-4d96-934e-71cf9336e04a", "value": "768:r5+UlP3FamEvmkqnNJxi69cQNv2mgoRnuWvW3:x3FbEmkqnNO6n2sr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638050462, "uuid": "868b0e29-eaf1-4115-ad3f-0310ea672576", "value": 32136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638050462, "uuid": "5a8eff3a-0ff7-4927-aa50-fb6a82aeb76e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638050462, "uuid": "58dd559f-d57e-482f-872a-daf135173506", "value": "SecuriteInfo.com.Linux.Mirai.53.8326.23579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc8c268-4f56-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637999179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999179, "uuid": "6e599169-ccfd-4814-959f-73be0ae10cb4", "comment": "Malware payload (RedLineStealer)", "value": "d9cae7c1ba8a55b4af7fe529e8842277", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999179, "uuid": "37eff1c1-f914-4e17-8695-4bfd7679b197", "comment": "Malware payload (RedLineStealer)", "value": "395a97735cbb580387322886a9debfa2b03ef61d1925c3f66d3c53163c169687", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999179, "uuid": "24a73b58-9e71-409c-902d-6d01fe9e72eb", "comment": "Malware payload (RedLineStealer)", "value": "395c1e9e94ca698877d196d8df30625118bc3683", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999179, "uuid": "aec2a0d9-7712-4eb5-9aba-bebb601a235a", "comment": "Malware payload (RedLineStealer)", "value": "3fa741124e468dc8bbb38e43634d9010b6ce30431952397311ac09a74592a4bfdceb4ecf6edc84decccbbabaf35bcd4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999179, "uuid": "54522f03-b2d3-4dce-85eb-9153ef3d381c", "value": "T1396533A7D5452D8FC65386788A5AFE02566C46D83DD99A23AB7CC5C3800CC13F9FE09E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999179, "uuid": "481408f9-cca6-4853-9a9f-744bf5a9d7fe", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999179, "uuid": "232cb901-5d3b-4684-bc77-298505b4b4eb", "value": "24576:bMaK2ojtT1NxayotenDoeKimG6Tmiu6FYlkEaHNYK3h7oy3NVzLR:bxK28cKncpzTMvNafU6NVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637999179, "uuid": "c4b926c2-9f8d-4957-8c91-4177c2612748", "value": 1434264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637999179, "uuid": "93610514-1500-4e7f-baf0-6be9f1b5965a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999179, "uuid": "f3ec9e58-cd1f-4b31-a954-26dd3ba94918", "value": "d9cae7c1ba8a55b4af7fe529e8842277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebab3082-4f4b-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637994803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637994803, "uuid": "f10726e7-eed3-4f42-9cdd-baad38b3b193", "comment": "Malware payload (Heodo)", "value": "0f4ab8970b84a1e2019b10de23a8ced0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637994803, "uuid": "a6ee3f3d-4d8f-4aa2-ae18-871fffde43e6", "comment": "Malware payload (Heodo)", "value": "39a923c6db8fbb634c8f86e022e0f18c9f0f6b697367f4dc63abfd803f3102b3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637994803, "uuid": "e98b7372-df32-4e8b-a623-8e088892fded", "comment": "Malware payload (Heodo)", "value": "5d4bb97fb49161eb5b168cf0a93282bd0ed50b4f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637994803, "uuid": "a7412fd6-6cd7-495b-8564-70bdb9ab9436", "comment": "Malware payload (Heodo)", "value": "7d1978aee30232ac2b98626fc2d5e5a01ba902650a1eb13b390d546b7452c10f2cfc97c26fae7443f7820005e805291a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637994803, "uuid": "7cad351e-fd4e-4580-8830-d5cf2f6783f0", "value": "T11594AF11B6C2D432D1BE05303978CA96096D79718FB4CAEBB7D80A3E4E742C19B35E76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637994803, "uuid": "638adf25-2816-48e6-b60d-6b267d308067", "value": "d2a2f4c68a7903cc45764257f8ed7a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637994803, "uuid": "aeeaada3-05ca-4b0f-b799-1036379faaf7", "value": "6144:+AriSO7B4gYcl/qjc5dQD8JCedcsqAOBCWOEDNhLdZ4iTQqn8wXhat3Wuc:+AriSOG9c0jc5mDQxqfNR4iTQG8Ht3WN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637994803, "uuid": "6469d72a-eaed-4f07-ab30-89f1d6502dbb", "value": 414655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637994803, "uuid": "2037d8bf-5a81-4db6-bf34-1c07db7dd955", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637994803, "uuid": "8544a8ca-6be0-4955-a11f-6fabf32baf0f", "value": "emotet_exe_e5_39a923c6db8fbb634c8f86e022e0f18c9f0f6b697367f4dc63abfd803f3102b3_2021-11-27__063306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971ee362-4f9d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1638029880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029880, "uuid": "57a52895-1cf0-4c9f-b1e8-8f467dee45a4", "comment": "Malware payload (Gafgyt)", "value": "e4ad88ab11299295b14dac5f93364cac", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029880, "uuid": "e674bab7-d599-47ac-ad14-eaa30d83ac1f", "comment": "Malware payload (Gafgyt)", "value": "3a3999f5dd01b54379be3aa1ab46a7c2e978c6d00523281677f4a8e9980f1492", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029880, "uuid": "e9f96491-f61f-4e0b-b833-643991664b31", "comment": "Malware payload (Gafgyt)", "value": "2ac41624c4be7d461b272185aa41cdfd5e59ede7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029880, "uuid": "efd1f7ed-5d43-4e2d-9434-53a7843cb089", "comment": "Malware payload (Gafgyt)", "value": "d847a1469d00de4b8d4ed08edc217870f644b650a31663873608dd3276b7c9481991bfb53a78f67c72060b55365bd50a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029880, "uuid": "6af8a08b-c90d-4000-b41f-2447fe8eb968", "value": "T180C33B23B6E1CAF6C083527526EF99E1D823F0BE0772321B77946D602B29DD52D1DB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029880, "uuid": "b2a04a26-cdee-4b25-936b-cde50c5c37ae", "value": "3072:cgmuQFn1MDoApPwjCBIq8FWyutophaC42mZUVOX5tU6oRq:mryoWIqqOophaCrmZUVOX5tU6oRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638029880, "uuid": "15401376-53a3-4d7d-969b-4ec0d7774038", "value": 121906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638029880, "uuid": "7beab077-a6ee-4e96-8609-9487f6a72d6a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029880, "uuid": "47468895-9e5e-4695-9f05-52f4c08efe4b", "value": "e4ad88ab11299295b14dac5f93364cac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5f14ab-4fa1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1638031578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638031578, "uuid": "a0993435-b94f-48a6-82cc-df78c6e3fadf", "comment": "Malware payload (AgentTesla)", "value": "590361e14574f3babf614d53bc2f701a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638031578, "uuid": "3d8cf26b-62b9-4715-9d5c-13c3b56497ed", "comment": "Malware payload (AgentTesla)", "value": "3ad952f5675e7f82130c8f5c095d107e6258d0737fc54ca85fa8ee5fc030b8b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638031578, "uuid": "1949ee5a-9b18-4e93-9182-517f92faf24d", "comment": "Malware payload (AgentTesla)", "value": "cfb25a68aef16bc6d1c3840b7ed9dfc008d5deab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638031578, "uuid": "8f179096-317a-45dd-b8f5-8d90989ae1d1", "comment": "Malware payload (AgentTesla)", "value": "d7e5a1fc955b4c09c3908dbabc8bd638aa98cd0cf99e285fc866164c34262e320ffac7bf27d8da7d09b279ccc40691e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638031578, "uuid": "2e53aca2-82f9-4ae3-9b64-fcbb9917fe5c", "value": "T16194235573D44B6AC65E2376246315A42330D52FA0BAF3412CCEEAEE5B4A7E0E7209C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638031578, "uuid": "5d0967ab-3162-4bb0-bd22-e43989c6e188", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638031578, "uuid": "dfa82752-bf11-4d93-af3a-bbd7f7deb58a", "value": "12288:+PixBFmnRBAtXD+xyMUvjP+iEmq6pRfYd:+Pi1oAZYyjaiEmNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638031578, "uuid": "70396063-6c08-43d6-9d1c-ebfcf32e15ab", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638031578, "uuid": "42d9e0a8-176e-4a0c-a24b-673e749fd1a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638031578, "uuid": "846731c6-08ff-4ad5-960d-1c8d02241d08", "value": "Emailing Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83f6afc-4f60-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638003790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003790, "uuid": "63609330-92e5-43aa-a86e-49d0d1708af3", "comment": "Malware payload", "value": "4256d2a410b3bb366e77f4be451f1023", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003790, "uuid": "9a5a7443-6875-4b5b-98c5-c4a23c3f1d89", "comment": "Malware payload", "value": "3bc0b448472628f1cd76903599df5e3d61c1302a37843a8163990aed1d5dc50a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003790, "uuid": "68364318-1490-487a-9c8b-63385c8236ae", "comment": "Malware payload", "value": "a36d6f53b94e29740cb0f05be30b4604fdbd2036", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003790, "uuid": "2d9bbb83-5551-4935-bc17-8282e46416a8", "comment": "Malware payload", "value": "9d188febe04730f92ffe9745d75bd0c794972bc0abd4d5a4f0bfe2d14c584436c6a81e487fb691c6a94d71a132fd57a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003790, "uuid": "ddbab8ba-1190-4de5-82db-1b728a2d1d38", "value": "T19AA33A329A01C035F99200FA96BE97DDF03C9A32031C90D797D66DE19B386E6F932597", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003790, "uuid": "75d71f47-ce29-410a-82c9-196074703e08", "value": "1536:d1mMMzfEOOS7T4YYpltIG0vCc9hanx/Ps+NXyu2L9X:WlOSfaiCcnax/hXyu2JX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003790, "uuid": "eef14719-01b9-4be9-a872-f8d27182205d", "value": 103184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003790, "uuid": "63bc44f3-f94a-4007-a6ee-4aa61617c5eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003790, "uuid": "63ef041a-4fa8-43dc-a17c-3d9329935a4a", "value": "4256d2a410b3bb366e77f4be451f1023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de850ec-4fb6-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1638040602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040602, "uuid": "2fcbecbe-5cd9-489c-8fcb-8c85c143039f", "comment": "Malware payload (Loki)", "value": "3ad4e441ab86eb0a21625e27bb32e0a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040602, "uuid": "b7b3e43f-6386-4f66-be74-e1d8e58f225a", "comment": "Malware payload (Loki)", "value": "3ccfa25b4a3ff244daa9ac9b87f06efbeda2f92b81555c2a389c97c615ff3c46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040602, "uuid": "76a24b42-3d69-4031-b7a7-bde793c86c6f", "comment": "Malware payload (Loki)", "value": "e0419ae29ea06091d2a026a8ac599062b09df5b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040602, "uuid": "7955c4ef-312f-4481-8897-a56e8c5026d1", "comment": "Malware payload (Loki)", "value": "7d5685b21db960f2a0bc44819052dd81358d6056880e6ad65e7ffab25ef05de7a4253868e4aaaa7e9834c2d5dd0b8c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040602, "uuid": "adb57fa1-49fc-4a9c-9d75-20a18889c551", "value": "T18E541288B675A7ABDB4E53F9586700C51BB2B50F2101F34F1DCDA28A0EDEF458920DE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040602, "uuid": "f23f4a89-d4a3-4576-b9a9-ceabc5dd6be7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040602, "uuid": "a10adb3c-430a-453c-8e19-5a5d21a76971", "value": "6144:fDE7uq6BFm/I87xrNOPn6N1aeZlzrDMbsi8LpQ9ywvb9vtvTxFU+Wgu1J:foixBFm/I6pNjqeZ5/MIimQrZRTxFUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638040602, "uuid": "727e3e25-7593-49ff-a260-eea5047711dc", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638040602, "uuid": "0e797b48-c517-4f74-9f01-3176811566b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040602, "uuid": "62f379b5-ea95-4b0b-92d9-09da041360f0", "value": "LCL Export Sailing Schedules for your reference.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1eb68bc-4f9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1638029039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029039, "uuid": "271aa759-2ddf-474c-89c2-6978a3b590e4", "comment": "Malware payload (Gafgyt)", "value": "919f543503b7ab7602eba0ce7875727d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029039, "uuid": "3738d9a2-1e46-4a40-9b1e-2b5ab6941ec4", "comment": "Malware payload (Gafgyt)", "value": "3d342d90e5c9745ed8bfa9539367ed471341026e6e9e6945675b22ab7e7c8cec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029039, "uuid": "d1240cfd-7851-43f7-b2dd-b1b017197b88", "comment": "Malware payload (Gafgyt)", "value": "2586afd051e81c06819405956986e845407443fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029039, "uuid": "551487b2-2ce4-4c17-9a7f-1b0be253f1c7", "comment": "Malware payload (Gafgyt)", "value": "84791e0a393d1b8088f5e04453fa7206999e8511f3d68283e3a051bdd00b554687f321bc265691eb268d4801e653dd0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029039, "uuid": "d6eb9c32-b2ed-471d-993f-f3ea3d90bf67", "value": "T1BBA35C99E707C2F3C8430AB2125FAE6B4532F67B0D2E5A46F31D2CB0AB625D57125F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029039, "uuid": "fa0dfaac-01ba-442a-b043-4a2c43151454", "value": "3072:NnCOOPk0VjrWL/J7uoPA68Zh2MVL5hMfox4mgG0OzUmgImfo:NVOPk0VjrWLB7u/4MVL5hMI4mgG0OzU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638029039, "uuid": "883d0958-3d75-4426-8dfe-ded67c3cc733", "value": 106858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638029039, "uuid": "64f1c86e-74de-4764-bd30-ef042ff6e410", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029039, "uuid": "15b3a62a-e755-4a61-8e17-bb6a472340c7", "value": "919f543503b7ab7602eba0ce7875727d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4599ff56-4f2c-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637981210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981210, "uuid": "5c86f8b9-14fd-43f4-8fd6-511eb2ab0314", "comment": "Malware payload (Heodo)", "value": "e385a56078e8d3549ceb6a237375d7ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981210, "uuid": "899f032c-6ea2-4efc-8ed5-f6621d48febe", "comment": "Malware payload (Heodo)", "value": "3dfd8624f1c8461afe183bb4498717f5ba42e7a8e77f6cbe574bd13b9d54efef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981210, "uuid": "061d2976-1c04-4f31-ade5-3d5ae3f5f6c1", "comment": "Malware payload (Heodo)", "value": "152a2e6704a07e664b7272e8285475401b8cb579", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981210, "uuid": "b31c8a92-835f-4f02-b1b3-f52d973d7e62", "comment": "Malware payload (Heodo)", "value": "316a281f0f6465d6966c6a176ae9acc0d40a56cbff70426eeb861ff833c5bddb3520f02de29f8ffd010bbb68adf6ebef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981210, "uuid": "0c78bc26-0fe3-4f6c-8dc7-7fbb9378a9d0", "value": "T1DFE4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981210, "uuid": "def3140a-5494-477b-91c5-3a31289b5742", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981210, "uuid": "10159a35-413c-466d-b5ce-45e6fa7d08f6", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhBico09cDlB4Vx/ID:0uH0GCNeQbi7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637981210, "uuid": "a085d18d-902a-4293-a9a5-ce7955126566", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637981210, "uuid": "d0c6c889-c6e5-4b61-9031-baaf39895ff4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981210, "uuid": "6843cd9e-1357-4c21-b10d-975a0735e6f0", "value": "e385a56078e8d3549ceb6a237375d7ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d52b28c-4f97-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638027313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638027313, "uuid": "074692d4-b390-4bf3-aec2-9676c2b9dfbf", "comment": "Malware payload (Mirai)", "value": "209fc6c5059aba515a82c1ceb8f69f14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638027313, "uuid": "54db91ba-3ecc-429c-85c8-c620394e162d", "comment": "Malware payload (Mirai)", "value": "3eb5d0e5371160e3ebcc93f3cb71d62d3e392c25e6444d93686534a503420131", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638027313, "uuid": "8a483700-3b47-449b-9203-5f07bd8c74b6", "comment": "Malware payload (Mirai)", "value": "22479a49857ef14171d8fe10c1f332b8a0182661", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638027313, "uuid": "18e6cb27-16ac-49d4-a457-19848e6c9bcb", "comment": "Malware payload (Mirai)", "value": "a1f7101ecb23b19edb66c9028e17e02e14b4af3b195f35c6083f50ad31bb9672dd0af0fea48f1f11a3f75446c572da75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638027313, "uuid": "89439a7e-ce22-4d84-90bb-8925d94392e6", "value": "T1F4E3756E3E21AFBEE268867107F75F70C395259327A19382E26CD6085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638027313, "uuid": "5bbbe52f-11d2-4633-84c3-8ee16fc49829", "value": "3072:MzBM1x2GPyaT/o5hKGEGaWURxuZq+1uPNd5R:ENORo5hKGfURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638027313, "uuid": "c2b98817-b883-48f9-8e2e-194e1ad98338", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638027313, "uuid": "d0e9bed3-ab98-4ec3-8a66-a541b1786f25", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638027313, "uuid": "e9275d56-aac4-49d5-8ed1-dd578cd2f792", "value": "209fc6c5059aba515a82c1ceb8f69f14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a973950-4f5d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1638002264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002264, "uuid": "1e3c3870-f228-49e4-aa83-9a9db89e982d", "comment": "Malware payload (AgentTesla)", "value": "c99b83b7ae7fe5bb0a17fec704736e4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002264, "uuid": "29f5db80-22b9-4feb-82ba-0921b7c3a7d1", "comment": "Malware payload (AgentTesla)", "value": "41fb65b6794c33a19ddb580204ad1f8fff97f235a49fda9faa90d670d0fc8bfb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002264, "uuid": "c96d78fc-ef31-41b6-a6c2-383c97b66bac", "comment": "Malware payload (AgentTesla)", "value": "09135d44ba26fff5bb9c7dd2d4231f9c3e7a9bbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002264, "uuid": "bd790d89-7d76-43f4-a48e-1d62333d32b9", "comment": "Malware payload (AgentTesla)", "value": "6c37a6aa238b132999d3e615d4ad947133fc1d433fa3b0f13af82e5a0aaebd19bb3645fc533c3b1f5344f2afcd7f529d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002264, "uuid": "5ecae4fd-a5de-4163-a8d6-67a5ae75941a", "value": "T14E84FC50912E3D6FF62FE81C1593E1C8386EA57AA4F0056C939EF014DE259EAED8C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002264, "uuid": "e755f990-b203-43b5-8948-b670d9713c8c", "value": "1536:i1j4DDDDDDDD1dLZvR0y0F2r6GoAp+ZJZBexq7hKfedzFz76mAg5eeVhMDw5wfLj:iiDDDDDDDDrKTdzFtr5RDAw5wff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638002264, "uuid": "ffda10a0-8938-46c8-bb87-9274039e4816", "value": 393121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638002264, "uuid": "709b66f7-3451-41c3-b219-694d78c33559", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002264, "uuid": "04443ce4-4fb1-4936-8b80-f84401121d0d", "value": "Details To Be Reconfirmed.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e28eb4-4fc4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638046486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638046486, "uuid": "5ded4e83-2651-4404-b904-282428ed30aa", "comment": "Malware payload", "value": "f7f1ed1f812e800315eb2100e57ed4f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638046486, "uuid": "85c43798-4f72-4a80-a01e-db4c9fa50038", "comment": "Malware payload", "value": "4545ddce15d1394e72e532e43bc20590c75c4703fc97b93056de2ce1387aaa9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638046486, "uuid": "3f41cac2-89b2-4c68-82d8-dd8f85384f76", "comment": "Malware payload", "value": "057928974b102eaaa4dcf62c6559cc7b59f99d70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638046486, "uuid": "75d60058-c27f-4a4a-af7b-c969cfef0acc", "comment": "Malware payload", "value": "745ccb76630621eaa06f4c7c4d768fb0389644c215e229a44f9aa8f90f0deb45f6151eb2a7d674e1767dab7e0a436218", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638046486, "uuid": "fe97d9f8-870f-4e1b-9c97-c516fb30c4b7", "value": "T182841428647FC05980E3EEA52DDCA8FBD99A95E3640C743301B4A33B8B51B94DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638046486, "uuid": "e5c1ba6f-700c-427d-8e22-37d500a3867c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638046486, "uuid": "16bb29fb-3f4f-4674-9675-145317b6df38", "value": "12288:QEFi1OGr+f/NEgiA3+EakSvdX4Qja21igrCc:Ti6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638046486, "uuid": "7758005b-ccef-4f90-967b-844b79d8a7f8", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638046486, "uuid": "6b62eff1-a9c1-45aa-a846-7e3cc35be9b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638046486, "uuid": "dd54a307-adf9-443e-b1c9-1ef4e754ef00", "value": "FortniteDesyncInstallerV5.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84039ab-4f5d-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1638002421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002421, "uuid": "0e7fe494-3fa9-4fa3-8887-b4fc05cfa647", "comment": "Malware payload (Heodo)", "value": "50323d390f1f9f805ebd39793f59056b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002421, "uuid": "f2f90ab6-4a73-416a-9795-3b843e14d58e", "comment": "Malware payload (Heodo)", "value": "4a1ea7affcba0788556ae5bd402178b65274dc2b8f1b7aea7b7813d9cc4346e5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002421, "uuid": "55ab118b-7bba-4c30-a2c8-53881edafecd", "comment": "Malware payload (Heodo)", "value": "11a34f2935f700dd5669a450868c47a71de3d510", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002421, "uuid": "41379f6e-9142-423a-92c2-8b32165b1d9c", "comment": "Malware payload (Heodo)", "value": "77a8a6c25dda88f5edb65d814723c722aa71657118d721d203a960b6df403ae5660e0e1a8bc32e3457fe2e8b70e2c721", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002421, "uuid": "ba8cc6ea-78af-48f4-9c2f-e9a26a687c2e", "value": "T1A8A3CE467390CD41F21EA6718DE7C69A63B2BE1A5F611A9B72C13F4D7CB00B1AF69340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002421, "uuid": "54af18f4-678e-4aa2-8045-cd62a9b4e87d", "value": "1536:uNeqLDr80L1lKugpEWoKtMH1Ky2ccCEIOVFzw3IZQUQj8b8:uNXHr80sM7AI0O35j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638002421, "uuid": "b69c5c73-b898-4a52-8e0b-2ca8b3e9f59a", "value": 99328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638002421, "uuid": "d14bd595-7a45-458f-a453-2399940d8e9c", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002421, "uuid": "9d86c0c2-5d67-4aa4-82a1-a377fb784e78", "value": "559172.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204770e6-4f57-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637999616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999616, "uuid": "37c3d1cf-0791-444a-b908-16211875d1af", "comment": "Malware payload (Mirai)", "value": "4b6c5797713295f45688c2bb9f74e4e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999616, "uuid": "077109a2-032d-41cf-8c1a-8f716cbaf8d8", "comment": "Malware payload (Mirai)", "value": "4a3888096dfa22f3aa0563d93ace79d00b50a8d8d6e0a456ba6c835ea5c8bfe4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999616, "uuid": "da3a936d-3954-44a6-8b49-552786e5f542", "comment": "Malware payload (Mirai)", "value": "4b3fb884d6be1cecbdb49d72309b4272701b71fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999616, "uuid": "e0cbe2ff-fee4-489e-9159-c5c60e972eec", "comment": "Malware payload (Mirai)", "value": "318709b2495d63f8dd40c53c154545050693a178c572fe05d71b909874cb9f9e64cdeb3417c31bd80dab700dc5fe1170", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999616, "uuid": "29e7d7bd-fd7a-44db-81d5-690c08ea61b9", "value": "T15B535CD9B4119E7CF9CBEABE88224F0EF821221150931B27BA67FD937D32194DC52D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999616, "uuid": "4f4c352b-3b6a-4459-9e88-19a8b931099d", "value": "1536:j0pZfwJ/mebn9ykMBH7l88g1pQntF5LR5kSF/zlzs178e:j591o8xpmXlR5VzyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637999616, "uuid": "d19c3392-ee56-4654-a18c-7c2458608d43", "value": 65940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637999616, "uuid": "b97c4c03-fd75-4cb4-99cd-44853e7469b7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999616, "uuid": "615b465a-5e17-4a00-847b-91f03770cafc", "value": "4b6c5797713295f45688c2bb9f74e4e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cca0964-4fb8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638041432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041432, "uuid": "8aea49a9-e871-4075-a354-3f0692525805", "comment": "Malware payload", "value": "ad7e4e5bb98ea9685ecb693143eb7e16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041432, "uuid": "72ac9481-7bf5-4333-ad9e-41de44e4ac46", "comment": "Malware payload", "value": "4b93f6cb98354616be8bf422311a01e681e70fcb051b53560cce94a6bb02d537", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041432, "uuid": "1315406a-0fc0-48fc-b987-b0a15f09bd96", "comment": "Malware payload", "value": "e172cb6de713083589b9fcad4882ee0577c12880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041432, "uuid": "51ff3dba-491e-49bf-9187-46d8ba6b13c9", "comment": "Malware payload", "value": "0fe8cd1b6c077f35c8f115aafa458061685f23d5914f8c44e2de69df05afe6aa215c8498d6e2bd30bbedac879ddb7a2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041432, "uuid": "569d7994-f69a-436d-b0ce-43457d4fea68", "value": "T1575533672BD4B489C04E03F41F10294FB25DAB9929F06097B2EBB0E67FDC50AB9741C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041432, "uuid": "8e71cccb-0347-4424-9cd5-7db91ddcac36", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041432, "uuid": "badc712f-5abf-4331-ad20-0f278f625c30", "value": "24576:ZzhThxBWU0ZfBST7IffOT58dwaMWafgpsNuazpWOenWD1nHpjkEaHNYK3KLls5vM:Z9THIU0MIw58wKa4pxazEJnW15NacavM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638041432, "uuid": "a680d113-b417-4e59-8198-7dea8960b457", "value": 1340928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638041432, "uuid": "1600637d-a046-42c3-8b55-7a6caf201c86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041432, "uuid": "342efcab-2afc-4fcc-94c4-b80842bffef7", "value": "Galaxy Swapper v2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455f6758-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971331, "uuid": "929f386d-03f4-4bc0-adf9-3dbe648503d3", "comment": "Malware payload (Heodo)", "value": "12cf2579d160b158300cb58135b5fb77", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971331, "uuid": "994f132d-c374-4302-b931-9f9e69b95538", "comment": "Malware payload (Heodo)", "value": "4e057579dca3a1e3cb9183c3ed759ad1bb01496be399623ac757d9757f456b51", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971331, "uuid": "20252dc0-d192-4614-86b2-ede692110139", "comment": "Malware payload (Heodo)", "value": "61bbc53fe3afbce9e0f1f4e584c8a24b23f66413", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971331, "uuid": "21baeb7d-9362-41eb-8575-435869027747", "comment": "Malware payload (Heodo)", "value": "4602821bbdd4466cc604631cf79ab6bad3de8abb486dfe29489e91f1224a73bf62f4d447dc603d56b7e4df585f5d1154", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971331, "uuid": "039d6de3-0551-4f70-acaf-ce2324177a37", "value": "T1C5E4AE1273D1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971331, "uuid": "e81b3997-249e-4efd-a5d7-d17ee1f3e5c1", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971331, "uuid": "6fbca184-6c58-41eb-a29a-ab341c7b70e2", "value": "12288:WKEUkuAOLka1miSmuYr1V7WAobS3qTHPR101D:TEQLka1nBVKAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971331, "uuid": "195ecf39-ae8e-4a48-9705-ec93d11bb368", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971331, "uuid": "86509111-8dc3-43b7-bbce-76387b40ef8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971331, "uuid": "3c893d3a-9244-4ffc-a7f5-d60eddc07fda", "value": "emotet_exe_e5_4e057579dca3a1e3cb9183c3ed759ad1bb01496be399623ac757d9757f456b51_2021-11-27__000207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052a5017-4f5b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638001288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001288, "uuid": "28f20bf7-36d5-4fb2-ab65-91bee060c9ff", "comment": "Malware payload (RedLineStealer)", "value": "ab8b0f37fd237246a64a012c6e958302", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001288, "uuid": "75a1258b-9d40-47ca-826e-128a0f1f911e", "comment": "Malware payload (RedLineStealer)", "value": "503cd66c43e8a33db4831ab1c5a8b2c8aa9eded40eb2b6208af563ebd20d5276", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001288, "uuid": "f8d77ec7-1720-4efb-b789-b7216169cb10", "comment": "Malware payload (RedLineStealer)", "value": "b49debbd1eb6cd079d6a64ca7df7e71b3fd9acff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001288, "uuid": "bb1f096c-f106-4d16-b61d-2ec29d96a137", "comment": "Malware payload (RedLineStealer)", "value": "509357287ee83b7eabd1d4c5dd24605ada10567bf50005f44be8828e37a4dde2a4f55fc9e93ca9b9f599878ea5f450f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001288, "uuid": "b278647e-1c2c-4603-91da-0a80e449ea88", "value": "T16FA4FF136DC8FB18A4911C3782CF3E291B922DD68B7255466B59FEF112A42052E3BF7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001288, "uuid": "c5ee336f-a56a-4716-abaa-80986bb735d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001288, "uuid": "4ce7895f-75c3-48d7-9695-9a38bad98962", "value": "6144:q+W8t+NPQ1vWj1kY1wJCj2jc8lYzmSS3PyeR5kMcy:fitBj1r1Vj6/3PyeR5tcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638001288, "uuid": "991c9198-a40f-4cf8-af6f-c26f17718203", "value": 466328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638001288, "uuid": "7a949bba-bbca-4899-bea0-9ebcea8ff258", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001288, "uuid": "b916b7f8-3ef8-4c8d-9970-e1784996fd59", "value": "ab8b0f37fd237246a64a012c6e958302.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06f80f2-4fb2-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1638039049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039049, "uuid": "56c19223-3217-4e43-9340-b5d40bb9a4b7", "comment": "Malware payload (njrat)", "value": "42c690607f11ff38887673a9cb86f1c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039049, "uuid": "a4c7a9ff-3fd0-409a-a8ab-cb1753ef9477", "comment": "Malware payload (njrat)", "value": "534b9bc8809ae37a2beada5b9d868bda1c17c32be812ec3b30de2ad2382014a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039049, "uuid": "5fee1392-efb4-4022-a863-073f83801b45", "comment": "Malware payload (njrat)", "value": "a7fcd7c5082cb6a8c96997cba1d050d808294fcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039049, "uuid": "07a4fb58-f4aa-4f89-b459-093c7588a91f", "comment": "Malware payload (njrat)", "value": "2b11c70985b90acb51241a13f146cea4e15a55330f5eea4bb67c2b84b064cad6be0a4fd99cfed9261f8a977d556ccf29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039049, "uuid": "9faf8254-9d39-4a04-8dbe-3f0cb4724fb7", "value": "T111740144B2F246F3DAF606360194A52FEB76A6349BA098D7C34C2D035A837C1667D3ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039049, "uuid": "7c8f7fc3-866c-41cd-b083-60cba54a2a34", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039049, "uuid": "d91d52c4-7a26-4f8b-8787-bc030107c73f", "value": "6144:65aWbksiNTBtPAn07xcB5b/undZhA//DpFwOVUFu0INOYN4MDjGYINo:65atNT/85b/eZhLqjNOYS5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638039049, "uuid": "82a0c965-9c04-48be-a25c-dd0f1d69ff80", "value": 364264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638039049, "uuid": "52b529b3-7e8a-4165-bc5c-01dd9d9298c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039049, "uuid": "b8e11183-6941-4584-bb3b-6f401472d0b3", "value": "534B9BC8809AE37A2BEADA5B9D868BDA1C17C32BE812E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88cff59f-4fb9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638041882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041882, "uuid": "353c5388-4aa8-4e25-a432-ee4dee0e9b85", "comment": "Malware payload", "value": "9a343d4fa0b49f0901530dc7decea450", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041882, "uuid": "12eb74d5-08ee-42f9-9cae-662c7adafc90", "comment": "Malware payload", "value": "557490d2818a3612d3fd86be5e34d7f10b2e976577bbd424cb191eac727a0fa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041882, "uuid": "9baa82f2-284c-43a9-a645-cac00e54bf23", "comment": "Malware payload", "value": "1e9df8755c616eb0285f73754648773c4204e40a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041882, "uuid": "734472ce-0dd2-4ba1-b3a2-5e9b137233e5", "comment": "Malware payload", "value": "4c086981e90f89225585f227e999596f56c1a678bac4e9a3c5b23f17bc3fe1ff532f2e671e2db5d4f66b493f55ad5026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041882, "uuid": "5f08e43e-706a-4b0d-a388-29a868d04a55", "value": "T1B06533AB5BD87ADAC7D33EB88739D9056A175364AC99F11134234DA00886DCBF31C1BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041882, "uuid": "f3c93907-12d6-4e79-a5c3-187678f56771", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041882, "uuid": "069f006e-3939-4741-8e2e-9dfe3112538f", "value": "24576:mPUx63aoGHj2PIJHKl+ULWoTXRMwU/0Rjq98kXAgv6omhXfCLpkEaHNYK3Sup/4z:Uavj2PIJ18WgDU/KLymhKFNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638041882, "uuid": "f35a37fc-d4f3-412c-8168-0f97befbb0a5", "value": 1449408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638041882, "uuid": "1cf122cd-95b2-4f53-8de9-46ac3b53d322", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041882, "uuid": "1596ef51-5003-4b57-a05f-df0257774c40", "value": "Auto_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926d8e5a-4f9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1638029013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029013, "uuid": "fd22d3af-f5d0-4ae5-bd7a-694b72ecab95", "comment": "Malware payload (Gafgyt)", "value": "3fafea9a091baa192015485c0ca5298a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029013, "uuid": "27651f92-f1d0-4f9f-b235-87ee65d6c193", "comment": "Malware payload (Gafgyt)", "value": "558d627a7d1b8c15a82968e9c03cda7a3c05310b44be09965b4afa30bc577218", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029013, "uuid": "9123218f-6701-454b-9fd1-ca05115433aa", "comment": "Malware payload (Gafgyt)", "value": "3b5b5786766c9a4cd04ea33f09977d4202d91799", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029013, "uuid": "1e18a90f-391c-49a1-895e-d90c53919f0a", "comment": "Malware payload (Gafgyt)", "value": "cb06700c5e0036c0987751aace05a53c7e9768474fcd59aa5d7f6b159e6d5a079391d2fca0fe8d06b409008b7e85fabd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029013, "uuid": "c53d9d3c-ec93-4c41-a377-0996f55fbe99", "value": "T152E32A06D4505767C2E327BAB79E429D73331BB453DB33219934AEB42FC1B992E39860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029013, "uuid": "d21fde19-c66c-493b-87c7-23c097d1bedf", "value": "3072:VdedNJcgDaAyH4ukJmQFD8a15h+9/OYsLTxmoQOYJxXoEb:7GrcgDaAyH4V8a15h+9/3UxmoQOYJloq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638029013, "uuid": "7b71b384-6f40-4213-b83b-6f86fdcc4fb9", "value": 150034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638029013, "uuid": "bbf01d1d-6c0c-442d-aa42-a65cdafe1b25", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029013, "uuid": "4ad953b2-2bcf-4ca3-9e77-485751cd9f96", "value": "3fafea9a091baa192015485c0ca5298a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d52c727-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971372, "uuid": "f6d35158-085a-452c-b45b-1cd7c25fbc12", "comment": "Malware payload (Heodo)", "value": "c4929c02e451e46a6636ad89aba11d4a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971372, "uuid": "b2525189-336b-41c0-a9d9-469d5efead1f", "comment": "Malware payload (Heodo)", "value": "55954a0d3460d2a7eaad2d521196a7d08c76619e2b0c228c891400f3bdb1c750", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971372, "uuid": "62bfe056-89a1-4fc2-8547-9ecf591e5cd4", "comment": "Malware payload (Heodo)", "value": "7ad4586f008eb18d3a61ff8aa43b37bf402670a5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971372, "uuid": "02182f3a-caeb-45b1-bc31-a6cd60af6e1d", "comment": "Malware payload (Heodo)", "value": "6b650fe6f033ff4d79f34394503dbd6a8f017ec40051e7f62da795092c05c85c7a517b9346b6596b3c07d0b3c8ca758e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971372, "uuid": "0f9c3364-d11b-4192-93a9-3de878b47219", "value": "T13AE4AE1277C1C076D4AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971372, "uuid": "bfc7a55b-e625-48c6-8e99-22cdbe20a79d", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971372, "uuid": "0f23208b-e005-4656-9328-e901ae627f51", "value": "12288:WKEUkuAOLka1miSmuYr1V7XAobS3qTHPR101D:TEQLka1nBV7AoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971372, "uuid": "565138e3-cb8e-45b4-b9d9-d9016a2075ec", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971372, "uuid": "5543a244-1a0a-4c91-837f-129c71400975", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971372, "uuid": "0f9c1b59-6439-4856-b7a5-da247f7fb9c2", "value": "emotet_exe_e4_55954a0d3460d2a7eaad2d521196a7d08c76619e2b0c228c891400f3bdb1c750_2021-11-27__000246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791de0ef-4f32-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637983874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637983874, "uuid": "fb3ab013-72b7-448b-bcd3-4efb66818aea", "comment": "Malware payload (Heodo)", "value": "21ae1b8c50ac16dacdd929054a5a2a1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637983874, "uuid": "51f7b707-e8f9-458f-bae7-12899eb2274a", "comment": "Malware payload (Heodo)", "value": "55e1713c6e4f9c2f3368e960c0f1a7498f0016b359e5633db0c0fbd0cf12dd02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637983874, "uuid": "89086e52-39f7-424c-8c51-92620bf95162", "comment": "Malware payload (Heodo)", "value": "b8964429e70021a2cf9807760af303554a816360", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637983874, "uuid": "465e967d-0efc-4e12-a7ce-07fffbbb157e", "comment": "Malware payload (Heodo)", "value": "cf8d14e9f9fd00cfedff33c5f9952aa29ea83cf852c044c8aef737deb288204efb6a58e49a2ce9f4f2ab271ed140ee33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637983874, "uuid": "30cd9f65-cf7c-4e2c-ae05-ba6f0f6d04a1", "value": "T1C3E4AE1273D1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637983874, "uuid": "f373df07-5f36-4ac6-92e2-072176de37cf", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637983874, "uuid": "81bde747-80e4-4284-a2fb-aebe5f221482", "value": "12288:WKEUkuAOLka1miSmuYr1V7GAobS3qTHPR101D:TEQLka1nBVSAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637983874, "uuid": "fb6436e6-8537-4718-8ac6-55da34dc0a0e", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637983874, "uuid": "6678f1db-0fa1-4587-8531-5392260f8dce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637983874, "uuid": "f8ebda8f-f029-4698-9e6c-5d23d2fde276", "value": "21ae1b8c50ac16dacdd929054a5a2a1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575d5caf-4f5a-11ec-843c-42010a9c0014", "comment": "Malware payload (DBatLoader)", "timestamp": 1638000997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638000997, "uuid": "f511caa7-8b82-4d97-bf78-8c6453e6c61e", "comment": "Malware payload (DBatLoader)", "value": "a70bfb158bbc30c909584454a05888e1", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638000997, "uuid": "003d96a5-7190-48f6-807d-995872b82192", "comment": "Malware payload (DBatLoader)", "value": "57e117773ebe7caaac7d1db9759f5c8313d15db896f7b736459c65164770a5f5", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638000997, "uuid": "b3c4ecb4-0f85-4b62-90a6-c079729cd5cb", "comment": "Malware payload (DBatLoader)", "value": "22887bb655cd356f9a5895a7c9fef98e73ae9129", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638000997, "uuid": "20526326-ffc7-4810-a77d-6b85d1def841", "comment": "Malware payload (DBatLoader)", "value": "33c69646b39d24f15b16bfe5d4f54a19019e4b312f00c78988af9ec2ce22c7fdd2e2dfc420414c5f3b91d7022c4a1c84", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638000997, "uuid": "e9893083-68f2-4a68-8331-8cbe94a17138", "value": "T1F7E45B2386814131D47B7D7A8D1BF2AEA5333F065A787C0A2AE33E5B1B3EB2035551C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638000997, "uuid": "99c88551-0c50-450f-8ba3-35a826e59e72", "value": "10e7df67f7eff778f9254a41e05c41c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638000997, "uuid": "98f61e45-dda6-4054-ad9a-d844836f48d3", "value": "6144:wFghwoZYgqvZvtn5SvU4doaGuoJEa/Z5yCPbNhYmgnFSB8rOe3JVhK4vPNzrexrn:qghhZYJgqfwClgFxVJPK4NH2lMwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638000997, "uuid": "f1ac4e10-e190-4bee-920e-2b1796bce432", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638000997, "uuid": "6efa73a5-a68d-4faf-9e93-b18210af715b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638000997, "uuid": "15c3d469-b20c-4627-b309-d68d5ca57728", "value": "Vergi \u00f6deme faturas\u0131 - 27 Kas\u0131m 2021 Cumartesi,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8670246f-4f60-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1638003653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003653, "uuid": "eb1654e0-77af-4c23-a3cc-f37a46193522", "comment": "Malware payload (Heodo)", "value": "33caab9dfadbac931dce86d31721d598", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003653, "uuid": "b3ff4b57-506a-4d5a-bc8b-9071adc69c93", "comment": "Malware payload (Heodo)", "value": "58488d6f8af64f890dcb448e9d4677a9e62665bc2e9e64f4bd37ffe347ee3734", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003653, "uuid": "3385e115-fdae-4e62-8f18-278da51580d6", "comment": "Malware payload (Heodo)", "value": "3b8bf98af92312d9c63b7f0c526d5b6443efc787", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003653, "uuid": "dbe6fd1c-8a57-4290-9088-c68c836de927", "comment": "Malware payload (Heodo)", "value": "29172779b004a7dcdc179d53ac4e6dd60d5da98128e17f87d88eb98bc118336309c0456b670cadde140cb4657d9404af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003653, "uuid": "11b4184e-3f63-4806-8e19-629a1a43d5ed", "value": "T10FE4AE1277C1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003653, "uuid": "e4a678bf-74ff-4f07-9eaf-7b268b1710d4", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003653, "uuid": "944f5b30-5db9-40ab-8bb5-5a0deef181f0", "value": "12288:WKEUkuAOLka1miSmuYr1V7AAobS3qTHPR101D:TEQLka1nBV8AoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003653, "uuid": "84b8169b-4b77-4349-9001-8798b05eb7fe", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003653, "uuid": "646dba3d-3ecc-4cc9-8448-4347d2c099b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003653, "uuid": "bf04ac07-3ced-4aa8-8b36-36a71a726006", "value": "33caab9dfadbac931dce86d31721d598.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919351bb-4f99-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638028153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028153, "uuid": "08a82c33-5be7-40af-8b16-b363e310f8a1", "comment": "Malware payload (Mirai)", "value": "7b10bb24d7fb81f1b3c95273f8733fd8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028153, "uuid": "c9b82a43-958a-407f-b8a2-1cbd9d3ec4a1", "comment": "Malware payload (Mirai)", "value": "592393c8a2924ee0fd18f79a3203e0953b02f5f184930f41c5b3190ce60b93d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028153, "uuid": "dff9c701-14b6-470c-8b4e-a51d9bb55450", "comment": "Malware payload (Mirai)", "value": "1e20c7d7d26af1dfd4388d3e60649e781b4465b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028153, "uuid": "0dc779f2-213e-46a0-9337-f431b9a38642", "comment": "Malware payload (Mirai)", "value": "2209304a7f3ede008cad3f67287162b9ac07277884aaaa6588d9b20f0e851e1138d5c876eb2fe9a7802b1273c5ee59f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028153, "uuid": "0beb6dc6-ec3b-4b91-b51d-65ce7888e88e", "value": "T183139EB3C8292E58D15986B4B4205F7457A3F854D2572EFB191BC2699053EFCFA0A3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028153, "uuid": "34b9d4e0-89a0-405b-92bc-61d280fe1e2c", "value": "768:/aC23eZelQqTUUO+iXC1fnKIop6aREoMljxW3CbJBJ0fSkeWI:/axwoUUTiXiKIopNpMHW3CbXkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638028153, "uuid": "cc8c7446-5b2b-4f62-88c4-f000b447ac72", "value": 44828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638028153, "uuid": "defc22bd-244a-45a0-b48d-7ad1ce0bba4c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028153, "uuid": "52e478d5-dbfa-4feb-ac67-2406243077a0", "value": "7b10bb24d7fb81f1b3c95273f8733fd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438c6b3f-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971328, "uuid": "3e819076-79dd-4f97-8240-61586dff1873", "comment": "Malware payload (Heodo)", "value": "077868aa79606401c6c30f4ce38a4a16", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971328, "uuid": "3fe5c657-ba02-4930-ba63-3eb964b41f9c", "comment": "Malware payload (Heodo)", "value": "59e4eab90009c0c6964656ab078b06d9525f4ec5d3cd4bcc7bebbbe7695f6b8c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971328, "uuid": "a7c0f1ad-3f9e-4e41-a6e7-db95a20c1a16", "comment": "Malware payload (Heodo)", "value": "7be8cc968b43cedccfb6523d50ef098ef7688fc0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971328, "uuid": "67a82661-354c-4556-a897-1251a51a5916", "comment": "Malware payload (Heodo)", "value": "a8a712a87adf3875660912652c58c04188fa1272e1d2d3106de3573c0f48d0986f3e08adac388599e2fefcb88f905037", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971328, "uuid": "fa2eaffc-047a-42f6-8cad-97eff8531694", "value": "T132E4AE1273C1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971328, "uuid": "f5461dc2-a7df-4ac3-b97f-604d66f00197", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971328, "uuid": "4d5e8db0-0440-478f-9701-888642f529c0", "value": "12288:WKEUkuAOLka1miSmuYr1V7NAobS3qTHPR101D:TEQLka1nBV5AoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971328, "uuid": "e8b8a94e-3b06-46d2-80ee-ffc62ba4986c", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971328, "uuid": "41a56ea2-a8ce-4e21-820e-9ebb31355831", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971328, "uuid": "8c767600-e32e-4980-91b3-a218e829582c", "value": "emotet_exe_e5_59e4eab90009c0c6964656ab078b06d9525f4ec5d3cd4bcc7bebbbe7695f6b8c_2021-11-27__000203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ecddc7-4fa1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1638031569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638031569, "uuid": "79ab1501-a3fa-4cbc-9c27-f406d6ef18a6", "comment": "Malware payload (AgentTesla)", "value": "b8b4d09e7110f216879e21de187e5ec0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638031569, "uuid": "5e29087f-b01d-400e-9d7b-e6e4cb974030", "comment": "Malware payload (AgentTesla)", "value": "5c503c6475202598918ad173f031375cab997325907ecfc12c1625edb78e5229", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638031569, "uuid": "fda412fb-54ab-4528-ac46-be9b3e5cdd27", "comment": "Malware payload (AgentTesla)", "value": "b879453544f90fc26052ba2b42ab796f690ba4c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638031569, "uuid": "6cd6a352-e9a1-4928-a619-b624ee5a91e4", "comment": "Malware payload (AgentTesla)", "value": "1e3d351d839238638c587ba7ee830aead5b7cba3e2750b0c404180a842c7b71e9561e530b1abdf0930bff97304c2f281", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638031569, "uuid": "500f36bb-2cdf-470c-9145-adb23b9267f1", "value": "T186942304FD3BD8533264EE86889E76F7A9D2DB27AD391181C06CBC1C622831D1B53B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638031569, "uuid": "a06dcc21-fc78-4777-b3aa-24ee0c9f74ba", "value": "6144:PQA9ZjX8/5qvKPxqJBvWAdBVBk7CVuD7kGZR7UGu951Vy4ERB3/TY1gFnaIAJGWR:ToBkHqCVuDYGZlUFz11E3D54ti7k5R9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638031569, "uuid": "b8c80672-5d58-4d8f-8780-72e720405eb2", "value": 416199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638031569, "uuid": "6e8f347c-bc57-4634-a816-8d53b469f97c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638031569, "uuid": "bfdec92b-cd50-489e-9a6c-f08e82458eb4", "value": "Emailing Swift.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c2e0ba-4fc3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638046229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638046229, "uuid": "5438c897-1f07-4464-be60-5ab9a3839b19", "comment": "Malware payload", "value": "36ea8aff0c020c747b11bae75a50a391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638046229, "uuid": "f388ddb6-7b06-4c41-8af7-083000a0c8ad", "comment": "Malware payload", "value": "5e1a399670d639603f8cd128505ced008a8660d6a28a62ebafc51494757350ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638046229, "uuid": "5fdb4fb3-8ba5-4d51-81b6-08fc586593bf", "comment": "Malware payload", "value": "fdece29b7a1bb7bb40422ba9163bf7141881cb47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638046229, "uuid": "782209a2-bbfd-464e-9d9e-188fd8e16377", "comment": "Malware payload", "value": "f7163c175822853f2a0d824854277b31087a1759408d9ad013f6a704e2760b7e511c57b0cf8f9b521832f141593015fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638046229, "uuid": "758cd86c-de28-4c9d-bc5f-878837c7c31d", "value": "T10345339EB4856820D40F23B42EE1661E58EF6E2FFE986D6F9A5517029F15224CBF01F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638046229, "uuid": "630f3ba4-eef5-4db5-b01b-ff900c864fa0", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638046229, "uuid": "280729ac-232f-4d5f-b63c-1ded97ffd7f2", "value": "24576:gcBgFeeD4ShWzWs8ki3q5abwDgUF3N0dS38m/NpIOkEaHNYK3r1ZOeQq:gcBirSzxbnodHmFppNaBPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638046229, "uuid": "908b4502-8167-4af7-94b8-515a39463691", "value": 1193328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638046229, "uuid": "f4d16176-f41a-4d03-927e-816f24096cf2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638046229, "uuid": "b1e8f993-7001-4d59-99c6-f678105a7032", "value": "FANDER_MOD V3.03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b0491e-4f55-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637998878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637998878, "uuid": "c535119d-ea65-4cb0-8216-147699df3f00", "comment": "Malware payload (RedLineStealer)", "value": "21df3d7cb8bbfef42c3072a3d38df6ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637998878, "uuid": "ec617aff-9961-4777-a402-9192596f1115", "comment": "Malware payload (RedLineStealer)", "value": "61c88f35590a639ac2fbf7e4cb6873549753c3ff97be6de464ae7ab1169d2584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637998878, "uuid": "c4986108-77e8-4e32-986f-def521076af8", "comment": "Malware payload (RedLineStealer)", "value": "f772489b7d36c951fa4231ac2916f8afc05e7175", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637998878, "uuid": "eadfb6d6-c525-4b29-97b2-f4c5cea5922f", "comment": "Malware payload (RedLineStealer)", "value": "cb153e0665039d7dd1e97d09b62663c166768a84e0801efa55512a13fd94007c37c7685cc406944f1c1cbcfd3b0353cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637998878, "uuid": "070364f6-1b11-4879-8445-f3f92024bfbc", "value": "T178F3AE2136E2D076D5B7E2306874CAA51ABB7C731631818B27A4262F5F707C38EB9357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637998878, "uuid": "ff1e7f05-f25d-4c17-81e2-8776440b50e5", "value": "bb8a0a27df83230d6bca882af393ec61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637998878, "uuid": "f2138890-a418-4025-87ba-5e8fbe5f1d2f", "value": "1536:oyke7lZR8ec2J4G+SZUBeL9GVgCnz52cg9fhotwWEKPR7seJphMWAQukGNha4/yK:1ke7T/+aJGgs9gh3pObdAXzNGkAd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637998878, "uuid": "6bc1f557-e2c1-49b7-a0ae-5adb6e002ac1", "value": 161280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637998878, "uuid": "036ff7f3-6dda-47b7-b8c8-5743999b5b06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637998878, "uuid": "d0736698-c61c-4725-afb8-70fbe56ff521", "value": "21df3d7cb8bbfef42c3072a3d38df6ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479a6591-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637971335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971335, "uuid": "4f982d87-9a31-4446-9413-e58bd420328c", "comment": "Malware payload (NanoCore)", "value": "87a9c22b51822df32a2d3a64cc993d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971335, "uuid": "b40b5d33-904d-4586-97bd-13447067f6ee", "comment": "Malware payload (NanoCore)", "value": "64054ba3c90d329fe750f7902674dfab229dfe61673f63c96cd307708300a665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971335, "uuid": "500f5eb4-c411-4019-9879-1373d47267db", "comment": "Malware payload (NanoCore)", "value": "e17c9df0a961f7ff135fd56e1d45becbd0a5f1b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971335, "uuid": "4ac18420-3154-4909-80c7-8f30ef80b702", "comment": "Malware payload (NanoCore)", "value": "ffdfecee9fbc88c436c622efdfd1fd45171ca06c4eed97467bf8b6b69ecc7ce27e715ed839abf7417fe107994d188d9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971335, "uuid": "52aca497-3dd2-4e56-a1eb-da702408cdd0", "value": "T1FA14CF167BA94A2FE2DE8679602206435378C2E399C3F7DE28D451F74F623E14A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971335, "uuid": "95410082-080e-45c7-a4ab-fc3cb079d71b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971335, "uuid": "7595375b-b396-4c74-b73d-4cb0bae5622b", "value": "6144:MLV6Bta6dtJmakIM5bP2ZCt/YSyHLDe1YO9og:MLV6BtpmkWkfvMog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971335, "uuid": "9447dba3-ec9f-4d81-88f2-d1170e585e47", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971335, "uuid": "b930bd90-9bbe-463a-b8ba-654298cae559", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971335, "uuid": "63ee9d61-9313-4029-89bb-759d84e61514", "value": "64054BA3C90D329FE750F7902674DFAB229DFE61673F6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2be0d2d-4f7f-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1638017041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017041, "uuid": "9969d451-1f0b-42d6-98d3-d3703829a75f", "comment": "Malware payload (Heodo)", "value": "c8948772949c20b4f8b525de66d3de7d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017041, "uuid": "bba6f333-4c2d-44e3-be83-757b725c8687", "comment": "Malware payload (Heodo)", "value": "65f1cf45704aefded0d16e1fadbe4ad6ba50d7d7f7765331dce34a7dbd1d80e7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017041, "uuid": "a3527bd3-0fdf-4edd-81bd-545892758f13", "comment": "Malware payload (Heodo)", "value": "81488f33b817f5f59fc3d06bf67f80cfc2040b50", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017041, "uuid": "cd01289f-00ce-492e-ace7-bcd697666617", "comment": "Malware payload (Heodo)", "value": "6e3938e8007b6b16b3348ddaaaca9540d0eca4333a05245fe0d77746831fbcc0236b161277f7deb5fea83046f269f9f0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017041, "uuid": "e5cc1843-dd2d-42f6-b421-2171ed171dcb", "value": "T118E4AE1273D1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017041, "uuid": "421fea45-329b-4b27-8697-ebc8b1c4267b", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017041, "uuid": "3b3466a9-c8c7-41f2-9a0c-91847d03febe", "value": "12288:WKEUkuAOLka1miSmuYr1V7gAobS3qTHPR101D:TEQLka1nBVkAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638017041, "uuid": "81498c5b-bfd7-45a5-8317-cb478dc4df26", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638017041, "uuid": "44c59d8b-b5fc-433e-8396-b48e46cda860", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017041, "uuid": "0b909b93-0d0d-4058-8af5-e1eecc35db49", "value": "emotet_exe_e5_56d8d5911d181b594cc80aa1a423e39b7bf9597363bacbbe705ec16f6e6b87d8_2021-11-27__124356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c30e16-4f36-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637985643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637985643, "uuid": "bfe86230-2a8e-46b0-bb21-771ec82b8a38", "comment": "Malware payload (Heodo)", "value": "557181019e09e33e7336606ada604b98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637985643, "uuid": "2ec72805-eb37-4d1f-84eb-c519c0ba81cd", "comment": "Malware payload (Heodo)", "value": "66335b3393f9c79fd6f52a72f4573de8cce37d536d9302746e4a514a2816aa5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637985643, "uuid": "42f0b51c-aa14-46fa-8d3c-91db83391f6f", "comment": "Malware payload (Heodo)", "value": "897d2c3e050aaffbacf02597df7b78025080b311", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637985643, "uuid": "494bc3c0-5d1f-4fc2-988f-b6605bafbee7", "comment": "Malware payload (Heodo)", "value": "61a965c598e1dc53f7254da75bb07590df96b8ddf3d476dfceaa790a2f23e50b85a2eb01278ea96474b3f81eedc3ec28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637985643, "uuid": "aaa701df-c08c-408f-b272-3d3566882a1a", "value": "T1ADE4AE1277C1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637985643, "uuid": "abf1a34d-3a43-45fc-9f81-aee4972ba04b", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637985643, "uuid": "1bef5d5f-eefd-46a8-a3e2-b11170c5ba4c", "value": "12288:WKEUkuAOLka1miSmuYr1V7IAobS3qTHPR101D:TEQLka1nBV0AoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637985643, "uuid": "c88737b9-98f2-4db8-86e0-53b05e684182", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637985643, "uuid": "2c5a7317-5d7d-4b1c-8f93-8e0c1a86ab14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637985643, "uuid": "c0771fa6-548b-4ef4-9f74-98807935a6fb", "value": "557181019e09e33e7336606ada604b98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900f7441-4f60-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638003669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003669, "uuid": "03f19726-a9a6-4248-b163-3b32cbccd262", "comment": "Malware payload", "value": "68b7de540bf84b490fbcddd23f049ea9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003669, "uuid": "0277c00e-b212-4e04-8c87-ba8dd9bb0dc0", "comment": "Malware payload", "value": "67d1f2b5d5a098638e63404f1c349b402a99e4ad3133f1ab6937e073adf456a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003669, "uuid": "fa12875c-b20d-47c3-8c79-4c39c57ec746", "comment": "Malware payload", "value": "ea912e80aa64ea1d7475119ce777c96ab269cc8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003669, "uuid": "53b519b8-ea28-4101-b201-6d17e193299b", "comment": "Malware payload", "value": "1bba7457ff4c7fc5df8af7b732451217b2f5f8a13ba940b2e0249bcd86dd48f31849754753ed8d26076fe42de0c2003d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003669, "uuid": "b3737235-1bec-489b-b446-55b944dafa9c", "value": "T1075313036DD8F718A0915D3382CF2F291B922CD68B7291466B49FEF112A46066D3BF7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003669, "uuid": "182c6116-9062-4b52-a124-bbf1ca65c4c6", "value": "768:AHSJ4Nj6CUV/OD0eP8s7lPulwbAJOsbhYr94dNqqW6GpC/k:iTJp/D02lPU2AJOsbg4dNqqWpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003669, "uuid": "9763584c-e030-4f82-a136-5c15abcd0d91", "value": 66347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003669, "uuid": "a278b2f1-be45-4ffa-88f8-1f61f133119e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003669, "uuid": "19447eff-3863-48e5-a61c-c729d54ab951", "value": "68b7de540bf84b490fbcddd23f049ea9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b684bc-4f3b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637987566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637987566, "uuid": "26530230-62e8-46fb-be19-d927563a1299", "comment": "Malware payload", "value": "23eb3bef08f5a5831a1caaa89d44362d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637987566, "uuid": "addd88ee-9b1a-43a8-975d-c49bf51204c6", "comment": "Malware payload", "value": "6a9728c46e511314ffdc255613b40b0adae653a86c6117791844d61dfed92aa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637987566, "uuid": "238121f3-47cb-495f-ab9d-02b6ea61eca0", "comment": "Malware payload", "value": "8f999b21ad744d50463cb4783eef0572e24db8d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637987566, "uuid": "56ab1a71-0111-46b6-bc59-a67eb46afb2f", "comment": "Malware payload", "value": "ecc099d0ec3c1980b2a3f404351ea76eb0f779e1f9e5b9a9925e9c30551328a9f7cdef68dfcfcba1485b4a924c6f58e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637987566, "uuid": "cbe6add9-e721-48f7-85e8-0748648c4407", "value": "T1F1C41269D05498B1D2665B71C832CE9918B0BC31EF80363D6719F16EB831743EE9BE2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637987566, "uuid": "6d2c68a5-e0f4-4e07-b3af-ab74f7b2a68c", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637987566, "uuid": "fdab428b-63c4-4cfc-a059-637ac7f61683", "value": "12288:u5m8ZlWk6VT6qIm9qCZb5rTa8kdVXpPwixoEySmITYDH0NRTEJ+T1:5O+DD9qCZb5rTa8UPPnN5mITYDsR++T1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637987566, "uuid": "9939505b-fc9b-48ce-9c5d-ecc8a27dda57", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637987566, "uuid": "d398a8d9-70f6-42ba-a4d5-ff3dc84119cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637987566, "uuid": "228c1365-ee6c-4f49-bf86-b7ab36cf5394", "value": "23eb3bef08f5a5831a1caaa89d44362d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c58e61e-4fd8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638055175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055175, "uuid": "56565158-c733-45ca-85d5-05ee66bb36fa", "comment": "Malware payload (Mirai)", "value": "3cb81c7d4292458d102073e049bec5c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055175, "uuid": "9f0375d7-b1a2-4232-aafb-7705db933db7", "comment": "Malware payload (Mirai)", "value": "6cc1e9fbdddbc270c4d688af4bed77d438a4bcfc0159fd21956215b1d569992b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055175, "uuid": "59b7e28c-bdb7-40b4-8e5f-6bc7c56430cc", "comment": "Malware payload (Mirai)", "value": "03c6220b7fa30afc7e38e03227a054df8a623127", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055175, "uuid": "db0d5ecc-5a1a-4115-8f37-e1489fa7029a", "comment": "Malware payload (Mirai)", "value": "9569c2890c3eefd30c272e12bf6d17fcf5c33563ff6573cbf29ca847139f75b28266ff02e9d1a4a791f14cb607069a3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055175, "uuid": "26d112aa-931c-4ccd-80cc-ad125e0299c8", "value": "T1E8233A92BC91EA1AC6D023B6BE5F64AE331163D9C1DE3217DC145F247ACAA0F0DB7641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055175, "uuid": "819d6778-27ab-4784-8b2b-7af0883a3fb4", "value": "768:dSfVVBJgLHH1bSSeS8Dko6BGz6m9eX2yFCHui8xaFiBmWc+08OHSHNXhGyqUlXBQ:4zgDVbSSNY6p2yFCt8EFiC+BVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638055175, "uuid": "81cc31e9-530c-4954-ab88-7de557fc356e", "value": 49168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638055175, "uuid": "ef8990db-5642-45bb-9e37-f8775e884594", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055175, "uuid": "30cd1286-a6d7-4f65-9c17-b2962e328cda", "value": "3cb81c7d4292458d102073e049bec5c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c76c2a6-4f5e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638002777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002777, "uuid": "47f6ea08-dc99-47d6-98d2-b325d4385314", "comment": "Malware payload (RedLineStealer)", "value": "af422820b636fcb3ce24d7b6e6393d05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002777, "uuid": "a43a1c16-c02b-47a6-92a0-5f96314bf522", "comment": "Malware payload (RedLineStealer)", "value": "6dd1d159928441b310792cbedaba5b84a0dfb4e241fd6cb0ea9fbb583372e9df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002777, "uuid": "01591d54-5927-47ce-9fbe-dd5c02af9435", "comment": "Malware payload (RedLineStealer)", "value": "027b4d1ffd34a767a6a9108cd7381e3fcc3a84f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002777, "uuid": "282f3367-5c99-4978-a366-42687771f501", "comment": "Malware payload (RedLineStealer)", "value": "da564c386a93c92338464f90c965c14ff5fdfb2d6658fd3a2a6618e20b8722c207aa985d55552446f400deaf3bedcdac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002777, "uuid": "d2cef1f5-757c-403d-b8be-5d6620ed23e4", "value": "T10A548E10ABA0C435F0B716F889B9D3B9B93F79A16B7890CB62D516EE46356D0EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002777, "uuid": "6b0af98a-9c64-4342-86f9-0413e2dc0424", "value": "ac14a22dc3791ebf7f4a67e197a18bc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002777, "uuid": "988d7f30-ab72-474c-ac2b-009dab6b04ae", "value": "6144:3rr2bMkKYWA8T6dY3RSXuZet0yS8CYzmn+Ci1fIm5L5:7SoXYWAY6dY3RSXuZet0yS8Ct+JLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638002777, "uuid": "36d7288f-ecee-4d7f-af24-4714db575cbf", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638002777, "uuid": "bb0766f4-da17-4072-8415-6884964fd231", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002777, "uuid": "9109dc4a-835d-4faf-9ffc-c141d563fb0d", "value": "af422820b636fcb3ce24d7b6e6393d05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf7874f-4f24-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637977998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637977998, "uuid": "8aca90b8-04d7-4348-9b85-33b92e342a37", "comment": "Malware payload (Heodo)", "value": "ea603c23d120e864c5d67a379df0f4f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637977998, "uuid": "41a447f3-3e76-4014-b9c2-17dab1964291", "comment": "Malware payload (Heodo)", "value": "6e9a8706a0e6eea4893507e243cc480293b649ecc7ac8863167c450fa18ab742", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637977998, "uuid": "e6dcb66b-4ebc-4806-af29-3afa90fae446", "comment": "Malware payload (Heodo)", "value": "ffa7eb79db9e0f598406be5263bbbde42cb670bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637977998, "uuid": "085b1588-125b-45b1-a895-34e0a3bfa8e4", "comment": "Malware payload (Heodo)", "value": "fba57aafed3b3cb07e99677b8e5d8be8113f7302e4bdca76d515a7fdc7ae9e970888aaaba3a06b0656cd97f85d6f03a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637977998, "uuid": "e8a83c35-9e8c-4e63-bfeb-f6f779ab7107", "value": "T1E0E4AE1273C1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637977998, "uuid": "d07d49da-09a7-452f-9a7f-af2371a20c9f", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637977998, "uuid": "759baed4-fba4-4243-b07e-98ecb9405048", "value": "12288:WKEUkuAOLka1miSmuYr1V7sAobS3qTHPR101D:TEQLka1nBV4AoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637977998, "uuid": "aef42985-f74c-4e34-b972-5286da9e9144", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637977998, "uuid": "8edcdae5-bd78-4cd0-bdb0-19da25857d78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637977998, "uuid": "fed759aa-60d2-454a-bd70-6361edd481ec", "value": "ea603c23d120e864c5d67a379df0f4f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe5f0cc-4f4a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637994300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637994300, "uuid": "c0adff84-6748-4f1d-b6e7-34502f354b97", "comment": "Malware payload (RedLineStealer)", "value": "e46e07b132837a812c151504cec4d962", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637994300, "uuid": "d2bb0d20-4126-41e0-95d9-3667aa66efa3", "comment": "Malware payload (RedLineStealer)", "value": "7078a63a2415bfa2f84f018d15a4f90deb9ce443f71b1334e18b474ffb7f53fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637994300, "uuid": "fbe20f9a-40fb-4f38-b5c3-2521b0933258", "comment": "Malware payload (RedLineStealer)", "value": "33cc82636299dc2e6f43f9877cfec3cc3d796762", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637994300, "uuid": "8df51106-05d6-442d-953f-f9b1c1d4e58e", "comment": "Malware payload (RedLineStealer)", "value": "afa7452838bfc13c7a4babd729f2489a0026d138472e42bab6518d7c0efd4afa1d2930d03975e412b98c9a64eacf52c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637994300, "uuid": "ceab3791-67e4-4d82-b27b-7cb57394186f", "value": "T19284AD4835CAF29BFC7AEBB50C7575814775F2F6DA00E6CEED94249A8672B800A10D73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637994300, "uuid": "973bd25c-e009-4a6c-a4ab-f943f444948c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637994300, "uuid": "1da944bc-8495-4bf5-9db9-08d4d6527ff3", "value": "6144:fiMt0cB0tOKyh4ZTrkR+fUE4sLoAqYMSeoTQohhR50n5WGooe6k:f57WOKi4dgwf3/qY2ChRlGwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637994300, "uuid": "1220f0a5-9cfc-49ae-a283-279609144316", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637994300, "uuid": "170d379e-643f-4380-b7b3-3f202ffbccaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637994300, "uuid": "b2540f4d-435d-43cd-a94b-4aa59500c660", "value": "e46e07b132837a812c151504cec4d962", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edc234a-4fd4-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638053408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053408, "uuid": "df5ae183-3271-4a21-9998-325dba6ac086", "comment": "Malware payload (Mirai)", "value": "9d301b5475389c81a0d3fc551e27c181", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053408, "uuid": "bbeeda54-b745-4be4-91ee-1f3a037558da", "comment": "Malware payload (Mirai)", "value": "72299a7a7f5587c72cdadf954c751b015c9e391789eca07ec0ab6e4447f9237f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053408, "uuid": "e68baa79-f89b-4a06-852d-b24bb60011ae", "comment": "Malware payload (Mirai)", "value": "b7f6d999edd760e95b88ce4de48e4a5c84a1602f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053408, "uuid": "47981d2e-83a9-4dad-974b-79d86c035e55", "comment": "Malware payload (Mirai)", "value": "3ddd3fc9d441e88042f9c29870644b6fdb8bfe04160175af815af536bc445e3f455aeec69a3ad18eb173e66b84746384", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053408, "uuid": "d29e2a38-f771-4c4d-9872-81d02a701e93", "value": "T11C633981BC919A02CAC012B6FE5F519E371613D9D2EA3217EC15AF2077CB91B0E7B256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053408, "uuid": "1cc53ff5-a74c-4d4a-b77c-4b7c7ff0ff73", "value": "1536:b9iZITLJhiCl7hp2zFNAiQiCRLsqbSSsUHkLvonV:b9ig9hiytcRraLsqZJgQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638053408, "uuid": "d39cfcca-8ada-4d14-aff9-e3e54e306eee", "value": 72916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638053408, "uuid": "396177fb-569d-4579-9553-3a635e29d331", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053408, "uuid": "0ef4a3a7-090d-4c81-b0d5-83dc469ae02c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f723933-4fc7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638047772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638047772, "uuid": "8ce00304-beb9-4253-a95c-bf47fc5be397", "comment": "Malware payload (RedLineStealer)", "value": "810465474dca0f573db9cd2b7eb9a3e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638047772, "uuid": "698400c9-3edd-4f68-a329-afc1f094861a", "comment": "Malware payload (RedLineStealer)", "value": "72937299c8e20a0a9dae27bee74145d7e6cfa1c38c2641b51011b00297a1e25d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638047772, "uuid": "0671d0a5-a31d-41f7-8e89-9affb5006f16", "comment": "Malware payload (RedLineStealer)", "value": "7c36624beb00e55c97903a08431879978ae4d207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638047772, "uuid": "f5b46fdd-718c-4b85-83e6-abff1a90c807", "comment": "Malware payload (RedLineStealer)", "value": "270ae90e089c56ec520fa480b238f53a3a1a67cc6bb4e38c1f88fedd4b0cdbe7183a12b417f10e0d5661401ab721c661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638047772, "uuid": "7d05696f-9033-4bf3-8963-0a9c94c43324", "value": "T1F424CF2171C1C1B3C4B7117044E6CB399A7934724B7992D7BBDD2BBA6F212E1A3362C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638047772, "uuid": "741bbcac-ff7d-4caa-9707-c8593d9ae0f9", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638047772, "uuid": "4a14f040-8a26-4aa8-a224-5c304acd991d", "value": "3072:UDKW1LgppLRHMY0TBfJvjcTp5XbT0j65TuWIJY4Qss2OqXaHl9:UDKW1Lgbdl0TBBvjc/Mj6oNds2OqKHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638047772, "uuid": "f29b0575-9f6e-4dd7-87fd-3ed0a39fbfe9", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638047772, "uuid": "17edc2ca-21e3-44e0-8c9f-b5e8d73d2b94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638047772, "uuid": "65fc9700-3608-4fd8-a767-3a1b3b2ff48d", "value": "810465474dca0f573db9cd2b7eb9a3e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b88ace6-4fbc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638043121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638043121, "uuid": "70663393-32ec-4bc7-87f6-d0594be6410a", "comment": "Malware payload", "value": "05f4553ee500bce6677b73e2ed44e3ae", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638043121, "uuid": "0b436336-2b21-4a0d-95e0-50a394894b92", "comment": "Malware payload", "value": "7334a984d3036002287f585cbad1209eff1fe7bdba7e93c88efede1201dba3e2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638043121, "uuid": "1707b142-fcc6-4891-b378-40f838e096d5", "comment": "Malware payload", "value": "858b5dfee9bf11a8c724062e0517b1ebfa7e8a53", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638043121, "uuid": "6da4e46e-6c0d-48dc-ba07-f7de5e838ff9", "comment": "Malware payload", "value": "3450b7bc6a7ac6ace7d1e481c656026169e74a01da08717adc02f2777313e0e17f3ce4d0beb74b3c61d6560d9a28aaf8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638043121, "uuid": "d71337c1-ea61-4668-9ba8-9fdb8787e8bf", "value": "T148963342B19CE4A8F753BF72A66DFA1A0DC8E3AE64F1B5014344B24D9353782D287B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638043121, "uuid": "664b75a7-25ab-4057-bbdb-7a66737b4b70", "value": "22a7d193681235f08e33cfcfbc112896", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638043121, "uuid": "f40d28e0-7c9a-414f-90ea-075a7260ffc6", "value": "196608:QBIIz0vn2daN8l8yII+RO+ElCMYLcRkopYIkMSr+2m:QFIvn2dapQ+aCXgubhrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638043121, "uuid": "c813c1ce-e920-407c-a835-2760e7ebea24", "value": 8720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638043121, "uuid": "577ad09c-2c27-4a07-99d6-43e0fe9fe961", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638043121, "uuid": "97e6fb91-412b-4e99-bb2c-61a666f94500", "value": "antiban.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3222973e-4fb8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638041307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041307, "uuid": "f5ec93ff-9e99-4e2a-8594-a4847e9251d5", "comment": "Malware payload", "value": "9d435fd1b391ed12c45fcc6ab8744dad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041307, "uuid": "9825bbd5-13c9-48ba-9517-3c45a096f18c", "comment": "Malware payload", "value": "7375b3744d91cc33d2595be5c14d4b4ab43aec691d3ab365145048d608cb9b38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041307, "uuid": "8414eee3-bbc0-4ed5-96bc-e4906199fce1", "comment": "Malware payload", "value": "e218389eb84a052a4f5ef8777dc840f6fb6c9ff6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041307, "uuid": "a7dc5afa-4bad-4b9b-aef8-654f57d4e6a6", "comment": "Malware payload", "value": "b4768e5c8723ac0ac12d1d05858c105cfa60d8ba311c4234709ca0c790b8f949ff2493585b06b7884cf49d49e450990b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041307, "uuid": "7b58efa5-03e7-42ce-8503-c0e00f93e87e", "value": "T1B446333073A2C0B9C2A742303D5CEF56597E26505FB60ADB7BC84F1BBCB15E02929766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041307, "uuid": "bd835503-0550-434e-8693-a0666eeec00a", "value": "eec4c9510d1f15621b464022e8c2d408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041307, "uuid": "b9352b91-2287-43fd-96fc-5232294aed97", "value": "98304:a6AnFtFtffW+yhu9XHYfM6f6E8mIiItjtzIOXt6Is6K2nq1WN1l1Do2o7oroKZo1:QnFtFtffW+yhu9XHYfM6f6E8mIiItjto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638041307, "uuid": "fa1640aa-292d-493a-bff6-ed38c2268a05", "value": 5479995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638041307, "uuid": "a990a6d3-848a-425c-b72b-8e996628193b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041307, "uuid": "5ac36d04-f0d8-413e-8a6a-3a5bb91724dc", "value": "9d435fd1b391ed12c45fcc6ab8744dad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b812d0e0-4fb1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638038525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638038525, "uuid": "8c5d3396-9535-419c-b2ee-7ba205bf8ef5", "comment": "Malware payload", "value": "85d9830cbb2eca02d98df544814e8239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638038525, "uuid": "98ab22ae-14ce-418b-95ae-11e0f25819fb", "comment": "Malware payload", "value": "7532e883f6432ebda0473d392e3ed7174bdb05c6e2178c4732f0aca7e0d0c287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638038525, "uuid": "c00659c2-7576-4d1a-985c-462516412c71", "comment": "Malware payload", "value": "4c353b660093c54d315ee6d3e6e0776e2cdae0ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638038525, "uuid": "3d814c99-f258-4f83-9bf5-8a9c16794dff", "comment": "Malware payload", "value": "eece45ec2775bfe1cd2207f8a76962e787cd37718ebef8e6f0a4b52b9ed6a28be90b09402072f05d110b20ef62cdbd27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638038525, "uuid": "942477fe-54c5-49e6-91f7-3906bb976520", "value": "T1BF6533EB228074ABC24F05F87876DD5247F4A6793CDCB147204A83E75849AD379B88ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638038525, "uuid": "5608ba4b-b094-4981-817d-b0b86c14d4c3", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638038525, "uuid": "eb1343f8-058c-4b00-a85f-875dc7737f0c", "value": "24576:mIGc0KuVX6bqcNxjha3Vhsdt4TwpMnb+nkEaHNYK3Y7oy3NVzL4:RGdKuFsNNhUhc4sanbiNaWU6NV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638038525, "uuid": "041db23c-c0d7-4415-99b6-3a9533cdabd4", "value": 1413160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638038525, "uuid": "5a3048cb-6afa-4b76-98d4-e8dc39a7e2dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638038525, "uuid": "61226532-0d18-4f41-bc93-b3e583280809", "value": "Fortnite Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccb18d2-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971371, "uuid": "4345f63c-8cac-4321-8031-e89a501647c0", "comment": "Malware payload (Heodo)", "value": "03a98d8e74b7996be6e38d8fab2d6af9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971371, "uuid": "2ba7d6d6-a7e5-429d-a6bd-bd555e866a18", "comment": "Malware payload (Heodo)", "value": "767836da977967d3f72c92a7d5998ef4bdd8027efa748fba1cd68562406e640c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971371, "uuid": "54a4e094-53e0-4a2f-8829-2920caf60911", "comment": "Malware payload (Heodo)", "value": "10bde36a6bedafb2fbc3e229aad2a9b9bbf11d3d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971371, "uuid": "365346c5-0072-4419-b461-57bbf6938df8", "comment": "Malware payload (Heodo)", "value": "6c2c45814df275bb61e52eb61d3fb19d13a2dfa42bbfc6cf71e1bdd3b827e41616ffa7db670d3899f3415f09f69ce685", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971371, "uuid": "d7e77fd3-7b71-4032-82fb-d1a9d30d00d0", "value": "T192E4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971371, "uuid": "e5803954-50ac-4160-8048-c9e054a28c9c", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971371, "uuid": "618f732a-185f-4ae4-bbc6-34af8dc7f2d8", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhxico09cDlB4Vx/ID:0uH0GCNeQji7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971371, "uuid": "e68c0f4c-15dc-4b91-86cc-12eddb057225", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971371, "uuid": "be9d7f96-ae80-4716-aadd-dc307bdaefd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971371, "uuid": "d206899e-228d-45b7-8778-812a83cbbc3d", "value": "emotet_exe_e4_767836da977967d3f72c92a7d5998ef4bdd8027efa748fba1cd68562406e640c_2021-11-27__000245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a3b773-4fb6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638040501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040501, "uuid": "7998a340-e835-45ce-82c3-373193b4a319", "comment": "Malware payload", "value": "aa9750f7664312294e457900635f2a82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040501, "uuid": "af27b12d-9990-4755-bbea-c16a5d2d2dbd", "comment": "Malware payload", "value": "774895440c1a3146c5c9c873b700ffc85e918426a2677aee3749e7618415f6bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040501, "uuid": "87dbcb48-1082-40d5-b738-7ead2dab0e78", "comment": "Malware payload", "value": "ebd44b1ae924f8920dc50d93a0594e3a89c78490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040501, "uuid": "e96eb1bd-f498-49de-a5d6-2159b679b0ec", "comment": "Malware payload", "value": "5eb04095f6bc9a68ad6faa310547f67cc90ecbeddb20298e868c8a60eb7fd4254782d935e8d45003feedc51d5647f87d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040501, "uuid": "3e5b1e14-477d-4822-85e7-eb70a9757cda", "value": "T1B5841F536DD8FB18A4915C3382CF7E291BA22DD68B3255562F59FEB112A02012D3BF7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040501, "uuid": "2da6ff16-4e10-4540-b97f-96d294579c94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040501, "uuid": "b7bba947-78fd-44bc-82c7-b61125fcf501", "value": "6144:9fiwYmu6abwBZ6idaYnruNMEBviioNQzTu8ODgvYsh9auYwLtfI/Gdis:ZNawSKTZEEcTTdLtfSG4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638040501, "uuid": "b74be621-2cb4-48b6-b1cc-bfbe0fa3f058", "value": 406424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638040501, "uuid": "adc02651-8408-4727-801e-594f8144fcd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040501, "uuid": "9427aed8-1226-4309-a256-329fa93e99d5", "value": "Atomic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7415025-4f24-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637978045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637978045, "uuid": "617b207a-f8b6-46d2-9187-9d6805285b57", "comment": "Malware payload", "value": "56ac8d967a8da0cb9a5a28d2e127d71a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637978045, "uuid": "21b0ee03-3719-43c4-8ba8-13f2a4b87b87", "comment": "Malware payload", "value": "7885da3574208452e6a806a3aa9d4bfb61577b85115f7fda9a559619a86bab24", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637978045, "uuid": "2521a7c1-c49f-432d-b8aa-e933df3529e3", "comment": "Malware payload", "value": "26b67c01316aeb910462838b8b2e033072f34258", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637978045, "uuid": "62fac488-705a-455d-a86a-7adb04914c10", "comment": "Malware payload", "value": "910e3e0022d21488db0c99d2f489b4b081beff0dd3ed8d66dc2ed07ddaaf0b67cc05fba38b1c11074666d8ef5c2150fc", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637978045, "uuid": "c841e2e5-3092-4e84-b2d5-d67a5eb4883e", "value": "T154D5E08AF719A62FC97794324EB6063606431C0698939B435A68B31C5DBBDC41F9BFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637978045, "uuid": "7c446bda-33b2-40e1-a7a6-ff2202c5f9cb", "value": "49152:Pg2A1RrBYjDMZWL43yBlFnfqnnnnuc6EFVTSMSw2LylhGVW1Xr1+C8TDaFJ5v1km:wRrBNeGslFnfqnnnnuc6EFVTSg2LKhGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637978045, "uuid": "a939cb60-ecc5-4c10-8491-af27686b4e28", "value": 2772328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637978045, "uuid": "79543b85-ee55-4609-beef-76f06c245a61", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637978045, "uuid": "03ca2c75-370a-45dd-b456-3d6784e87e32", "value": "01000000000.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35135dbc-4f39-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637986766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637986766, "uuid": "f7dc0869-54bf-4118-8c5e-e905036e7aef", "comment": "Malware payload", "value": "7a9ef587d79d6b0379854b2586e2b01f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637986766, "uuid": "4622251b-71e8-4896-9828-f021ecc978ea", "comment": "Malware payload", "value": "7b120ff9166e383ae6e8a0f1eca662fa0f3ac2c64d815b4689f06858a63afe30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637986766, "uuid": "aa240341-f896-4ae6-896a-7a305ff2895b", "comment": "Malware payload", "value": "fc912562b9d1ec30fc2de902665ad8343a32019c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637986766, "uuid": "15e62969-9f1e-4b2f-bc7b-24bd46d7128d", "comment": "Malware payload", "value": "797729e9332b1d654cab9bf24a45e12339cbe755f9164021765c8932032cd546475982d99d4d813274e0de1fcbd37317", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637986766, "uuid": "c53516e9-5549-445b-9553-7382d9a73d7e", "value": "T130F3F18AFE019F158A8539FBFB8F428D72571BADD2FAB010ED60572623C658A4F33015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637986766, "uuid": "fb560ee6-ab56-4afd-b5e7-8a1341339914", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioiaabEtnwKSDP99F:p3lOYoaja8xzx/0wsxzSigabE5wKSDPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637986766, "uuid": "5b088725-72fd-4311-b715-6ae5c3adcd8e", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637986766, "uuid": "67a32e01-8a1d-47d4-93a2-0d63edbe3e12", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637986766, "uuid": "8695504d-4af6-455c-9fa3-2b01c98ab167", "value": "7a9ef587d79d6b0379854b2586e2b01f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f94d49-4f18-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637972693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637972693, "uuid": "5e2b25e5-1cd1-425a-80ff-d62ab29f2fa4", "comment": "Malware payload (Loki)", "value": "8fb769a42fbccbaba0e88feb853e8ef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637972693, "uuid": "01531241-7d66-40d4-8eb6-d52eeb4d99f6", "comment": "Malware payload (Loki)", "value": "7b6dc822458358d9a175d7cf6cf23d044cc8406b06eedce122c98ab90fb364bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637972693, "uuid": "e89f70aa-0b74-416b-8d99-8bd955b8dbc9", "comment": "Malware payload (Loki)", "value": "e4b42390e28456f79eeb23ab988542721e6e6abc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637972693, "uuid": "c00a2a34-b564-4ffc-859c-75edfae344ec", "comment": "Malware payload (Loki)", "value": "29bc5826ab2976e374d952bf30ace60670944e1cad5d00c358113248a71a8e3930d1d518bd0fb229d2bb629f2ea47602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637972693, "uuid": "892fb266-f025-4050-9198-b0479091d2a7", "value": "T13D761217A5D5C83BD5A54E7D15739F78ABB692D4142107868FE80FFB2E300D24E2EA83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637972693, "uuid": "c97e5a98-ddc7-476f-9963-551744d750bb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637972693, "uuid": "c550565b-8cc9-4f95-bbc2-565987f9bc4d", "value": "6144:rGiy4hVaCu5H8xAHsYjpvM68oX244R53ImGst99T2DRst:b14HxHsIpvdfY5YmTnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637972693, "uuid": "f12dfd87-1c6a-4770-9962-7bfdfe0f5bf5", "value": 7340032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637972693, "uuid": "722e52bc-9450-472b-86ca-181988cdc9fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637972693, "uuid": "be11b46b-4282-4d51-9b13-0c7f7bdc915c", "value": "Ref 0180066743_pdf_______________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d87a06d-4f97-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638027314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638027314, "uuid": "ecdcc275-7a14-41db-a936-624532b62b87", "comment": "Malware payload (Mirai)", "value": "e8649a04fd2234cb89fbad6b42e472d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638027314, "uuid": "8547290c-f8fc-4192-a3e8-4842933979ff", "comment": "Malware payload (Mirai)", "value": "7b7d6bdb893066f1b0de170894c046e0727ff80b708bc49732e0e1debdaf8a85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638027314, "uuid": "fbe309c1-9205-40ed-84af-28f02f6e5072", "comment": "Malware payload (Mirai)", "value": "dfd4d18c843e4db05840d2e78bbee041ed22863a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638027314, "uuid": "31d82c02-5314-409e-a14a-4b6e4295cb4e", "comment": "Malware payload (Mirai)", "value": "475c959c59ea3da9ccab620a0e89b4e701b8dd8a6b9c0a651c6bd869a5eb2cbc8b51183ae8e91c23c6f9dee27ef0f237", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638027314, "uuid": "a3a94906-73e1-4ce8-bba0-596a2b7d212e", "value": "T1F2D3A62EBE315F7EFAAD8239A3B39E715665219A33E1C388C07CF9003E9164D144B765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638027314, "uuid": "7f4ff196-746b-4222-a955-cd39ed420640", "value": "1536:6x9lZnlknlrlAlYnlL7g3pEg5T1nF6TbXvFWx2vqdgFTT9lyY3C5cRtYeFGEhMIz:YZd6TbdvvqdgF/9lyY3C5EtoEhu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638027314, "uuid": "2ddc60e4-dd38-4720-a005-881056a98c8e", "value": 142264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638027314, "uuid": "88ee5516-726e-430d-b12d-e71d205df553", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638027314, "uuid": "a15802c5-a20f-449f-94b5-5c748d7083a5", "value": "e8649a04fd2234cb89fbad6b42e472d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25080c2-4f5f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638003324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003324, "uuid": "a2ca2e5d-520d-480a-9841-82af0839b825", "comment": "Malware payload (Mirai)", "value": "8f77375c2e3a4bba47562fae712b3d1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003324, "uuid": "ff062635-7067-4dc3-bc09-5eea5871bd5a", "comment": "Malware payload (Mirai)", "value": "7bf82c241842fb0e5aa6ea6d36a01b5b67f6295218a0b68a87ac706c8d643b63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003324, "uuid": "dc1ae5de-a4c6-4ac1-be5c-ae12b4b1684e", "comment": "Malware payload (Mirai)", "value": "854827ff7823b5724d8d86ae5ea03fdcea6b092f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003324, "uuid": "a7f7e411-83f5-4670-b9b2-c50303463730", "comment": "Malware payload (Mirai)", "value": "94f80217f95f00f25c88bfdca15e1bde6e8ab2697f0cca0d8bf9c602f66b1414eab9cde03a0ed5617c53b041df32680d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003324, "uuid": "bc91ab6c-fbde-4504-a779-21ce02554cb0", "value": "T112831881B9809E11C6C507BBFA6F108E331257ADE2DEB353CD145F6477CA81B0E2768A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003324, "uuid": "e7569adf-eb76-443d-b643-edbc97f6de7c", "value": "1536:CZn0fmn7taav+wsQz1JYh82gydb9lJ3yduCUFRZ9mrsplDKZUmQBKXAVanhX+F8M:Pf6vvsm1uhXgObDJ3BCUh9mrsplDKZUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003324, "uuid": "5ed36edd-b81c-4550-96b4-1c9ebbe2d032", "value": 83076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003324, "uuid": "52ded734-da4e-4978-8148-690be715141a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003324, "uuid": "dcf212b7-4fdc-426e-bc42-755d9a6f410f", "value": "8f77375c2e3a4bba47562fae712b3d1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a5cd91-4f5f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638003014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003014, "uuid": "ed40083b-62a8-4445-b450-c7fcd2dacf8b", "comment": "Malware payload (Mirai)", "value": "20809faa738684627c8e8a6c1fc05c0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003014, "uuid": "0a5f4b5c-1627-483c-918f-1390d1011890", "comment": "Malware payload (Mirai)", "value": "7e34b071741c4d437516d635251ac28108a2ecd4e0729fdf5427ab824ab99000", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003014, "uuid": "cfa06404-ca8a-4de7-bb5f-1686fbe1e621", "comment": "Malware payload (Mirai)", "value": "63303bb5592d086a95f37e392bdef54f3130eb31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003014, "uuid": "6ce66567-5533-4ee2-8f19-1a678a24ca46", "comment": "Malware payload (Mirai)", "value": "a461ef1e171b4b87e30b2843153dfb4201327a56ebd47c8310af4e2da0b1bca65ac3a4e64625ceebd8af9f9feecbc4ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003014, "uuid": "669f741e-92a3-47d0-890f-e6b9a4ce36aa", "value": "T19DE34B86EA408A13C0D6177AFAEF41493322D755E3DB73078D185FB43F86A9E0E63649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003014, "uuid": "fd5672f9-a482-42b1-ada1-9abd32b5090d", "value": "3072:RxnLuCdRwqrpGO9b4D7zEP5y9mrsplDKZUiQBKXAVanLX+F8JyvN4hLCA3I5BN/d:RxnLuCdRwqrpGO9b4Pzi5y9mrsplDKZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003014, "uuid": "60d07f72-e10c-42d9-8936-ea0251d7f440", "value": 145324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003014, "uuid": "cfea206d-073e-47fe-baed-b0eeca45bebd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003014, "uuid": "e2fd534c-eace-4c62-a33d-0ead6fb3df95", "value": "20809faa738684627c8e8a6c1fc05c0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69afc9be-4f7f-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1638016919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638016919, "uuid": "020fc08f-db8e-4e1c-bfec-a9a615b9af69", "comment": "Malware payload (DCRat)", "value": "a6e5a95ec64dd4e9394647e9ab023a95", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638016919, "uuid": "3334c3d8-3030-46ff-8738-182877b7299a", "comment": "Malware payload (DCRat)", "value": "7e942e56182c2a564b3cfc21ee3faba7e4dfe398ddbf844a6064d7829ec5f119", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638016919, "uuid": "61da76d9-81fc-4aea-917d-7660a728c55a", "comment": "Malware payload (DCRat)", "value": "a37d6c841602e333ca9600c03b4015fe7cd1e8eb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638016919, "uuid": "dbc37d38-c39b-443f-a7c6-0fcf4382428a", "comment": "Malware payload (DCRat)", "value": "981090836037e1a987b3907513a821adf767a5db9beb651c3f9bf8ad3600605f3275573e5f5c3c4483738cb230b1da7d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638016919, "uuid": "e93aa576-5426-4ff2-aee9-794e36643b73", "value": "T13D455A123A64DE02E16B173BC9EF805447ACEE417A62DB1A7E6F339D65413A70E0D1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638016919, "uuid": "f7e158d7-e0a4-4ba8-8b6c-e9d20776661e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638016919, "uuid": "2b5c75a6-7509-4a35-bd2f-f1a817152ac8", "value": "24576:hrtb29jyTS6MoaS0BPXM3l9HDesNM1w3HzjM4LjvTCdPILP+4:7b29j5jf/GB6eZLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638016919, "uuid": "8474e265-5757-4bce-bd7c-1fe4062dd245", "value": 1234432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638016919, "uuid": "2084f83f-99f1-4d0c-a21c-a88eb3585530", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638016919, "uuid": "491e5775-e8a2-4306-bd73-01629b113fc9", "value": "a6e5a95ec64dd4e9394647e9ab023a95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17868dcd-4f57-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637999601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999601, "uuid": "bf1653f9-1c6e-40a3-a180-0803ea841573", "comment": "Malware payload (Mirai)", "value": "970394c7f6b7b294be47532ea56f3707", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999601, "uuid": "655fd9bb-5971-42b9-bdb1-969006d97299", "comment": "Malware payload (Mirai)", "value": "7f82026e79dea836a6412b79146c056832198dc94bd5d66af5e8031ccfcb69e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999601, "uuid": "60b07ae9-6452-47c9-b7ed-287502856c48", "comment": "Malware payload (Mirai)", "value": "c215460cffe876228ceae56f79a4eaf3a8358028", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999601, "uuid": "91083d77-9196-4637-9c4a-f59807e729ce", "comment": "Malware payload (Mirai)", "value": "ef23a275dd8a000acfa28f10b57172a9c33d925f894a899838d70e910adc82c9239df9ce7dd0529d6778d8f1b8cf9754", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999601, "uuid": "19c7b5dc-5d10-4453-88b6-26bc9e4aed1d", "value": "T1FDC2E124274E6435D6F040B8C9A0C29611AF5B6CD1DBF2263D440E3C79AA91E71F9E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999601, "uuid": "4cc8de01-6556-41cd-b9fe-9207285e276c", "value": "384:qdoc751FK5G+8qsM9poBAYYKN3gB6OzKRHMAyEZjvX4qw2HAiPhRaHhymdGUop5Y:qn75KMu5z6sOj4q4s3UoznY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637999601, "uuid": "d41317bb-0dcf-402f-a924-3e60b702c0d7", "value": 26296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637999601, "uuid": "8891aca3-8815-445b-b7b7-76a68791f0d6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999601, "uuid": "0b2cfa43-3021-4808-8a61-f1c4dc959e2c", "value": "970394c7f6b7b294be47532ea56f3707", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec4b4de-4fc9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638048737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638048737, "uuid": "d6bbc736-3b5f-48b3-a260-897333be19f9", "comment": "Malware payload", "value": "a66b580065de67a09e1ee1091004e9df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638048737, "uuid": "314646e4-75dc-4d65-9085-c873465daea5", "comment": "Malware payload", "value": "81b11c3463db6618788ee5883b39ca7bbadfad39bbbd5a02e0eb1e94d7e80130", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638048737, "uuid": "8f8ef539-df1b-4a67-bb33-0084fa4c5736", "comment": "Malware payload", "value": "9d8776323dd1973f0af6a5f795be07e3023d3e81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638048737, "uuid": "e9dea4bb-765f-45a4-96f9-4665b1687baa", "comment": "Malware payload", "value": "cf876f97a4e262b2098d979ff14600eab5bdf19a18ea0d32b2bac575ac4962df218b48b66a15d9850a4be1900bf8ad8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638048737, "uuid": "e8faaca0-0419-4d3f-887a-4b414272f0fd", "value": "T151941208A3188F26EDADA7FD4466514207B450572283D78A5FCEE4D94BB17EA8B32CCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638048737, "uuid": "a82036a7-5e57-49cf-a54a-255025b936da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638048737, "uuid": "e1828787-a06a-4e98-9921-f4553d1ec809", "value": "12288:o/ixBFmlFevxHp7ioBiGvIxHOOQkdmj4AEGo9llTGPdkhM8:o/i1uEuoBihg57EizdkhM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638048737, "uuid": "0025650d-bc6a-4285-8182-f2f8c2187228", "value": 447488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638048737, "uuid": "c1e761aa-9302-4088-a26d-21be992d566b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638048737, "uuid": "06720e96-abb0-4d80-ac3e-8ae4aae56357", "value": "a66b580065de67a09e1ee1091004e9df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1f8c89-4fd4-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638053405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053405, "uuid": "1ffd362a-e1d7-4b46-a43e-d738d08dd198", "comment": "Malware payload (Mirai)", "value": "01a639c37c89aa0abbce7cf894812bc1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053405, "uuid": "6cb5a9db-7430-495f-b73f-824c82e6fc5a", "comment": "Malware payload (Mirai)", "value": "831e983bdd85ebcd6c4d872bfcf1d2fc3fb373203c1d36aa93e2c8aa0d5c902c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053405, "uuid": "1501e9ae-f9c3-4135-80ad-086a3a61ab1d", "comment": "Malware payload (Mirai)", "value": "32058ad519272509e9a627c190bb7bf2eb51cf7f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053405, "uuid": "3a58363a-5850-4ff5-b31e-860ac9ec0a57", "comment": "Malware payload (Mirai)", "value": "b030dfa5b6af82f7cf32333b10d553ddedc91a11001a9be22c050e98c3bc1742f4a2e4e33b7678d956a26098ae14e5c7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053405, "uuid": "864f1a22-af3c-44d9-bcd1-e3e38adac267", "value": "T16443F190B19679A3CEA15836E6738FD7B2049C68FAE8B530A58403FC23C5F1461ED6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053405, "uuid": "aa379236-f531-4cc1-a68c-7b9e1ce47295", "value": "768:Pghjon/tbC0KUhjJpU4CAkGzyKTPSNFb/HbrQnMNeMzYVVPq3UIH2tD22uc4qo7W:vlb3RU4C40nrIYeMUVgHm6qogbS1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638053405, "uuid": "e91570f7-e752-4678-9579-ea1dd4b862e8", "value": 56048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638053405, "uuid": "614372d0-b38d-4c3b-9c8e-411150ea90d0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053405, "uuid": "d4a2afd4-727a-49be-8915-292ff62a8f36", "value": "z0r0.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1bba6ec-4f5a-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1638001148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001148, "uuid": "d75d0c0b-ed5d-40b1-b031-d54a197eccbd", "comment": "Malware payload (CoinMiner)", "value": "292990cfd27d869a5af4e466aa498f8d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001148, "uuid": "939dec2e-c79f-45e0-bd32-a7ad6c40319a", "comment": "Malware payload (CoinMiner)", "value": "833990804d459870448fdb9a0f74f6b8f5c59d395a71da86f347cf7a74f858d2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001148, "uuid": "a4346539-ad60-4790-982e-cd08ebd027bd", "comment": "Malware payload (CoinMiner)", "value": "e8d1372959ffdba695d2c1d8036735f0953fc274", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001148, "uuid": "8b7348d1-3229-4e1c-b3e9-1d6606e8b319", "comment": "Malware payload (CoinMiner)", "value": "0adf959b85e1c729a96348396e0165d88756ba7ca4781dbcbfc4b1585bc68a9e310a72342827961f8b118751430dfe6a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001148, "uuid": "5d737352-8f16-42df-9aff-eeb564044497", "value": "T1EC9623BD619877ACC01FC5B8A433FD4AB2F1171E43E995E9B0DBBAC033DA5049609B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001148, "uuid": "001f1290-7db1-4558-991c-1c9b998ddc7a", "value": "889336afd01a952ba79d1e90fb751739", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001148, "uuid": "e7ab2ead-0125-4a7e-8d80-51a16209ce29", "value": "196608:gj3ezSFsRZXLQOXSsJ8w9l65dfpvvSKzqOhPmDYW/pNjk1TbzFGvCe:gSSFs7XLQPHOOfpvFz9h+MWBxsTbxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638001148, "uuid": "964b8c95-dd9b-4a8e-989d-eb403b805fb7", "value": 9227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638001148, "uuid": "84e73c0f-d1cb-40a8-910c-0250469933ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001148, "uuid": "bf3c272c-fc4d-4099-904e-9faf2d2d4725", "value": "292990cfd27d869a5af4e466aa498f8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4ccaa7-4fab-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1638035771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638035771, "uuid": "4ddebc1f-336f-4679-b616-dea06c3b158a", "comment": "Malware payload (njrat)", "value": "22f26e034985e150cdeb214492905fd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638035771, "uuid": "d6755ed0-7d1b-4ba4-8caa-f0bf80dfa689", "comment": "Malware payload (njrat)", "value": "83b1180e8794a4d719586d4f5fe237b37167ef93c186d3c0976a70d39541c72f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638035771, "uuid": "1eacc8b7-3996-4dd0-b9e4-5a0bbaaa9b8d", "comment": "Malware payload (njrat)", "value": "08d5a4de12a85dce3aada80308274a87cc1a4195", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638035771, "uuid": "6d4b6305-4f40-4f1a-8562-98412cd7b423", "comment": "Malware payload (njrat)", "value": "56bc0f341aae5af709328786ebf2efbdbeb880b8dcdeb81d4a7f841c8b06fb931e472de09c9c900944b6a90fc471f7da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638035771, "uuid": "fd41fb93-7ed4-46ff-b06a-a95314b77419", "value": "T1BB74F191F2E151F7D6F2053201E5A23ED73296244724E9EFC38C2A1296527C2A77E3ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638035771, "uuid": "5431d41f-28b1-4dd0-becf-479d7cacfb5a", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638035771, "uuid": "6a393747-c48c-4912-a4d5-178f9faab944", "value": "6144:65aWbksiNTBRBvLn1Z3wu8HudThXp8jAVX46Brk/cL8QMGzJRErG7zWZTZd3m:65atNTv9L1ZJ8Hud1p8jAVX46mfQMGz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638035771, "uuid": "bf2b31c7-d5b6-407c-a263-1138b8b04264", "value": 364264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638035771, "uuid": "235d04cf-abb3-4b86-9349-cc9eb10e4685", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638035771, "uuid": "3aca57cc-767c-4974-bbd8-86e4a7a63d29", "value": "83B1180E8794A4D719586D4F5FE237B37167EF93C186D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0b5d5f-4fda-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638055898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055898, "uuid": "c4e7430b-201f-4486-ae80-f145431c2817", "comment": "Malware payload (Mirai)", "value": "365d24c8ab0e70a77a87c3914eb08f7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055898, "uuid": "597a3586-3947-4b97-806f-c0ab22f8cd1b", "comment": "Malware payload (Mirai)", "value": "84541bf06acdae21a6f52174f34d6cbe3ac32af6d1117aa4c564888cf6689f71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055898, "uuid": "eb7d0807-57c8-48a7-a306-61814b6fd573", "comment": "Malware payload (Mirai)", "value": "f33388f83c4957514d4f83b600eaaa68f4cde305", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055898, "uuid": "e53cf4fd-2dfb-478e-99e1-fc23cb8f49b7", "comment": "Malware payload (Mirai)", "value": "d9e5f39f123bc27a879b42b5a2ea2738d1ef635447e54c93ee1690c20b452896ba55b289cbd92056faee42f659cfaf37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055898, "uuid": "1d3aff97-007c-4400-a9d1-eef40df8f017", "value": "T10E63964D3E319FACFBA8463457F39E20A35823D526E1CA85E19CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055898, "uuid": "cce79462-a741-4ebc-81ba-54ab4bbc5b68", "value": "768:RzZWyvL5MsRXxPx2pqV2ULz9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2UlGecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638055898, "uuid": "44494da2-0bd2-4b70-b1b8-cd3faa6bbb34", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638055898, "uuid": "a7ad9764-8ea3-43ef-84b1-f6ad05520ace", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055898, "uuid": "23cf7a83-b469-4b3a-992e-1751f40bc2cf", "value": "365d24c8ab0e70a77a87c3914eb08f7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4a22b0-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971371, "uuid": "f2cc8d55-b323-4e0f-b4c2-7c9e29f90bb4", "comment": "Malware payload (Heodo)", "value": "26a956389f879ebb6e88a0bae5e6eee6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971371, "uuid": "67f3fa72-c60c-4a4a-9386-57dea8ff9cf6", "comment": "Malware payload (Heodo)", "value": "848ca4ab3b4ab50eba0fc58383232169d19e1fc384f749cc27dcea87b546267c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971371, "uuid": "209a0ea9-11cd-49d1-a707-c848a92e6dcf", "comment": "Malware payload (Heodo)", "value": "43b8a6096902de69079ed2f54e164dd9d666f385", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971371, "uuid": "3b15d308-9234-4dd4-ba97-52c0fc804c20", "comment": "Malware payload (Heodo)", "value": "b2ef9a687a33b10e434fe34645fa072c477ae5823bb7ed2fdb2324ca254b5694736c49e4bc04dc31d6a236beee76db60", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971371, "uuid": "5c3b0ce2-7822-4ef7-afdf-e83ec04daa8d", "value": "T1BDE4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971371, "uuid": "df33bade-054b-479e-b4c6-ec0771cdf23a", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971371, "uuid": "4c4bf327-9507-4690-8b8c-3000112866ec", "value": "12288:FqQlvIOH0GCTBHmPt4eBQh6ico09cDlB4Vx/ID:0uH0GCNeQsi7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971371, "uuid": "09d32393-d962-443b-bce3-a462372ba8c4", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971371, "uuid": "2620de1e-6d5e-4f03-ba42-d17c8715e04b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971371, "uuid": "710588e9-4919-4fb7-9e4f-5fd5673941bc", "value": "emotet_exe_e4_848ca4ab3b4ab50eba0fc58383232169d19e1fc384f749cc27dcea87b546267c_2021-11-27__000245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5716aebd-4f5b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638001426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001426, "uuid": "f4061522-8a54-417e-820b-1435d8e3cbb7", "comment": "Malware payload", "value": "365b9d035a3aedd50883013356d64e56", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001426, "uuid": "7f7577ef-1ee3-46e3-85da-4d296984002f", "comment": "Malware payload", "value": "894ccf5650eacb1e74ca0ed00b8496190880d27f32c9484b2fe1f33fe3b0137a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001426, "uuid": "d94ba062-efba-45be-83ba-3d8e0ba6f0d3", "comment": "Malware payload", "value": "9f6298edda4f02db9067584fe385492e2cc1d81d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001426, "uuid": "82a05369-4b18-4ac5-b64c-b33ce02f0dd5", "comment": "Malware payload", "value": "4fc582b54d32c418ac8ef961266fc2784806d74f8f6ba05b097ecb5d7162f50a70958f59ae4826060fff52eda7fe2792", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001426, "uuid": "8c131dde-b439-41ec-b471-e5258b58cc93", "value": "T196E53A22B1BD84F7D0623AFB9DDB6359B5257E702D28440B2BA47D4CDF39E803919287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001426, "uuid": "f83f0054-ddfc-4afd-bac2-f841f1711a39", "value": "49152:D5ihKUmN/NIE8xEVJgfgeITP6AI0bGY43A:4YUmN/NIRx4z3DbGYIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638001426, "uuid": "6c711adb-f513-49df-9ab4-24f79e91d1f6", "value": 3216384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638001426, "uuid": "243469e9-3441-4a0d-9a06-75e2128ff74a", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001426, "uuid": "8a458664-ce70-4b7a-bd43-748ec1c9bae2", "value": "Factura 0jhf8423984h23f89423uf8342gfhjug.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d8831f-4f5a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638001177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001177, "uuid": "8408cc4c-25bf-4fbb-9898-1831e8fcbefe", "comment": "Malware payload", "value": "679981e2a3e8c6d2f6386d609765d1ea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001177, "uuid": "6da27b3e-e90d-4940-9d31-6ab92395b5fb", "comment": "Malware payload", "value": "8dfade8dc8eae27c0d0b48b95fdc4353c87e9172eeb392844b341f88c154089d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001177, "uuid": "2c243ff4-943b-4df2-8545-f52d34e1a13b", "comment": "Malware payload", "value": "39bb91c1001fafca32c158d66c434b101e5bc3c4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001177, "uuid": "65899e22-f597-4bc4-a506-8648cd3980af", "comment": "Malware payload", "value": "fc1dc865283cad09382bc0db150ea08393f050a584245eeddd6e59978f53c67fbbea2cf8e45ac1ee011489131ecf71f3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001177, "uuid": "58c16a27-201d-4ea8-aa8d-7d1addbb3228", "value": "T174A4E1283B029E92E16815BBC0CB915443B15A5726F3E35A7ED932ED59123E23E0D9CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001177, "uuid": "562f612e-73cf-4f68-8d83-b32978c40237", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001177, "uuid": "068c92ec-1075-49a7-84ff-7bb4daa1b3ba", "value": "12288:LrfSRrSNil6s4A5gu7Q7jDJwjoF8b9WBMAz8acfcMQO4rdpVw:6hv4w52CMVzdK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638001177, "uuid": "e5be0c0b-97d6-42f6-8833-705446d1013a", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638001177, "uuid": "78ea02c3-b9d9-468f-82e6-cb891f28574d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001177, "uuid": "b3cb19ec-19ec-4765-8fc9-cad14cfb7e49", "value": "679981e2a3e8c6d2f6386d609765d1ea.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409da95f-4f66-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638006113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638006113, "uuid": "a5827c27-5713-4746-b618-637bb5403265", "comment": "Malware payload (RedLineStealer)", "value": "5999a323289235c0380844661c863998", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638006113, "uuid": "3705e474-106b-45b2-83d9-b7da9328f55f", "comment": "Malware payload (RedLineStealer)", "value": "8f1b6b2bb8a1655268d78c0c045046045a728cfe97a6b2922a7e7461afb5098b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638006113, "uuid": "0abbd086-6987-4ca4-943f-4897bc58a49b", "comment": "Malware payload (RedLineStealer)", "value": "94fea7f9a96989885c3f7599f04cafb6a1c9257a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638006113, "uuid": "07019802-fb1b-4263-a4c7-d2704d903f82", "comment": "Malware payload (RedLineStealer)", "value": "574e497067889a041519bf3afd3d39cbfe46fb67c23f95615e7676e394442d62bd4cfe88471eea53e2dc07f1d6dbb037", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638006113, "uuid": "8185411b-8194-47ae-895b-d52bb70db5e8", "value": "T10DB4F1036DD8F718A0915D3782CF3E295B926DD28B7295466B09FEF112A42122D3BF3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638006113, "uuid": "4613b339-4e76-4b77-ba46-5b1c92f528aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638006113, "uuid": "259ba8e3-3498-42df-8d4a-9a559f0c4d0e", "value": "6144:ntATSzS1LRPyHKbgVxQoIAVwPvNvVGB5yXbcPa+xp1R183YEb2ew4SGLXiHi:OTS2ryHKNOuP/bZWp1R1aFb2v4Lci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638006113, "uuid": "910eb858-bd0b-46fc-ac1f-5827e5c78434", "value": 504216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638006113, "uuid": "415652be-98b9-461c-87ce-7708559ba111", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638006113, "uuid": "ee91e545-86ed-4a86-9f95-0141564e2884", "value": "5999a323289235c0380844661c863998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d522679b-4fb2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638039004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039004, "uuid": "7765e4ec-4864-4272-bea2-30817cbf5eb2", "comment": "Malware payload (Mirai)", "value": "e15c242f5175992d90df0dabcfb8796b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039004, "uuid": "86c3486c-e643-4a64-9f86-342809d5fa58", "comment": "Malware payload (Mirai)", "value": "8f56a392a2e70a74f173e19eb1184ded7271008c996e8776c0aa95694c99a01d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039004, "uuid": "ad554fe3-3492-4294-b9b8-c71152cba163", "comment": "Malware payload (Mirai)", "value": "682515f8c8d4ad6758a21b0b262ac22e59beb9b6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039004, "uuid": "bcead01e-8e48-4d86-a43f-498302772a16", "comment": "Malware payload (Mirai)", "value": "aeb5ae7ffdaf7cc5cc3464249daf7d2a9cc40492378d948e2aa837b6c5e7b701c4026e1eaf444eb0c1d0d403fe0aba99", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039004, "uuid": "f0c57329-dc25-4ff5-a658-4d8c93d624d5", "value": "T181D2F11BDEE6F987F493B2336B5491BD82442AC746BC8581B6D87E0152CA10D2CF9FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039004, "uuid": "2fd48612-e9f7-45c2-8b8d-7c0b65916513", "value": "384:MxgYRwKusckSImz1QlY2JWkvPYipIY0Z4JlMe1YZNYQEw8LNUIbScaPFS+EKdBks:uealYxkvegxHQt8LaIbziFS+EskoUD/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638039004, "uuid": "893d33ac-e39a-414f-89f2-dade66a4c659", "value": 30152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638039004, "uuid": "4068dac5-5915-4c04-9197-fd3d64552191", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039004, "uuid": "f72cc70c-b64d-4b56-9247-e5f11047df98", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489b0600-4f2c-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637981215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981215, "uuid": "94767637-23aa-4b7d-b8ef-870947830597", "comment": "Malware payload (Heodo)", "value": "c05b1b18bd08d9c2036e291e510d4183", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981215, "uuid": "e44a5712-4050-4757-9d27-5636b8ceb6f5", "comment": "Malware payload (Heodo)", "value": "902026b43cd98d34cb9d7be1b86695bddcf0f2bbe4cb79df48f64e59f8e5e204", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981215, "uuid": "5c9fca39-0682-4864-ac0f-7a68102570ec", "comment": "Malware payload (Heodo)", "value": "046ee91d17b597012b04eb0fa875a39c0ee854d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981215, "uuid": "c113bde9-a225-427a-a040-b1d432729c1c", "comment": "Malware payload (Heodo)", "value": "a298e8e400089da965802bf7b06dbc5121cbb126bcafdfd148fb47628941b7bff8f18a80e7bea2fbbc968a13995dcbf4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981215, "uuid": "28bb64f9-eeef-470a-a943-d747cbd49f82", "value": "T1EDE4AE1277C1C076D4AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981215, "uuid": "b9d578a9-db13-46ea-9ede-b55235316c26", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981215, "uuid": "4275bbe2-3867-4839-8d2c-7e593e041fc3", "value": "12288:WKEUkuAOLka1miSmuYr1V7DAobS3qTHPR101D:TEQLka1nBVXAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637981215, "uuid": "7f32fd04-e06d-4ffd-8a9e-c0a2078b5547", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637981215, "uuid": "5c47f1ee-c0d5-410d-a00d-1f88c54724c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981215, "uuid": "2f27913b-a37c-48e5-9172-c8cf15367800", "value": "c05b1b18bd08d9c2036e291e510d4183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7948f30-4f8c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1638022606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638022606, "uuid": "f7931135-ca87-44e9-8000-fa3068cf5cfe", "comment": "Malware payload (AgentTesla)", "value": "2c5b3e96a5fbdbea19b7f52f3b63c85a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638022606, "uuid": "e26a1af8-c24f-4d39-9c62-b41fc3305a88", "comment": "Malware payload (AgentTesla)", "value": "90550e0278c126b303b0bef5949eec43d444346047cbcf53e5b1a5e8a17f53bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638022606, "uuid": "b1d39e08-abcb-4e1f-a411-8ab3da2d142c", "comment": "Malware payload (AgentTesla)", "value": "d035b762f1bcff1523efad4df415ec65222b770b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638022606, "uuid": "a2367129-10b2-4e8b-a19b-a917ea9d6daf", "comment": "Malware payload (AgentTesla)", "value": "e5a9846102339be8b1c1937558c8e6dd97a5a8239754988e1cb9bc37390be8fa2f2c5a26b9bc03af80392f6f81c655aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638022606, "uuid": "f7f30e7c-14e7-4c32-b6f9-6e3db664ae6f", "value": "T16AC42AA4166DAB1FFC76C3AD24D83195CB5050D1F186F84ED8D129CFA90EB2A3C136A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638022606, "uuid": "fc45d5f4-4565-40f8-a448-2c8434a5b491", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638022606, "uuid": "425acdd3-2a90-416b-91e3-cea7fcd61bd4", "value": "12288:z6XpOAyJ5AQzU0VtV64yTGj0m9npdawnmVTnAQzkA90:z6XplQb8Gj0m5pdzmVD7zpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638022606, "uuid": "6922e4c8-ee0a-42f3-9083-b0368c4c7d51", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638022606, "uuid": "1cd29c7d-c919-4951-963a-85f95035d024", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638022606, "uuid": "57f70ce5-8c5c-4ace-bad4-ee6a66141f7f", "value": "TT swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8bac5a-4f9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1638029030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029030, "uuid": "72ed9b91-34cf-472b-b2b1-8cb7cc5ac529", "comment": "Malware payload (Gafgyt)", "value": "b006990f8a65e610f9b9133608879383", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029030, "uuid": "fe200fec-5427-4817-8ae6-8648c9f92c60", "comment": "Malware payload (Gafgyt)", "value": "914cf6e8bb1a90e299f954e9c60293afbb07a15c4ece01518ea4792a7a65ac34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029030, "uuid": "01f7860c-2b23-49a8-b3a0-c93de65f91c0", "comment": "Malware payload (Gafgyt)", "value": "65a75292c3cbcb77b5c194be742324b9aeb5231a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029030, "uuid": "142d929e-651b-40dc-b0a7-3f3a520ba658", "comment": "Malware payload (Gafgyt)", "value": "98cb3a37fb4c6a473a57ce366524a15621d9a02809e9db65fdce2523f98ce7ce3a74bf7a83a0cdd94fb25c661bd58448", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029030, "uuid": "9e655dce-7169-4893-abb7-487f01541fed", "value": "T1A2C35B4794654FB3C087B9B524AF69300716A9925FAF2A8A713857F4078F8CE740FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029030, "uuid": "7fba5881-0833-4e91-a217-006c4cc4a6e7", "value": "3072:kr2gfGJ2vGqHKfx5hmiqgmjI0q4+2Ilue:y2gG2edfx5hm+mjI0q4+2Ilue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638029030, "uuid": "ef13fd84-246a-4449-a619-05d06529218f", "value": 119333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638029030, "uuid": "ed2bc9c7-a223-4af0-95e7-20027dd3fe9a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029030, "uuid": "8105d585-8c91-4d86-be72-786854824764", "value": "b006990f8a65e610f9b9133608879383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210b0372-4fda-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638055881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055881, "uuid": "c44a8276-d312-4c87-b087-9cbe37235a1f", "comment": "Malware payload", "value": "b781f41b1b8a5d28202ef17c5271cf05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055881, "uuid": "b173e8c8-1700-48a4-9714-bbfcea58f577", "comment": "Malware payload", "value": "922d6c9a83f437281f3a0f6710f7d0cea10176802eb801dea3b23abb1a69ee21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055881, "uuid": "4303f3f5-e7f3-4877-9fb6-05904412f50f", "comment": "Malware payload", "value": "a627e468b603ce6387eeee330c292e1bdee393e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055881, "uuid": "4f1fb680-a777-4e11-afb5-639fc1ac56a4", "comment": "Malware payload", "value": "2159c2ff0e95ff081b1d661094c20c6d63da52aab29795be451ee6cde0b5f60853bdd96a0da3bb7687fb3a9ee5ebd9fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055881, "uuid": "f7cb3cae-0c75-4098-8251-44680931a2f3", "value": "T10D5733185B505438FDFCCDB26FA04F5C2B38EF3D291CDC667B1499287A1CA4693A2297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055881, "uuid": "0fb499d1-755a-4767-b758-e8d66a6a30e8", "value": "f2f9102c7663962c22d17a8dabc5e7ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055881, "uuid": "108306b4-0431-4d2d-8678-c6375aeb6042", "value": "786432:2scxEFRah+QjSVrzynPLms9dkl8nv7D8/2jdZF0Hlfj:LcqQ5GVrmzmsZny+P+lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638055881, "uuid": "e2f525da-f24a-481f-9f3e-ef4569e533fb", "value": 28545024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638055881, "uuid": "db7b68b9-b550-40ae-b3ae-f828168426c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055881, "uuid": "a5e8c49d-11cd-49b2-aaf9-3bad49d0ebd0", "value": "b781f41b1b8a5d28202ef17c5271cf05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7177a6-4f4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637996017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637996017, "uuid": "028edc6e-5676-4e35-9934-144853b26ec5", "comment": "Malware payload (Mirai)", "value": "f7446dd871b744774facadf76a70ea68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637996017, "uuid": "2d27033c-4569-4be8-be91-fbccdfc3d334", "comment": "Malware payload (Mirai)", "value": "93760a638ac9cec4b62b5157d3efc5af84ae659c406a11628e8bd4cf4697b3c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637996017, "uuid": "d86aae4f-63d4-47f8-8e75-5f7cd4271e1f", "comment": "Malware payload (Mirai)", "value": "e2beccbcf8106efe5d963d728bc489b5b8fa9e9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637996017, "uuid": "ba4c4e48-9702-4d34-bdf4-ed2f71b2a191", "comment": "Malware payload (Mirai)", "value": "3a0b7be87b1d8df185287f65512b09eb3dc5e431f724f0e5ea95e0e125275b6f9284679d797d01b86580f1f966672ca2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637996017, "uuid": "e136c75e-9fe9-48e3-b48c-e79537fd25a9", "value": "T18C64D08AED41AF25E9D526BAFF1F024973734BACE3EA7110D620972037DA65B4F36044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637996017, "uuid": "86cb27fa-7d90-40db-b5a8-36161b4dd79a", "value": "6144:7O/QJHZweEL/NOjCHm7FZZncDabE5wKSDP99zBa77oNsKqqfPqOJ:78QpZsKCaiDabEDSDP99zBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637996017, "uuid": "ff493d45-12ea-4831-806c-8fe9f37c4645", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637996017, "uuid": "acbd565d-fe10-4773-92c4-a0431d2ecfa2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637996017, "uuid": "2e385d3a-ebc1-4efe-bbfa-6adb988c54c5", "value": "f7446dd871b744774facadf76a70ea68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d63181-4f9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1638029021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029021, "uuid": "447ff060-72a3-4eeb-bca3-a1a2cbc44aa9", "comment": "Malware payload (Gafgyt)", "value": "e052d76b7d00cbbb310753fb20c5615b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029021, "uuid": "4f1286fc-5b8d-48db-a93f-4056bac89565", "comment": "Malware payload (Gafgyt)", "value": "94265508381e773d888e2d21cadd31ab8a083e9d96d456fa448a27f6b9fc7f42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029021, "uuid": "bd99adff-8b24-4e7b-a142-17da9a9d65f7", "comment": "Malware payload (Gafgyt)", "value": "55f157d902d036171c886f8b857e0acd8d63a8d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029021, "uuid": "7d661e21-c394-41e7-aae8-fe8a2509a83c", "comment": "Malware payload (Gafgyt)", "value": "4cc12768077348206ae46a3476315f2556c974c44b972e4f8dc6266a64bb924db5471489ed533d7a170f05e95238d483", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029021, "uuid": "7e13ff85-0460-41e4-a6e9-50c84d2b2d91", "value": "T107F3946ABB619EB7D81FCE73059A4502148CD68A42D93FAFB3B4C518E78B94F04E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029021, "uuid": "51f14625-97f3-4467-ae80-8d7ff473adfe", "value": "3072:B5ThuWPX4xwVKT5hJ9ETKhmvtOqx13LFRWq:B5S+KT5hJ9QKhmvtOqx13LFRWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638029021, "uuid": "d5cd6d54-4abd-4256-a35b-4e9fe0c8f23d", "value": 162329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638029021, "uuid": "e0b92f4d-11f3-418a-9bfd-19e9368ae542", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029021, "uuid": "e81ef16e-be9c-4634-a891-06aebcf9c254", "value": "e052d76b7d00cbbb310753fb20c5615b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ece86a-4fda-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638055920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055920, "uuid": "279b9906-483e-4cd5-937b-f138141ac03d", "comment": "Malware payload (Mirai)", "value": "d55118234c04dc974b2bdf70da83eba7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055920, "uuid": "6345a3f7-d526-4b29-a1bf-fc73a68cc46f", "comment": "Malware payload (Mirai)", "value": "942b14f3bcfae5980ddd4f2f2f215d0492f038fb190ed571658168e20c1cdaf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055920, "uuid": "42eee9e0-4d5a-461f-bcd0-c2222964c84e", "comment": "Malware payload (Mirai)", "value": "76b545e7feb3f0ecdb5b3ca88f9413057a0d7020", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055920, "uuid": "e5d2caee-8762-410f-83cf-0f47aa8cc2c3", "comment": "Malware payload (Mirai)", "value": "05d033277db6fec64cfa6741088a26b53b2f5402864dca227882c75ceece7001a7aad42bac0c535150d73d2ff9a03d6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055920, "uuid": "a73edb9b-0c15-436c-b468-d19a1dcaf3c0", "value": "T1C9732B99F800EDBDF44ADAB78127490EF530A3508A920F37A727FD977C720A54917D8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055920, "uuid": "95e0794c-0dcd-4e84-bdd9-a3e86520ff36", "value": "1536:HmzTIqmTvmfP3zQHM/mlPCyKhly8qaLym4blXEOKfvcNdG0w:HMEHM/mlKRhlp6b5EB/0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638055920, "uuid": "f3d9dc56-2563-424c-aa6c-835c3c9e6f72", "value": 74180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638055920, "uuid": "4a884fbe-8919-4cf7-837f-732bf8551821", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055920, "uuid": "9db638b5-2d86-4085-aebb-a31d8372bb3e", "value": "d55118234c04dc974b2bdf70da83eba7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f899fcc-4f5c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638001870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001870, "uuid": "911e1501-5fda-49c5-b3cd-e632c71c4231", "comment": "Malware payload (RedLineStealer)", "value": "14d1dfa9d6eeaabecfcdfdcec86d0374", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001870, "uuid": "8d451953-a8bd-4055-a73e-9eee177274e6", "comment": "Malware payload (RedLineStealer)", "value": "957f253b1c0aca309013bc1d78426ef723803555aa98e707a7ceecaba8581203", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001870, "uuid": "a8b297d0-8824-4647-b847-355aeaa32f5f", "comment": "Malware payload (RedLineStealer)", "value": "5c1cc80e6498e06ab6fbe2ee8fd5f358bb97bfa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001870, "uuid": "655bfb75-efea-4ebb-9138-e74b22106233", "comment": "Malware payload (RedLineStealer)", "value": "32c47bbf4ba3261fa4be219429a8a3412c6ccef7089faf8c18604b389a9aa4e5362ea09c2e527761d239e0c655130b30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001870, "uuid": "a4013cec-b465-4932-98d6-c39038e63ad7", "value": "T1FA549E10ABA0C838F1B756F889B993A9793F79A16B3890CF53D516ED4635AD0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001870, "uuid": "b75f64d1-c164-41ca-9ff8-949f1baba7eb", "value": "ac14a22dc3791ebf7f4a67e197a18bc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001870, "uuid": "0ca781ae-fbf9-4a60-98ed-990af794e687", "value": "6144:heNpAs3kNkPFmAcy6dYTRSXuZet0yS8iYezV+ti12RziiqYN:hcpXS2FmA16dYTRSXuZet0yS8iB+oa7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638001870, "uuid": "c19a1ba1-6595-42ce-8dbc-460e54f7f6c0", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638001870, "uuid": "6d0c6ac7-4c90-4e02-8c70-1212c0b3bc9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001870, "uuid": "7aec9bac-fb86-40c3-b12e-59da1ac5e61d", "value": "14d1dfa9d6eeaabecfcdfdcec86d0374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9bee041-4f5e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638002987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002987, "uuid": "cdfa52f9-b8b2-4ab3-ae3b-e3f4cc860463", "comment": "Malware payload (RaccoonStealer)", "value": "e9c55caad9f81092f6f6adc89c525949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002987, "uuid": "be6cb9b4-3c67-41f0-b300-7dbe1a9c5b4e", "comment": "Malware payload (RaccoonStealer)", "value": "9684510f52cb986f32e2c3c9f9590b8dafb9786ca42d35586d353a7733b77fba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002987, "uuid": "637a70b3-8210-4149-84df-03a81da925a5", "comment": "Malware payload (RaccoonStealer)", "value": "f0e55a9df6ef8ac9bd1ff3919354bf62c00bc5b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002987, "uuid": "239311ae-d01b-4542-8856-417072c25bd0", "comment": "Malware payload (RaccoonStealer)", "value": "d6dc9b0557c6d98919ab9c03005ec871a4e5a1f6682a7ac01b0f7d0fe545eb365b97dba2ddcecf91744d9a841ce2c5c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002987, "uuid": "6f3027ba-73f3-43b0-af9a-3d1011233880", "value": "T102D523020254C002F9E6B670BF29C7314B52BD258FE8955E25E1FE0F39BD3A3657AB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002987, "uuid": "5c3a3987-59da-4a49-87ef-33d9814c6ef4", "value": "409ae534a0f9c0411b6e90c7bdee4f41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002987, "uuid": "e3ff1cd2-a38e-4246-82af-b0c6c98e355c", "value": "49152:aRjMZJMbjOE6uL32IahRJDLSdsNqukmL3P7FB2Ht9eoJuf8wrnFVOTPXe3fZMS3Y:aRjMI9J1ahRJG8drBB2HjXuhDFkfSMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638002987, "uuid": "1039362d-8fdb-4b0c-a1fd-0abba82bdf88", "value": 3002064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638002987, "uuid": "42b84434-eaef-4904-9900-0efd05a9a673", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002987, "uuid": "2df9d7f6-7ed0-45e8-8599-74c664228e30", "value": "e9c55caad9f81092f6f6adc89c525949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483c6781-4fd9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638055518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055518, "uuid": "73f23427-9862-4437-a8f8-f42d5c565b99", "comment": "Malware payload (Mirai)", "value": "d59ba4f37b722033d9ffb11b4c84169f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055518, "uuid": "08f91e63-46a8-4b33-941b-5e39f184f9a8", "comment": "Malware payload (Mirai)", "value": "979115175c29047046dff8a7c624d9dfd343cfa31fe5103136dc0eef48a8bbe5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055518, "uuid": "640c2b80-0fbc-42d5-a8de-d773cba902c7", "comment": "Malware payload (Mirai)", "value": "eefb5d87902e77756d71981dd81ba68ea4e5d374", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055518, "uuid": "b2326ebe-600a-4e0b-8fe8-11a08d71fb6c", "comment": "Malware payload (Mirai)", "value": "616420d13d5b3f374368db21c34e944bf456f52c2099d3bdac63934a515c7ba8bfe80dc71705fbe13f2b9fb64a58b285", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055518, "uuid": "88b3106c-aa5a-4b22-a869-d3190ac7e216", "value": "T15493B409BFA05FF7E8AFCC3345E92745248D555A21A83B79B930D828B25B24F15E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055518, "uuid": "50764d9b-dfca-4190-9e2f-1f29bca17bc7", "value": "1536:W9BsOSrxvOZsNc6Sg+eBkwl+EwDld/kRRccsiaoowzA:WbsOSrxvAsNc6SgTol9UDarI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638055518, "uuid": "83981fc8-c7cb-4e4e-9958-d98bfd66b175", "value": 93408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638055518, "uuid": "de076d39-d1cd-4181-96d0-b8126fefa76e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055518, "uuid": "266b5de4-9a9f-4791-9ab9-85fb3c1714f0", "value": "d59ba4f37b722033d9ffb11b4c84169f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824b78cf-4f60-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638003646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003646, "uuid": "bac32cde-42c0-4520-8275-36ee786e31e0", "comment": "Malware payload (Mirai)", "value": "6516c9f421523f326e509d68212997ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003646, "uuid": "41598bc3-ded7-4349-89c2-76192e79319c", "comment": "Malware payload (Mirai)", "value": "98e9173588dc3fa70c9138dcd161f144752b2a3eb95649667e6cd33dd1a1f8b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003646, "uuid": "a27dbc09-421f-46b3-8f0b-7229025f31ad", "comment": "Malware payload (Mirai)", "value": "a8c6003a68906fa17785e30efc0f0834e09147a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003646, "uuid": "a51b50cf-3a28-489a-8b8d-1df86aa8859f", "comment": "Malware payload (Mirai)", "value": "0ee67a95f6306ca6ced79691d3584b1b7a715479da264c62aed762e2359a3ee4d5b1dff9d9fc331bc36c7f6aa6edce54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003646, "uuid": "c7cb2127-200f-4e03-919a-fe9ff2c79f6d", "value": "T1CF538DA5C8A8ADACC6654978F6118839AB13F00C61A32DF6DA47C352945FDFCF0197F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003646, "uuid": "f1d5f26a-086d-4fdf-b822-1c8ceb7f884a", "value": "1536:X/pdpuGkBa9atiFxKyQ8MZso9tUoLfs3m27zo8DfnCxAi:XBdX4PtiFxKyu9tU4f+Tw87nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003646, "uuid": "20e1d7d7-8982-4b94-aa3d-45df906c6e42", "value": 66372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003646, "uuid": "0f6bdf6b-e07d-444b-94fb-09820e77612b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003646, "uuid": "e0be4548-03bf-4347-9cc8-cc13c544d876", "value": "6516c9f421523f326e509d68212997ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3556eae-4f95-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638026545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638026545, "uuid": "894b5c04-0b6d-4163-8ee3-de67f5667100", "comment": "Malware payload (Mirai)", "value": "3600f08039df4cb351bcd4d4d5026c28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638026545, "uuid": "ec6a65a6-aa47-47f0-a5e4-2f974b7acbfc", "comment": "Malware payload (Mirai)", "value": "9bc89501cc83338ba3134a19a6c06a74e2fe3d5d60d4da73509ceefb79a96835", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638026545, "uuid": "dccc8593-e3c7-4a03-bd1e-4c67bd8324d4", "comment": "Malware payload (Mirai)", "value": "77af8ac5f779ab640f9d9de5a6b038d2ac3c8606", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638026545, "uuid": "7957f56a-15d2-4929-851b-5edd30a300e9", "comment": "Malware payload (Mirai)", "value": "759b45b90f2692aa4be542a972cb5fea38ce7c86275f601d7040d2606d6d80b02b71d5b6a2f6b11ade3e57e142d9fab7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638026545, "uuid": "6e6e0ae0-4b96-41d7-b284-e7570d8059aa", "value": "T1FFE3A5496F612EABD86ACC3344DD0782A4EC531321AD2B66FD38E654F7D768705E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638026545, "uuid": "ea5fc318-db78-4b6b-ab65-894e4653dc2c", "value": "1536:jfdtw65Jqea4MNI5fU5HVc/rfcy1ZPvH7d/uYQP4hM4io6M:jfbw65JqGMyfBfcy1uB4hV6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638026545, "uuid": "9a758775-8b68-413e-9004-8c72f496b33a", "value": 146360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638026545, "uuid": "ad4139f7-5344-4f38-abd9-b7653d2a169f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638026545, "uuid": "34e2d969-15ba-47fd-ad15-58401085d983", "value": "3600f08039df4cb351bcd4d4d5026c28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c310437-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971370, "uuid": "f62c5b73-9468-4c33-b6db-28ffad8705ef", "comment": "Malware payload (Heodo)", "value": "8b218e807b595da011337ec8d7932768", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971370, "uuid": "2082dc35-a8ac-45ea-ae44-f2ccdd929ed8", "comment": "Malware payload (Heodo)", "value": "9d0b5a689a094aaa570ff4e842616e577f25343d896aa2067a180dc66ae77d6d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971370, "uuid": "c95b176a-a097-4c23-9816-94228f725cb0", "comment": "Malware payload (Heodo)", "value": "bb558019e38b0b8373db6019427cafe86c58b357", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971370, "uuid": "18d3c1a7-53f1-4ffb-94a5-fe24dc279ca2", "comment": "Malware payload (Heodo)", "value": "160cdcac8db3f0d60179fb0b3b03e29b8212937187a05202a7c57b0b8322a868488d3b89657fe11544796f3c42b9982a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971370, "uuid": "a61be189-a7ca-4290-94da-a8c97a8d8737", "value": "T1BCE4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971370, "uuid": "f8219661-b380-4281-9db1-4ad83b451027", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971370, "uuid": "f0f7cd03-8eb5-40df-88ea-e8042459e146", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhmico09cDlB4Vx/ID:0uH0GCNeQki7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971370, "uuid": "c73229c7-288d-4c79-8eac-40841696c43f", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971370, "uuid": "8c8ed0bc-a108-44f2-b903-367c774ceafd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971370, "uuid": "4514a02d-74a5-4b0d-a7e8-6ad89a11e7ce", "value": "emotet_exe_e4_9d0b5a689a094aaa570ff4e842616e577f25343d896aa2067a180dc66ae77d6d_2021-11-27__000245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464c2c85-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971333, "uuid": "e3e979ee-e7ce-4791-8b8b-c60b29801c83", "comment": "Malware payload (Heodo)", "value": "5cc401f1e0f419f07fed8b93a71dc017", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971333, "uuid": "430bb66e-f195-4570-884f-7e4452d47d8e", "comment": "Malware payload (Heodo)", "value": "a0a3f525084239e91b24b5394017e941f6eda5ae0a19165a63aca119d5841d8b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971333, "uuid": "18c1fcab-1a4a-4ee2-8e19-bbd7926a482e", "comment": "Malware payload (Heodo)", "value": "19cd58d645cdaf31315108cea2133373f584e06c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971333, "uuid": "1146ec0f-cd60-414e-a8cf-6418f763ca65", "comment": "Malware payload (Heodo)", "value": "3a6888518ddc387106395dc919c1b90f2d452e5e3a4f42e98358a0a9c416e753b6ad24e79621157fea3424f156a08925", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971333, "uuid": "053e4146-acae-496f-8a41-a2ccee753295", "value": "T18FE4AE1273C1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971333, "uuid": "bfcdb643-0e69-4ff1-b348-21e1ebc205a4", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971333, "uuid": "8cb84ab8-268d-4350-84cb-8cd545dd4b5e", "value": "12288:WKEUkuAOLka1miSmuYr1V7dAobS3qTHPR101D:TEQLka1nBVhAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971333, "uuid": "417e5956-cd5e-482c-95af-12a916753a50", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971333, "uuid": "54edc6bc-1cba-4212-8a95-04a49163851e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971333, "uuid": "8f468d70-331c-4598-b5e0-e3ac3129469e", "value": "emotet_exe_e5_a0a3f525084239e91b24b5394017e941f6eda5ae0a19165a63aca119d5841d8b_2021-11-27__000207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefdf0d8-4fb4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638039906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039906, "uuid": "79500d50-7412-4707-ad13-9fdb4ba208d1", "comment": "Malware payload", "value": "cf8d8ef0cbb6dc32b94106bd6d3382f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039906, "uuid": "74c900ca-21d3-4169-9054-aee8c5ed1ad1", "comment": "Malware payload", "value": "a196c6f0e2c8355b5dc3ff846ddd055add175e048c4f58c1270424f8fe7b5f3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039906, "uuid": "4d2d08a9-af5f-4514-a71f-2e87a59a3cdc", "comment": "Malware payload", "value": "ad09391d39722a55ac24a1107b41ae8311c62e91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638039906, "uuid": "20536f8c-aa06-43b8-ab97-6ab8e65fc99a", "comment": "Malware payload", "value": "dec2cb33b4bd4834990be5e6568a2421232d7f102308ac45dc05b214d2ca0587a8361196a9e0e17e6bace94b62790c00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039906, "uuid": "3b164d8d-7191-4029-b1c7-c096e6d94217", "value": "T1A655333661C47889DD9F53F81695EF34ABE902895CE4A0AE730D3FB361724C6B34989C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039906, "uuid": "c4a0fd86-4e36-4f31-afbb-4405109ab812", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039906, "uuid": "dc0968f5-50c5-4f7a-a156-7d54a74f85e7", "value": "24576:bKqv6eJQV4zxNt9jJn3bIiE1BaOOeIWTf1PD51lBgHtVMkEaHNYK3K7oy3NVzLW:bNCeo4zZzIiE1ueIW71PV1l27MNawU66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638039906, "uuid": "b8f4d8d6-03a1-4331-806b-6354e4fffd8d", "value": 1384568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638039906, "uuid": "21264ae5-8b2d-42f4-ae0c-72f063a81fe1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638039906, "uuid": "94b5ee7c-ed51-4964-9175-09c5c27e052f", "value": "DullWave.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29305d4-4f57-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637999969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999969, "uuid": "31e3ec21-db76-4b31-bb7e-384c126b337a", "comment": "Malware payload (Mirai)", "value": "1351873e3974c25dc850ce4076b2becc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999969, "uuid": "c6d39d1e-59aa-484b-89b2-83b53ea57dc9", "comment": "Malware payload (Mirai)", "value": "a32f08c0ae4198034597c18e781d37604829450868a2144949120fcf7d094f66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999969, "uuid": "07044426-c556-4686-8de5-08c24dfc30c1", "comment": "Malware payload (Mirai)", "value": "516e855604e69114e7e24ddf27223dcacd07a8f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999969, "uuid": "9c678a6a-d818-4e1a-b22d-5d30a05f8215", "comment": "Malware payload (Mirai)", "value": "e4fec256c59f0f9d07fd4724e58aa2f93a1b790119c88ac1c6745892164eea1f1d2327c21545b77047b21f872867af3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999969, "uuid": "6ed93ef6-7b57-46b2-ae8b-365be3b16b33", "value": "T1F6734B24A9792E27C1D4A17E62FBC321F1E6230E25B4961C3CB60F8FFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999969, "uuid": "1b99fc34-7a74-4dc8-b8b3-a5033deaa8fa", "value": "1536:SbHmkTSo3BOIqS5aq+Dc035R9QuEk6vNNTKjf3FRo:omcjaq+Dcc5J+vNwjfHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637999969, "uuid": "896bd917-a875-4fcc-ae11-69b64e630991", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637999969, "uuid": "1310559b-00ef-4d39-86c4-45966749aafa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999969, "uuid": "ef6c21ab-0efc-475d-b6ea-caa8bf43cdc9", "value": "1351873e3974c25dc850ce4076b2becc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5025fe50-4f62-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638004421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004421, "uuid": "070a3d30-c982-4367-8777-d79d4c7ac564", "comment": "Malware payload (Mirai)", "value": "aee78c941d7743c76549b7876039e9a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004421, "uuid": "18a0a270-5df5-48f8-9b80-01e5259642c2", "comment": "Malware payload (Mirai)", "value": "a59480e74d1550afc4d40bb952938fd54b1c332702f02eb4da57d0182ce214db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004421, "uuid": "5eb4e095-87ce-438b-bfe2-2a5a47a6624b", "comment": "Malware payload (Mirai)", "value": "4e3ea22d9a7ced1b39fe3471e1ed592879a67110", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004421, "uuid": "ff159447-5d9c-4711-8028-2fe1a8e648a4", "comment": "Malware payload (Mirai)", "value": "576f79d34e8faaf7840a39ecfa89e952d3e4fbf51f42b68edee95676e7252010dd6979b1a015a7feee15d63c1247d95a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004421, "uuid": "73474179-625e-4b54-831c-a72888afa51c", "value": "T1BE735C34A97D2E16C0D4B17A22F78751B2E6220E2AB0865D7C720F4FFF34644A8562B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004421, "uuid": "46231311-4b14-4ab4-9c64-8f51f3359067", "value": "1536:nanV3HoEuW5WzR1YznvIJgLWo8K142cTcvAB56vZ25PyJRFFU:oHoEuW5WzR1YDxcTcFvZeQFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638004421, "uuid": "ea14c407-996a-4286-801b-bd26cea43f8d", "value": 75764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638004421, "uuid": "25e1fd03-b9bd-4eda-b8ad-c6dd517ebbc0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004421, "uuid": "bbfce6d5-aa1b-4ab3-99ce-24bc9c3ff3e9", "value": "aee78c941d7743c76549b7876039e9a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd77149-4f9d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1638029888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029888, "uuid": "e9aa807f-64d2-4826-86a3-c874a74d31f3", "comment": "Malware payload (Gafgyt)", "value": "231dbd0773e8e4603700d139efa43c54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029888, "uuid": "2b3556c9-c049-4d98-acfa-81ce74f4e501", "comment": "Malware payload (Gafgyt)", "value": "a82e9c6b2bb168922148f11d6be91db77a37bfe498db97a49c61b24fe87b6fbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029888, "uuid": "b4af0a21-a1a1-41f4-aa2f-f895ceee575d", "comment": "Malware payload (Gafgyt)", "value": "9c588102e911ada00b87080ff5cdbb2072070aaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029888, "uuid": "a9049cc6-a199-427e-a11e-33ba7c806e4e", "comment": "Malware payload (Gafgyt)", "value": "d349014ec403bbb187faa04edb728f94452920f8dcc6a02449de705041ff0ecc9bae2075b0c0b1b943db2fe409365691", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029888, "uuid": "18a4bd4b-4c42-4170-bb12-ffc764297785", "value": "T13B043905DA404757C2E327BAE68B434E333347A5A7DB33169938DBB43FC1B995E26821", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029888, "uuid": "6be7d3be-2d84-49cd-b176-8ec70bab8710", "value": "3072:kOkdejDla5n86zI7oGAE7niCyvv5hLag/YN5M/9AQ7qmRwfBL+QHyb:kReXla5n86cEGLiCy35hLag/YLM/9/OO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638029888, "uuid": "46510129-701d-4a60-b1b9-ce56f9da0195", "value": 188235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638029888, "uuid": "2801bd0b-f1f5-468f-8661-c041a4cfdf56", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029888, "uuid": "8445f051-9db3-4cec-9bf3-39030875a8d4", "value": "231dbd0773e8e4603700d139efa43c54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b4fcdd-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971329, "uuid": "77171a1e-114e-42cc-8618-e9a2485dfdea", "comment": "Malware payload (Heodo)", "value": "bc6b277e3859f746c5cb6b7607de96cb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971329, "uuid": "76a9aa38-ced4-402d-864d-4ca1cddc2256", "comment": "Malware payload (Heodo)", "value": "a8eaf1a79ccf599c781da53a862119e80fd589f08c857b9fb5abcb9a21180ef7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971329, "uuid": "4a685543-b9be-4de4-8105-f99ff2748fac", "comment": "Malware payload (Heodo)", "value": "eb4840b3a772af7177676830c74f2b34dd641d37", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971329, "uuid": "44452595-16c3-4af9-b740-488fb1471bb2", "comment": "Malware payload (Heodo)", "value": "d333c8da4f67c20cac45a54f06c1739ccfd38adff0df1f55e2ba572d0900cdfef5b509d0690a421fee1e0821b04dfe5e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971329, "uuid": "502262b8-51cb-47f3-aa88-c0fc2b39d9a2", "value": "T109E4AE1273D1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971329, "uuid": "91e024c4-17a6-4d30-81d9-b8cfe97bce9d", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971329, "uuid": "ed258deb-c84b-4f11-b385-d52106d5acf9", "value": "12288:WKEUkuAOLka1miSmuYr1V7JAobS3qTHPR101D:TEQLka1nBVlAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971329, "uuid": "9b396293-553f-476d-9298-38470840632f", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971329, "uuid": "985fba04-31a3-41dc-8dab-88fdc3b078a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971329, "uuid": "3d918df0-ca77-4911-8a2e-8d3e906aa33a", "value": "emotet_exe_e5_a8eaf1a79ccf599c781da53a862119e80fd589f08c857b9fb5abcb9a21180ef7_2021-11-27__000203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4404ae71-4fd9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638055510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055510, "uuid": "5ae0f462-55da-4bbb-8f64-a77a5f9587c3", "comment": "Malware payload (Mirai)", "value": "e66b3de4c9d57ece786d947f9b7b29eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055510, "uuid": "78d33526-8893-4d4c-b6e9-ba70249a5f67", "comment": "Malware payload (Mirai)", "value": "ad36d2cac5800f2fc6456cebbacbeeedd29b7dd89b186a3ec69df40696ba526b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055510, "uuid": "6df07dae-9c5b-4ace-9a11-394079d5e79e", "comment": "Malware payload (Mirai)", "value": "8ccf519b3f8b813037388a4ce8b130949a186696", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055510, "uuid": "98caab56-2009-4d7f-8f2c-21102861c066", "comment": "Malware payload (Mirai)", "value": "633050f76d12d3e93b706325e267457f9bfc1f8d5257d4540cc9c0e3a1aeffc424f1433ffc4f675858d4009c599db267", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055510, "uuid": "ef821b48-2c59-4c8c-a067-df183aecd6bb", "value": "T18B63390177584E43D1A21EF9393F17E593EEEE8021F4FA842A0FD64A5271E33494AF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055510, "uuid": "f976f403-3122-4cb4-9d5f-ee4df71d487e", "value": "1536:22uu2JmNsiaQPlge9LM3bvyu/rQUSe4yjCPyxp:2+DPGOLE/dSefjhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638055510, "uuid": "bd59b167-2da7-4181-8d03-4c85dd65b2db", "value": 68352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638055510, "uuid": "40870f1a-850e-4ff4-a3c2-3ab8f9618df2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055510, "uuid": "081ac84b-15ac-4818-bf81-4e4cabfa5528", "value": "e66b3de4c9d57ece786d947f9b7b29eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7350724c-4f81-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638017794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017794, "uuid": "c2e33f67-5d10-462c-9dc3-b287a1e52a7d", "comment": "Malware payload", "value": "974e2089ec36394a5007befe45a70842", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017794, "uuid": "67f26127-78ec-4ffc-a4b7-b5f3abc56d17", "comment": "Malware payload", "value": "ae9bf7e4d1c2191218dc39515950a2363975f4e30faa3dd994a9a905a4014595", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017794, "uuid": "b29ca346-71e2-4217-9a2d-7c5e7eab27cc", "comment": "Malware payload", "value": "3baec1e76af9b025f98b30a5ab584ec14ad1e12f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017794, "uuid": "cd9eec15-122f-4f5a-b008-c37b3e997c67", "comment": "Malware payload", "value": "0128cc39de62279145e3ee5d670e7093cd6ec84328c6b6c760a3b39d3d04e4da3f844ee6263628647f2fc28450d93d33", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017794, "uuid": "c2c734fd-7d96-47a8-b120-1985e4281e7e", "value": "T170249E4277C680B7DAB722B18A56A32EB3E5C700473B69CB57D51C242B355C3A33DA1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017794, "uuid": "74012cbb-76fe-4312-98fc-e31c2ad7088b", "value": "6144:WKEUPDI8HTI4IPualOM8Vka11WqQtXwpomuJ:WKEUkuAOLka1miSmuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638017794, "uuid": "6b1231cf-201d-4696-a2a5-a16dd1400c3f", "value": 228960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638017794, "uuid": "73c3b2fa-e596-45f5-9ee9-0d5727c1466d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017794, "uuid": "d24c3587-7b14-48c2-9ac5-9de04e507322", "value": "emotet_exe_e5_ae9bf7e4d1c2191218dc39515950a2363975f4e30faa3dd994a9a905a4014595_2021-11-27__125630.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36882152-4fb8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638041314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041314, "uuid": "996169c5-ce5c-4813-86b6-315475f3e44a", "comment": "Malware payload", "value": "9ae6eff275090becc5e96bcc25d85c02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041314, "uuid": "1c7cd59c-502a-4452-a79c-3b8fb45af8cc", "comment": "Malware payload", "value": "af56a24c3af012c1ce963d7f752185e1cf079a972ea58c6c4c334b69e0324a37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041314, "uuid": "248f2faa-2041-4887-8bbf-13807abc0492", "comment": "Malware payload", "value": "7aad5325df4e27aea7813c7846fef772770c6db3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041314, "uuid": "f5e6f44d-ab4c-4341-9de3-9b62842f79a2", "comment": "Malware payload", "value": "0aec909fda975a6a0c96c44183ea99ccd4929b4f16b9265bfcbba540cc83cc29bfd8797c0f5c9f6f60beef64323a7d6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041314, "uuid": "7eddbe56-9083-4954-bd4f-e2bff5889234", "value": "T104F633BE0FC5666EFAEB5E7EDB1A07933B5A005B3384971E3DD126D2BA604305E6440C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041314, "uuid": "6236ba0d-2eb6-41bd-9d82-22240822287b", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041314, "uuid": "d2a34a74-cb9f-40c0-acbf-55364f16ee16", "value": "196608:/czLT53g1O5QoSCJPwiOHjpVOPIg4Rffhzw0tGr4WdenReA77WzgntrD:EzJ3gKSCJP2+zI2ZrDMZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638041314, "uuid": "3caa0fb9-9292-4261-b67c-2ccc9fb3f3ef", "value": 15630848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638041314, "uuid": "3d1497b7-219f-4451-9a14-5ff1be635f7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041314, "uuid": "2c3ad14f-d67f-4071-b0aa-0444d6c51430", "value": "modest-menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bac5ea8-4fbc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638043202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638043202, "uuid": "d18dac6e-080d-4323-b76e-97dff1c0f8ac", "comment": "Malware payload", "value": "ac1b01ef39649181eaaf4a8cefdafac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638043202, "uuid": "60616de5-3f40-4a92-893f-5eac16a625f6", "comment": "Malware payload", "value": "afd37b61d3d84da8f08b21408b000e33a8c63966ad9860f5f582e8dc9934b109", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638043202, "uuid": "0273cebb-1cfc-46fc-97d6-6a10fc6971c4", "comment": "Malware payload", "value": "a01d9aefdc3bacdd98749d0fad3c5ae3d39229c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638043202, "uuid": "38ff084e-5e87-4555-901e-eea539b263f9", "comment": "Malware payload", "value": "34135a7833466c0057d77765c841c418768f927e0cea6a8390afdbf43ea1e6e6c3a2a15d04eedadfddc1e7e446e0f189", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638043202, "uuid": "02520550-1808-42b4-8db7-3d5f01fc8fcb", "value": "T1BA45339DE3D4B93CCB0825BD982AA788992671F08355D2C5B231111A3B741DBEF97B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638043202, "uuid": "36527a5b-994d-4ac8-a8f5-61dbe369e689", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638043202, "uuid": "c8ecc445-6250-4c61-9883-2f53d010a38a", "value": "24576:AosmCiknxk8W11MucwLoYx7pnFw6kEaHNYK33lY9IpkR0:AYCLBW1aucwLoY1pF/NaBOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638043202, "uuid": "6d3cb25f-0d5d-4aa6-b30a-7ebe4054ff42", "value": 1216224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638043202, "uuid": "7ea41faa-160e-4069-9a3d-810d8b1ad67c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638043202, "uuid": "abada81c-5021-4852-9463-08ae70a99236", "value": "start.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78896c3-4f24-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637977992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637977992, "uuid": "316572d6-547f-4637-905e-7a39817c5964", "comment": "Malware payload (Heodo)", "value": "d045f745474fb4ddb46cc92392719c37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637977992, "uuid": "3c82ff66-14a9-451b-acd6-b414d2d2f144", "comment": "Malware payload (Heodo)", "value": "b58efe6cb9c0ceaab2e2dc522d7ef8319eb0998900075d99632c866585549061", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637977992, "uuid": "65f517d4-ffca-4c9a-8c89-c6c08aad7fec", "comment": "Malware payload (Heodo)", "value": "ddd2d15b23c24b186d78ce1c5321751c971cc828", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637977992, "uuid": "80a0bbeb-58e1-4a6d-b2ac-d75320b380dc", "comment": "Malware payload (Heodo)", "value": "c75df4341ef725696b4fbed3ba70c1c3e5a3d4683c2552174aef229c00feb1d8537c53e4788459860d386474a1e8f3a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637977992, "uuid": "530687b4-66fa-4968-9662-c05eca2b2a8c", "value": "T1FBE4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637977992, "uuid": "02fc9a3e-5e77-423f-b784-f6213d9c6017", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637977992, "uuid": "d0710ba3-a52c-4da7-b825-9b45a13e6acf", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhLico09cDlB4Vx/ID:0uH0GCNeQ9i7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637977992, "uuid": "3db0dcb8-56c5-4a12-b940-d17791371a37", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637977992, "uuid": "5eaabb39-d75d-4bad-b632-06c12bde97f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637977992, "uuid": "41d4bcf5-abe4-4ce0-b189-d40455ef31d9", "value": "d045f745474fb4ddb46cc92392719c37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02caf0ce-4f86-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638019753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638019753, "uuid": "ffc74a5e-2c1b-46c8-872e-d5f7f7333dce", "comment": "Malware payload", "value": "c9a4b9928b2e1648a84c3c7631b53fab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638019753, "uuid": "a2b51fa1-8a1a-4a50-9c52-5a90e2f8fe8d", "comment": "Malware payload", "value": "b6471ffec5f9e7ca1cd069bc2e89a22c152069dcbc099600ea92463c631b8d91", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638019753, "uuid": "2b91c8c1-4ae0-4940-b99b-e4ce64acac3d", "comment": "Malware payload", "value": "b27e1fa62ff0cea58f6719696b289cc534f92080", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638019753, "uuid": "f150ad86-08ae-4a7f-b872-e0c538ea6a43", "comment": "Malware payload", "value": "4939c104e9b57d0664aa1ead772de4393693dc410c6dccfbb99a41582cb93b1f5032ad747183451ef7ab9ffa5bc21b0f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638019753, "uuid": "bb08163b-efcd-4774-a798-73081a9d45e3", "value": "T1DD64AE1276C680B7DAB311B18A56A32EB3F6A700473B69C75BD50C205B355C3E73EB1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638019753, "uuid": "ac260f15-071e-4c17-bd5a-09d3b0e78480", "value": "6144:WKEUPDI8HTI4IPualOM8Vka11WqQtXwpomuU3rNOW1V1v:WKEUkuAOLka1miSmuYr13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638019753, "uuid": "81c1de1e-8699-475c-a4cd-dbd66802e353", "value": 310767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638019753, "uuid": "be278c9d-0dd5-40d9-af8e-eeda0ba22406", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638019753, "uuid": "06bdbfe4-cf5e-49da-b643-53c854565de8", "value": "emotet_exe_e4_b6471ffec5f9e7ca1cd069bc2e89a22c152069dcbc099600ea92463c631b8d91_2021-11-27__132908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f37631-4f5e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638002979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002979, "uuid": "5e72aecf-fafb-41b4-8109-4868363b9a3e", "comment": "Malware payload (Mirai)", "value": "446b14860d314ab04827e9bbca1a7457", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002979, "uuid": "e43aa7ea-98d1-4e8b-b53a-4fba68e4ccbf", "comment": "Malware payload (Mirai)", "value": "bb95d010fa3f282fee18b61b9176c6edb5232209969a874db022762bd672455e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002979, "uuid": "797eb59a-8a4c-44f7-8bf7-c567a222fc15", "comment": "Malware payload (Mirai)", "value": "8e92aa8185c95e3b9e28dc9fc506495d383ebe9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002979, "uuid": "975dc1ff-3bb7-4651-be3c-bdfdc845c280", "comment": "Malware payload (Mirai)", "value": "557ff29162ba0d8e8ceb9ffaa06159237d17af6efc59a3c7157ff12234be9531e15673832d622c2de1c34d8ee0775a55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002979, "uuid": "e04896ae-6735-4ea4-a334-9bb500dfa350", "value": "T147532AC8E593E8F5DC1409B8306ABB65AEB3F13B7035F99BC3D82573A901702D5066AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002979, "uuid": "c9aeeab2-f757-424f-aade-6fa63c6d0f76", "value": "1536:+Y946QWtBrYQPNseLL337HiUguESWuX/MMO6s2qg6U4e:N46QWtBrYQPNsefTiB5SWs/dO63qR9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638002979, "uuid": "ff1aac1d-72e0-41d6-ade7-719e77e54fde", "value": 66140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638002979, "uuid": "2bb416b4-7316-4a69-9d53-8321779b48c2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002979, "uuid": "35c5b6ce-d15e-4229-b83a-e9735160894e", "value": "446b14860d314ab04827e9bbca1a7457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8317cbe7-4fdd-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1638057334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638057334, "uuid": "f5fda34e-692a-4da5-832d-f18fccd7ded3", "comment": "Malware payload (njrat)", "value": "75403e885e281235c854d10aa36d4abb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638057334, "uuid": "441a3cb2-9d8d-47d6-a4fe-cbf71f9abbe2", "comment": "Malware payload (njrat)", "value": "bcd81033532cceb9c3b4fa83aa084646d4936ebccfd2a6b209123a76d1032bab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638057334, "uuid": "22f8aa4e-1033-4718-a5b0-2a8e45a966e4", "comment": "Malware payload (njrat)", "value": "5f025274f8316e4f0bb65445b50b8dbc44d987f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638057334, "uuid": "4524b192-fd19-49f5-94c9-e20af267ef4c", "comment": "Malware payload (njrat)", "value": "0526d56ac1420e9c37713e42a41a42b3e0651c18fc214e22ca4dde522dea511b36dea65443bf957c9f717b1aa5ced2ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638057334, "uuid": "7f318fca-3e1e-42c8-8c6c-7d691ac0c4e8", "value": "T12EC2DF03A7C4E57ACA514F717FA7274082E1A2620BD70F3C59B85899BDB238D4E33B95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638057334, "uuid": "449dc75d-3dff-42de-9168-43d8cb76e392", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638057334, "uuid": "285d260d-07d9-4311-85fb-9b99663c1ddf", "value": "384:5vcTz8a+exfVhhEv2W5o4lcHWWZxu7pq9o2P55Gq5v4F6lLWy+Kz9QZKS:5vkLtM5omaZE7pwocD5Qa+Khw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638057334, "uuid": "459220e7-dfe1-4724-9276-a5b01d922002", "value": 25872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638057334, "uuid": "1836e094-aef5-46e0-b37d-617a21deb3db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638057334, "uuid": "a482490b-ce85-40d1-afa1-6b9035d0562d", "value": "BCD81033532CCEB9C3B4FA83AA084646D4936EBCCFD2A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17fe727-4f5e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638002973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002973, "uuid": "566315fe-5fb4-431a-a3da-d6c76196e64d", "comment": "Malware payload (Mirai)", "value": "4d037240dc8b9c2bfca5d7062af9f934", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002973, "uuid": "1a047e24-ba65-4324-bab9-3623a1aec0ff", "comment": "Malware payload (Mirai)", "value": "bdded61e37757ba79796eb63a281f22c09255208be19cfb0f4055104899ebe9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002973, "uuid": "88d23f82-dafc-45e6-a0f8-dc854da5d106", "comment": "Malware payload (Mirai)", "value": "dc1e96e6157c58087b9180d281c0ceeb6e084619", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002973, "uuid": "df7b8777-5ccf-4e76-966f-ed7b351c4d97", "comment": "Malware payload (Mirai)", "value": "23de1745f64fb26202b32b88aae0ef02d84ea8633381b416e807284903ee0ee5bddbcccd1d5dbf4d178b6b43ba0d9d38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002973, "uuid": "1e715106-f006-4592-a238-95cd8e301084", "value": "T19593810AAF610FF7E89FDC374AD92B0524DD551A21AD7B39B930D818F25A30E19E3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002973, "uuid": "f450a408-19a6-4f0c-8fc7-29209509652d", "value": "1536:IlGYxrXy40ODrB9wHeR9P6sTJpp5U6XhsbPWe:mGYxrlDrBOJ6Xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638002973, "uuid": "6b10ab35-eb04-4cb4-80aa-cac349ce1f8c", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638002973, "uuid": "e4a4c735-1e03-406f-bf69-6ff811d66a80", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002973, "uuid": "8ecd1746-dc45-4b48-ad50-0e425f59e4e8", "value": "4d037240dc8b9c2bfca5d7062af9f934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136f0099-4f57-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637999594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999594, "uuid": "36fb530a-e1fb-42d5-a183-e9d71d053221", "comment": "Malware payload (Mirai)", "value": "07774072a84b7490a2734d1ac5876fac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999594, "uuid": "8c0e9e35-6b8c-4027-bc9e-b96ca3c1bd90", "comment": "Malware payload (Mirai)", "value": "beed39d8596c33f987486820cb8f68750ffa96f4e2d053af101f3b10770ae7a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999594, "uuid": "a28e0397-e74b-4ca4-9ee0-e6ead40f6ca2", "comment": "Malware payload (Mirai)", "value": "e12890b46ddad60e2d6b534dbe66fa1be70a006b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999594, "uuid": "fa71fc65-6217-49e5-a146-bffd38bc3e80", "comment": "Malware payload (Mirai)", "value": "348e5fcfa76cfe4559876ea99259d1bdbc400e1fa128bdac00c1b54d48fd5caecba7b3aa53a47cc85593744160e32870", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999594, "uuid": "56dfb858-b7ae-4edd-bf1b-0c5a51acbe6e", "value": "T1FAF2E073694ACD61CFF0227AD6E172017BA84E7CD16874B651A15F14B7CFD8B70A028B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999594, "uuid": "2e378408-65cd-4696-8d3d-189b2ed73e77", "value": "768:Db+GsIbn0XpiTAPB4bT9bOs26GIa+UqaXbMvE/9q3UELQ9:Db+GsLidbT4s26dVUqaI8uL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637999594, "uuid": "c753a9b8-ad10-4ffd-b220-e78f7c8d2609", "value": 34488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637999594, "uuid": "0e897b49-b955-497c-af96-3cd8fc0c500c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999594, "uuid": "ac21db6d-bfec-43ca-9322-c000b2b6ecc6", "value": "07774072a84b7490a2734d1ac5876fac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a55805c-4fd9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638055494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055494, "uuid": "9822aa34-9e9f-47db-9d8f-cec84f3ffb31", "comment": "Malware payload (Mirai)", "value": "4196cb39d8806514da326a31dd8d5734", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055494, "uuid": "4209b4d1-79fd-49b4-a5a2-c8f822d9754c", "comment": "Malware payload (Mirai)", "value": "c004a0a48888f2a1a510e658ed045d92b114acb8f2f3191a723739239c043ab7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055494, "uuid": "ba7bc85a-235e-4f19-9d02-eaf3a8519048", "comment": "Malware payload (Mirai)", "value": "6ba287621d05342ccc3c531dac7dc1df1b629837", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055494, "uuid": "8e08b331-ef14-45cc-8504-1434c922c904", "comment": "Malware payload (Mirai)", "value": "3bf4bbee8fe0a2937bdd0e12f8f0cb1db495ad6959c01d8504f3b836e80a7acabc26817bd99776cc854294154cc63025", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055494, "uuid": "54cd978e-3379-4b10-8e31-0837f69d7334", "value": "T164539D72C5641D90C19446F0F668CEB90763E20087933FF5459ACAA99497EFCF60A3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055494, "uuid": "27a61741-4ccc-42a8-9a36-c98efb1af655", "value": "1536:2aQJAALocuf43z/ai545n9RGDKsrKo4E2CQoYBJ:2jUg37lO90msmE2/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638055494, "uuid": "e8714c41-fbfb-4675-b951-588557d80fda", "value": 62856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638055494, "uuid": "de742c79-6493-4b7f-be93-8eb754118e8c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055494, "uuid": "f546ea25-4f84-4aeb-827c-f9dd4da814ec", "value": "4196cb39d8806514da326a31dd8d5734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bdee7a5-4f32-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637983878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637983878, "uuid": "e3f672f1-ca56-4ac0-9aa2-820f4ac368ab", "comment": "Malware payload (Heodo)", "value": "e1a002aa00ae7df1681d7b2af058a899", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637983878, "uuid": "144d369e-a4aa-4dd9-a2fe-098ec2c54324", "comment": "Malware payload (Heodo)", "value": "c0b2a126eca284484b5a9e0acc6cf20dd2f9a0c79bab8b3e1194e29c09e2c99b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637983878, "uuid": "1dae1c0d-5c06-47d2-8201-ab059591e15b", "comment": "Malware payload (Heodo)", "value": "98266f98a7811c1e031b1e3924ee96796f264256", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637983878, "uuid": "26ddfec3-e99d-41ff-a46a-25422019d321", "comment": "Malware payload (Heodo)", "value": "37b5b275bb3210d13f323001b4e67da3039326325893c29763040499d964dfdf135e1b74d52ef5b0a329ef315ebd8bbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637983878, "uuid": "4934e8d5-388d-4e5b-bc87-ef71e223e461", "value": "T1A9E4AE1277C1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637983878, "uuid": "0952fa81-9c4f-4ff6-af5d-fddce8f19677", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637983878, "uuid": "9639789e-d11a-4b62-bf4a-6b5a84d18d5c", "value": "12288:WKEUkuAOLka1miSmuYr1V7ZAobS3qTHPR101D:TEQLka1nBV1AoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637983878, "uuid": "284f4ef5-d14b-4bec-bc0e-cea2eb2e6e72", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637983878, "uuid": "36d833d3-4317-4ff8-808f-ecf01d568d8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637983878, "uuid": "4cd60660-4bbe-435e-9412-ded0af404e12", "value": "e1a002aa00ae7df1681d7b2af058a899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdba4aae-4fb5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638040280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040280, "uuid": "258a8317-2724-4aad-b4a7-c999e3fbc083", "comment": "Malware payload", "value": "89a0a414e18167e0fa2ac11d5cf6fcca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040280, "uuid": "f4206e51-d270-474a-ae6f-744dda31fc52", "comment": "Malware payload", "value": "c22bfadc2381c990fc2ac05a1873a1a6bc811ab371fb8bed72d41fb7422061ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040280, "uuid": "93546c25-3b83-4000-b730-70a589ad60cd", "comment": "Malware payload", "value": "28ad8843902f39c2dfac35061441b18fcab9659d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040280, "uuid": "64f15871-e7ce-4fad-b2dd-1dc78dde5cfc", "comment": "Malware payload", "value": "799bfb07a04ac70c6e81b1596dfc0ccede4c04a2961184eea43e92e045d89cd47181555e23690c26a0bb70aca9708f53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040280, "uuid": "b0f86ef8-ef06-40fa-bbe6-b3e7269f36ab", "value": "T1A74533EB53E0720CC99705786CFADB52EE9146E1B6C4E54F74260A94128E8F7327D4EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040280, "uuid": "beb44001-cfb8-4c4b-b4a3-c40a2ac5bda6", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040280, "uuid": "84973071-2260-4051-820d-a7ae52ccec70", "value": "24576:iMuWsTCkgnKulwqXFIhiqeYrMe/eMXL9iOxf3B5kEaHNYK377oy3NVzLVW:q/CkgnKEwo2iqei/eMLf3jNaRU6NVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638040280, "uuid": "2e4d1072-197d-4955-b5e1-5cf2f1e7f0cf", "value": 1188736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638040280, "uuid": "e85fc29b-2fce-4858-907f-5efcb98d392f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040280, "uuid": "ef9d3b75-7fef-410d-823b-7270ce317e66", "value": "GL_hackV2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20315817-4f56-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637999186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999186, "uuid": "f7f1ad31-a720-4ccf-9755-d00c2be113d2", "comment": "Malware payload", "value": "b08324e16c7cad9d14ed3b0d65dfe9c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999186, "uuid": "e4bc5bae-dbfa-4878-a21f-e9649376d332", "comment": "Malware payload", "value": "c2ff45933ddda1065adc46fbe189e4fc770e71190aee302bec0b1c2617fc00dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999186, "uuid": "fb969eb0-524c-4dbe-b25c-4e55d84e6d02", "comment": "Malware payload", "value": "31a3c1ca462949a238d231db4846f114a068ffc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999186, "uuid": "357a8fcc-d2ac-4940-a29d-100618d9e520", "comment": "Malware payload", "value": "53cc3e956302c811c4507870218c4d9195aa62092f20c12aaeebad0504e1770a3036284f23e1a6ffd42b54f7b3012b13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999186, "uuid": "48f2d80e-c2e1-4b1f-8f37-03f01dcfc629", "value": "T1CD549F10ABA0C439F1B717F889B99368B93F79A16B7890CF62D516EE56346D0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999186, "uuid": "1c7d5edb-12d2-49f6-aea0-d4bbce4a4303", "value": "ac14a22dc3791ebf7f4a67e197a18bc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999186, "uuid": "f8b921f1-5a78-43da-a6b0-98709eafa843", "value": "6144:HeJSfRrwlHkHwn4NQ+6dYS/SXuZet0yS8lYV3ATOi1wDx0d4Q8:+sRrwVWwn4f6dYS/SXuZet0yS8lPTtUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637999186, "uuid": "db1f7480-bfe7-4532-87c4-7ed10425113c", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637999186, "uuid": "600bd43e-d009-47e3-b434-1b0d516e4941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999186, "uuid": "bd97e3e3-ba60-4733-9f70-a498db3fa344", "value": "b08324e16c7cad9d14ed3b0d65dfe9c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8269935d-4f99-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638028127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028127, "uuid": "a66fa8c4-d360-43d2-b8d9-cb79f87fb327", "comment": "Malware payload (Mirai)", "value": "1050823fc0e593843b1076f1487475b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028127, "uuid": "504e1fbe-aa4e-4cec-a761-13fb6161a1bd", "comment": "Malware payload (Mirai)", "value": "c59519c5228896698c41e13679686d9ab80be27b3df96ee7a91a4196de982c86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028127, "uuid": "e00ac56a-4208-4c47-9894-924454ff72e9", "comment": "Malware payload (Mirai)", "value": "4869c88334520222c675bc5da63969086b6401f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028127, "uuid": "2aca607c-1508-4b57-84b2-1665c7710b80", "comment": "Malware payload (Mirai)", "value": "a7a6cb45bf2dab5ab6fa7af94421e8d6df0a1c84d71ef0268484fe925170c6d4705c36c22a5d557fb3ed7a321f7ef392", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028127, "uuid": "794bbeef-534c-4f77-b951-bf5c731e2013", "value": "T186D33B05D8909767C6D227BAF79E428D73236B68A7D733115A28AFB02FC1B9D1D7D020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028127, "uuid": "34694f36-805c-4f74-be58-26e93c9bdf18", "value": "3072:IVfyQ+d+pceQGftb3za5fJhWOiwTteOH345hLMC3K4G5ZZPMmydQCYMhEFg:ub3za5fJhoIHo5hLMC3GvkmydQCYMhE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638028127, "uuid": "ce7d38e6-8bc5-4199-be5a-1e90ebc45017", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638028127, "uuid": "3e5cdf91-986a-44f9-9851-1098507ea31b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028127, "uuid": "2b3fcc55-a5da-4ec2-9501-aba326f761f4", "value": "1050823fc0e593843b1076f1487475b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f3248f-4f99-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638028179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028179, "uuid": "a9ab2ecb-219c-4649-ab41-f6964503774a", "comment": "Malware payload (Mirai)", "value": "787ac581a92103f01d77bf623f9f9377", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028179, "uuid": "e105a8f1-727c-4799-b77e-9a8dd75c75f3", "comment": "Malware payload (Mirai)", "value": "c64c7cec53de1d3c09b696a2a1120c10e62f4c68c689a2f8e6aa747e08c6e82e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028179, "uuid": "cb72e529-60ed-4149-ac4d-aed1256a60ee", "comment": "Malware payload (Mirai)", "value": "693fe8d2836294029657cf80781ff9a9de3c32e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028179, "uuid": "6b457d6f-c8d2-4b42-80ca-33bf43e05477", "comment": "Malware payload (Mirai)", "value": "b8939f698e601d386779d9128e7c65cfeccb3040ba20a16160f233d33f5f636399afcfa39690b461a8ba581ec7e772ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028179, "uuid": "c15adeb5-a199-45db-97af-89e8479f93db", "value": "T1D0C2D742BC819617C6D013BABAAE4A8D3321B7E8D2CF7757CD161F00768521F1E67B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028179, "uuid": "7397d363-68bc-4711-9c38-85aafc876e98", "value": "768:dkHTuu29dJNcQWvKtZ8lOXMQYwTF8pHPN:dC2nxWvCZ8lgTCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638028179, "uuid": "a6fbbe8d-4e84-442c-a799-635514083b62", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638028179, "uuid": "a7160bd3-efaa-4684-9648-3c26197dc75e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028179, "uuid": "87f1b78c-b804-4b0b-92b9-ecacf38bb055", "value": "787ac581a92103f01d77bf623f9f9377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76f321f-4f99-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638028189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028189, "uuid": "b587026e-f7f0-488c-8892-1db0630134bf", "comment": "Malware payload", "value": "57eccfa18b1626d5cd067e070c779a93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028189, "uuid": "2c37be56-3034-4e51-bde4-ad21da944ff3", "comment": "Malware payload", "value": "c87e6397cfee421392ddb68a814bc6370ff72ab3d32606ec147d66b8ed70db50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028189, "uuid": "09ccc35a-f41c-452f-86d9-2c139a6de5c5", "comment": "Malware payload", "value": "a44dfb10645f03393050a258d374993252b7f938", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028189, "uuid": "461eb998-b1b9-46d8-a0e7-bb0db9da70c8", "comment": "Malware payload", "value": "550b0b94d9e7a009b33963b43f858a1d68c5d6f09c9209b6948e7c3a2967891684dc777e0bb22be3fb97f03a95115ba5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028189, "uuid": "797357bd-29b2-4ec4-8929-e8b8969c0021", "value": "T1952601682012E19EF5C2B0F38A670CF4BBBD7C677A0AC09A602B354B551C5C79F176AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028189, "uuid": "c3f5e99c-d2af-4feb-8810-e8793b25d9f0", "value": "98304:9Vpgj9vY+B+HLEhjFybVRlL49RSAwqFNsQBLl73x:9VaG+BGqybVnLA9wqFi+l73x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638028189, "uuid": "6e93e9a8-3a5c-4f04-a0fe-3317df042dad", "value": 4497408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638028189, "uuid": "5f89e2c8-6727-421f-8702-6a5d53a1a68d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028189, "uuid": "fdfda8d7-358f-460d-b5f5-8026a744c35b", "value": "SecuriteInfo.com.Artemis57ECCFA18B16.5742.16862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d263f9-4f33-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637984274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637984274, "uuid": "9b387578-d34e-4ece-a1d4-34bb2933f9e5", "comment": "Malware payload (Heodo)", "value": "5b53c03d154a951d6c4966fc9f93ed2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637984274, "uuid": "e6853864-a61f-4b04-b2b5-83d8d0583c67", "comment": "Malware payload (Heodo)", "value": "c93e5a17841fc576f5d29d7fd2db5a22429ca7fc2a3a50af6817b81989b3988d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637984274, "uuid": "7f08ffe4-6be7-4c73-96e4-076ce901c3e6", "comment": "Malware payload (Heodo)", "value": "b6c54682ac42e8876f1776395ee408fecc51938a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637984274, "uuid": "827ec678-86fa-4ad8-aba5-705edabc5142", "comment": "Malware payload (Heodo)", "value": "10fe5bad97d6851d9cf0c32bd91a156f66e7752a899a4c2967f31147bfb4800f2c98bbc1ea471755c121a4686389609b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637984274, "uuid": "e0a0aebe-211c-4953-b40e-f2c49b3a8ddd", "value": "T16CE4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637984274, "uuid": "0a68657b-1624-469b-a968-fe5530171382", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637984274, "uuid": "bad029b2-053e-4afd-8860-4e203f9125d9", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhzico09cDlB4Vx/ID:0uH0GCNeQNi7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637984274, "uuid": "62a53e47-b3b2-4545-8a05-bf3a6d8a7c97", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637984274, "uuid": "d446015d-3907-410f-ad9e-b9cf68001558", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637984274, "uuid": "838a785e-c046-4b60-a597-db483029cd3d", "value": "5b53c03d154a951d6c4966fc9f93ed2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41fac80-4fa2-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1638032103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638032103, "uuid": "773b6a87-4b4c-44c3-83ac-6a90745ab421", "comment": "Malware payload (Heodo)", "value": "4f174fc64f06938cc1b8c63f9333af6c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638032103, "uuid": "ebf9b3b6-fb3f-4c49-a781-b732b5c2cce9", "comment": "Malware payload (Heodo)", "value": "c952865b866eab0825e6957c56defcd77b28acdb42380a0068938e2ca596b433", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638032103, "uuid": "ad7416d2-bf66-4ff0-a531-6d45d5c10c4d", "comment": "Malware payload (Heodo)", "value": "06df357c67ea78924e376422056b8cc4deae856c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638032103, "uuid": "b5cfedc0-3f35-454b-b980-03f34876dbb7", "comment": "Malware payload (Heodo)", "value": "878cf01b8ab872a2c2d19ea2c07758c54a5f94b31a2276f78cc57ea1baca12e7e4a0e664a6c1061001286aec41133080", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638032103, "uuid": "288d2cef-6f6d-4eb5-a3b7-720845c83856", "value": "T14BE4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638032103, "uuid": "06e29e05-a682-4e8b-bf4c-ed51b2f41995", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638032103, "uuid": "b022f6f7-2b04-42cc-b29f-6ea1c5843ff1", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhBico09cDlB4Vx/ID:0uH0GCNeQ7i7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638032103, "uuid": "066a4532-fa11-45dc-b33d-6f56a58aa3f8", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638032103, "uuid": "5ab6c68c-5410-4154-a0c1-8ad33a890644", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638032103, "uuid": "64896872-799a-4c4c-900b-ed218e4447d7", "value": "A2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e6ed04-4f57-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637999944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999944, "uuid": "1386cdba-6b17-4638-9bee-0df47e8d508b", "comment": "Malware payload (Mirai)", "value": "7781b0db20a1b65a6b5634ec4ef95f91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999944, "uuid": "22068321-c8f2-4ee4-97fb-155449054a52", "comment": "Malware payload (Mirai)", "value": "cafb0f28f004967391dc0752d630f134bb7ca541ea635b0957448f4b479ffaae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999944, "uuid": "2c9b5032-196b-4773-a6cd-b846c0509d05", "comment": "Malware payload (Mirai)", "value": "c5910348838dabc29c61efa1dfb1d1311f9a4f0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999944, "uuid": "6f76288a-0830-4f12-8874-1e2c4dbe9bb4", "comment": "Malware payload (Mirai)", "value": "6a0d492ea24a84b243c8d7d9dcd1a44c1824e52ebfe0f1e9ed4471e1a9a7c0d8155988eba751e73af59605939899af88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999944, "uuid": "b88aaa6d-3d99-4c0f-842c-56a8cb038f04", "value": "T19BD2E1F8EF689B8BD0D1A73E4D5D9C4E71ACBD671AB6E5190B420D222039E60D5ECCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999944, "uuid": "5f4da139-2a47-4115-b453-60672d4dbad0", "value": "768:XN8fWlfoQmQAXV7E/QciiRcrHKOu3etqB:dMNXFl76NncU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637999944, "uuid": "ec81fbc4-73d0-4eed-8229-5d3396c2c0b3", "value": 29912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637999944, "uuid": "6b06f348-c0eb-4228-aab2-b77ccb65d7f0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999944, "uuid": "d48ec2b1-d918-4751-8411-915e7ff712d6", "value": "7781b0db20a1b65a6b5634ec4ef95f91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248ca881-4f57-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637999623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999623, "uuid": "51f3100b-7da6-4d36-bcfc-bd65a0f52988", "comment": "Malware payload (Mirai)", "value": "065b9bd2a0113b0752fb43dc2b3f6e4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999623, "uuid": "3b9b40d4-eeb9-4a10-8eca-93902f581377", "comment": "Malware payload (Mirai)", "value": "cb79f0a2399ee93e83a92298d88e929515db5b0855de0c1d8fd5f1893587d831", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999623, "uuid": "d1449e71-e116-451b-8cd7-0c680f897acb", "comment": "Malware payload (Mirai)", "value": "c2bd932a5abbff79fe8d69b87fa05d2013cca135", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999623, "uuid": "b1a1dbe1-0af4-4913-ba84-5e38fc77e640", "comment": "Malware payload (Mirai)", "value": "ae5f5c7d3ab097790d248079480d99891893605c89352c52cde9f68178ee38527bc328e56d781cfaebca6d7d65bb6723", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999623, "uuid": "9e9af2fa-a5e5-406f-9381-b9876e64603a", "value": "T1AE539DA5C4B8BD99CF69927CB61488389723900564A33DFAE742C796D00BEECF10D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999623, "uuid": "35bf3b2c-8a62-4284-919b-11e7ad15f6cd", "value": "1536:B/bivQhunGaiwt4gpuFosvXZxwaqUfs3rBktd1UYjC1z2:BjiBGhGp+XZxtf+d21UYj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637999623, "uuid": "536f4285-087d-4e4c-8959-7a25e4eb49bb", "value": 64360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637999623, "uuid": "7d6ef125-5a38-4aa1-8a92-ea097267cbd8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999623, "uuid": "f3d69d4b-b597-4d62-80e1-e26495a1f2af", "value": "065b9bd2a0113b0752fb43dc2b3f6e4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25feb209-4f79-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638014228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638014228, "uuid": "4bd0a3ec-6a16-4ed8-9766-4c8c36dd8cfc", "comment": "Malware payload (RedLineStealer)", "value": "a67f614dfb878eb79f54a4574e44fc89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638014228, "uuid": "6ac8a6fb-a04a-438f-ac1c-570834d3ea51", "comment": "Malware payload (RedLineStealer)", "value": "cbeb4e922aabe85afb7d5d3508aa7f153b58509d76d77787ec6d640d4a6300a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638014228, "uuid": "403386b7-53cb-47c2-9e61-0fbb0b5ba702", "comment": "Malware payload (RedLineStealer)", "value": "aa96fc38bca0b88faed1cc2bf30310fb6c6e056b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638014228, "uuid": "a38d6c21-fa74-4e59-b7da-2b14ca0be381", "comment": "Malware payload (RedLineStealer)", "value": "8724cc4a5776a0f46685abd4bcf9cfc19dcd4094ac1cd8ffbee318ccf23151e43494849068bef5f491615f2197778c4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638014228, "uuid": "7efd32ad-a7b5-4864-a8a9-d4f7407e48ce", "value": "T195B4EE036DD8FB18A4915D3382CF6F291B922DD2877291566B59FEF112A02022D7BF3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638014228, "uuid": "19cb52cc-9349-430f-95d6-858a4dc75792", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638014228, "uuid": "16278633-6933-4498-af11-4603594a3c9c", "value": "6144:aKRP5evCNsfCe9n+uK5SajPmM02/zDURgB9w1DHRwG7GY+WCqa2dwmXE9bNo:tZsfr9lgnkRQ92f+uafNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638014228, "uuid": "d97db652-a90b-44b0-b668-019b3d1763e9", "value": 525720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638014228, "uuid": "0d0dd8e9-2f4e-4b19-a56e-d6a00713953d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638014228, "uuid": "71138833-8ee3-498c-9e46-6c5a7a7b849b", "value": "a67f614dfb878eb79f54a4574e44fc89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f466bae5-4f5b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1638001690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001690, "uuid": "dbaa5676-c039-4a34-82ed-efb71a039342", "comment": "Malware payload (AgentTesla)", "value": "8831a7e33f584de6873e8a626fc0ef49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001690, "uuid": "e3cec298-a41b-4aba-8d30-d4f961e24e36", "comment": "Malware payload (AgentTesla)", "value": "cf9bd1c02c585d023fa90ff6b0eda9396ba2c6f42761328e5942045ae3216170", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001690, "uuid": "e158c730-5a3a-4145-95f5-cfe6e22575f5", "comment": "Malware payload (AgentTesla)", "value": "c456251b7b783af512edae09f046a048256015f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001690, "uuid": "78b1fd19-66a7-49e7-ad9f-4ea46f2a529c", "comment": "Malware payload (AgentTesla)", "value": "8c2e719ebe1e0dd8ef78ca4f2b93c57c6fd020b33fad53000b9860eb175ba51d93fd43158d15c8203ee01a66e8869d32", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001690, "uuid": "247e19fb-218d-4a8f-bb18-85cd2418d5b3", "value": "T1DEB4D05A316497F6E53C87B3BE03A52D5BB26DF55D60C2482ED3F2DA2871B200D90A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001690, "uuid": "748feeca-9d64-4d33-9d13-734cb7f99ae0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001690, "uuid": "c6e085c6-78c6-4648-b4ae-dee9976eed8f", "value": "12288:9OoLHixBFmeNhpLRky1lqyRs5HN2sMlv/U7hqNKAJ:9bi1v51kyzFsONlEeKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638001690, "uuid": "64bb54e2-7ebe-4f9c-b6c5-be86f626fa7d", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638001690, "uuid": "c27fe9e1-bcb6-4e4c-9d92-fa1db703c19c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001690, "uuid": "817e3ed9-3f1c-40c3-843e-432f66572c54", "value": "DHL Shipment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f66c69f-4f57-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637999588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999588, "uuid": "11f10397-73e8-4b2b-bb49-6e04aaf41eac", "comment": "Malware payload (Mirai)", "value": "6710bc5b7d60f861fe84ffb9fd665e88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999588, "uuid": "f40e74ad-a065-4128-99ae-6f29cb64e598", "comment": "Malware payload (Mirai)", "value": "cfc3bf7641c16bc223f2e3808f8a10739acf8a48f6feb675d441ceb59cfa544b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999588, "uuid": "8fad415c-909f-40ff-9351-98f2a4a72463", "comment": "Malware payload (Mirai)", "value": "78c0de578c519d3ab6a4510c605bb096d8decc38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999588, "uuid": "d653f563-3dc7-4cd5-9388-09341a538af8", "comment": "Malware payload (Mirai)", "value": "0cbd5a9d3c9e24dd8593cc9d377c1853054a843415204062337acc41e12da42a46ad5c9f21709425e398bfa050fcf91a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999588, "uuid": "a1e23300-48d5-41b7-9c8c-60f470fd4dbe", "value": "T161C2E1B1C00E8DB3FF7AFEB08685DDE23F8A469E28A2D8D3A0557B15067353954009F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999588, "uuid": "27ebefbb-8082-4446-9c93-794299304269", "value": "768:zjxqNa7PqLefxslATOTIAA6Q7dHGKKdPBKp0+Owrj4uVcqgw09c:wNLaxsl8X6+dDePQwU4u+qgw09c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637999588, "uuid": "13c63b37-7815-448d-b972-f2f3a1b485c5", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637999588, "uuid": "d444e209-c0fe-4f56-a332-252399adf6d0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999588, "uuid": "8d97ff3f-2d25-40b5-bcee-1786ff1fdd53", "value": "6710bc5b7d60f861fe84ffb9fd665e88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97df7405-4f99-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638028163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028163, "uuid": "2c3cce39-0c8a-48f6-924c-df20ef995a6c", "comment": "Malware payload (Mirai)", "value": "7969f8b4fe1d77bb632265dcc8f2bf8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028163, "uuid": "17971b95-dc3d-434d-80ce-b01bd4ccf9f8", "comment": "Malware payload (Mirai)", "value": "d0debd0a1dfbecf7e0acfcb2357ae76d59086af792b59699d4d7e092b443df77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028163, "uuid": "794d4e93-4c07-4e05-8cb9-43751392576d", "comment": "Malware payload (Mirai)", "value": "dcf8e7e7aa43eb97090c74f5d4eee9ebd19e50ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028163, "uuid": "8a496ccf-344f-4ffb-90b1-481e66f3881e", "comment": "Malware payload (Mirai)", "value": "1b153633aa9139499668069592eb96df32470055e6a9ddd213ec369a9b6bef2ac5ac9c5b9357f6c5725109d1db41c659", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028163, "uuid": "e6af6575-ae6c-4ddb-a3aa-ad12aaf4e8f3", "value": "T11E63D8096E219FFDFB6C823447B78E21A79833D626E1D6C5E19CD6001E7034E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028163, "uuid": "58d93b33-744f-4cba-928d-b99b36af4050", "value": "768:B00gk35PZ5YOpWWHurZWqd3mZytf0RkFf99X6enNrsxQk77fS8KCH4POYNx8ypYJ:20b3J0OpKm8f0OvqxQky8WDP0eYPwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638028163, "uuid": "2136efc5-09e7-43f8-a442-a2f18c284d74", "value": 68304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638028163, "uuid": "29939938-4e99-49ee-a65b-ab4beeb6071f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028163, "uuid": "9b34615d-5c8c-4b47-8eb9-5c8f8d7b8c61", "value": "7969f8b4fe1d77bb632265dcc8f2bf8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564232cf-4f38-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637986392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637986392, "uuid": "ae6ec8a6-3b25-4519-b7f7-3ee985ccfd59", "comment": "Malware payload", "value": "60ab91512a84d970fd13a4da7a508caa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637986392, "uuid": "22093717-3f23-491a-b53b-5fea1808a1eb", "comment": "Malware payload", "value": "d16863d282d0b8c38354664020d406a78f34ad91f926606388f0b16cb3a999e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637986392, "uuid": "39013854-ea25-4f28-9d85-fb87dbc299b4", "comment": "Malware payload", "value": "0461753b471e8d3693c48a14f4ba0e10d955cb77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637986392, "uuid": "0a5f323b-9786-47a7-a5c2-d9d2a2c1bd11", "comment": "Malware payload", "value": "977e4f031b6c304f661084b3f59725415879862a84784182e3d1805ea370472f84ff93b149bea0215f07bb133fdc8ab0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637986392, "uuid": "a3dd5df5-b1a8-4595-8a16-64ec2aef6e02", "value": "T1E992C036D1659D2BDF7DEE7C0E80F2D077A24F9D37C09DD154986B20E225C26690ADE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637986392, "uuid": "fe9a78fd-09bc-482d-a045-c6b4cbef0c21", "value": "384:JRUl623tXDRIvZ5yBofr7cslS8ZuonM4uVcqgw05VxJDBu:JWw29WIBovB1ZuZ4uVcqgw091Bu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637986392, "uuid": "1bf7e58a-c618-496d-b41a-3554215ff0c9", "value": 19656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637986392, "uuid": "9822d026-bf16-417c-9765-46b9a6b9ee16", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637986392, "uuid": "12c221fa-891d-4e59-8883-aa1059e50c34", "value": "60ab91512a84d970fd13a4da7a508caa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac1be2d-4f4a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637994292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637994292, "uuid": "3083502f-0ab1-48d9-a6a0-291261d8e465", "comment": "Malware payload (RedLineStealer)", "value": "12908b725fb771c0f2323fe997e64897", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637994292, "uuid": "7fde6636-b4fc-43c2-9d6e-6ad564f15ea2", "comment": "Malware payload (RedLineStealer)", "value": "d2424ee4002e652925c9d339cc4d08a64f88cf027352f6302d260677a6e70718", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637994292, "uuid": "685e0155-35f8-4c94-92a8-2592b7542bb3", "comment": "Malware payload (RedLineStealer)", "value": "d5b175659ad8200190c671b269bf67f0f4c8af53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637994292, "uuid": "09b16432-69a7-4e3d-bc5b-1579c599ee47", "comment": "Malware payload (RedLineStealer)", "value": "16e84ced9f95836380c153d78f356d7c30d48b11517efb01954f047b1a769a4666fa750ba1680f9ab3ac47fa73b67066", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637994292, "uuid": "825efe42-d3ca-4368-a265-8e92da1c2e3b", "value": "T15E54F16136E1C032DAE70A316970FF651A377C727A35804F2F74162E6E32BE0A66574E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637994292, "uuid": "4427d322-5df3-49f0-b646-17b3215ea40e", "value": "53b0378649e79a9a5712f4b4ad78cbde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637994292, "uuid": "b9119cc1-1d6a-405a-80a5-6ac7ba6104bb", "value": "6144:2/bzLydmTGFYPk1TUGQTO1k8YXadX2zCbHY8KZtQZT:avLGmKhTlWO1k8Y2GyH2KZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637994292, "uuid": "3926f10a-7573-4c17-8c9c-672989c2a748", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637994292, "uuid": "41fc9532-f7f7-4bb1-8b7a-87af893656db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637994292, "uuid": "af798612-c14b-46f2-8181-610566fef85d", "value": "12908b725fb771c0f2323fe997e64897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3d0a5d-4fdb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638056491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638056491, "uuid": "7c7d1cd2-a86f-4b16-8629-cb54ab3a7c92", "comment": "Malware payload", "value": "50ef0bb9dc91c3099e2e0904344ae966", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638056491, "uuid": "ac087ff9-613e-4fde-91d6-55b06eb27022", "comment": "Malware payload", "value": "d30fdcf3c1e63aa03fad165cf11e1006bcc6c52330592fa11cd8d8a1eedc3646", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638056491, "uuid": "670760ca-700a-4e63-bff8-5a765178233f", "comment": "Malware payload", "value": "dcac87eb8da4b9b35810176cf4793100ac2157aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638056491, "uuid": "e7936bb4-c08b-48a4-b593-948a84316683", "comment": "Malware payload", "value": "f4ab2b49d29a9c0f2d45f8ca7ef2f74a6c575b2d9cfe47aa05fae35abe2cc394b947430a4bae2f3cfa405b11355e2ec7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638056491, "uuid": "78909913-c816-4067-8c95-aad09ae2faae", "value": "T111A4020532BD4F62D6388BFCA560600557F2B66E22B1E74D5EC2B0DB0E66F064682E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638056491, "uuid": "09c0e644-4938-43c9-93a1-ad1234ac6d8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638056491, "uuid": "a212ad94-322d-4982-9abf-dddb98d870c0", "value": "12288:ck2NjDUSJoL0ixBFmExfKrh7IG4mVRw/HEcw5vf58CezZ3:ck2NXHeIi1NRKr2G4mTw/H7Cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638056491, "uuid": "63667745-e71c-44bf-8fe5-29321e89e2a6", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638056491, "uuid": "072cf112-34ec-4ae1-b508-5704f5e6d772", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638056491, "uuid": "5dcb9b95-edc7-4c67-bbe0-1c037fe36a92", "value": "50ef0bb9dc91c3099e2e0904344ae966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ece8fa3-4f80-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638017196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017196, "uuid": "705c4f63-fe19-4c77-88d2-088a67b248f1", "comment": "Malware payload", "value": "94b4bb8b50b6ab673a8d11d6b1c7cb3f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017196, "uuid": "b3fb17bd-e60f-4fa8-9cc3-6b72f8fc59a7", "comment": "Malware payload", "value": "d38044df8d84a1451fe2913ee8e0e24bc58ee22f1a3d328565d7884f0271ddc0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017196, "uuid": "e33625f6-e23a-4ec1-98dc-17f4b7b610e1", "comment": "Malware payload", "value": "6992342cc57fd5df988274534e0ecde3ebe75a51", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017196, "uuid": "37cdea43-0549-4271-88fd-bfdb4e211752", "comment": "Malware payload", "value": "51f8bac3b3d930c70482f780984c094cffec5e9ab92b1e796677532051ec3e84e246858aba8bf627bfe27438adcb417d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017196, "uuid": "2b25a271-a95f-4efb-a90a-4ab3d65fad51", "value": "T1D1448C2276C1C436D2A334B1821A96B565AD6A305BF6C2C7ABD05E3A5F341D3973CB0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017196, "uuid": "e0aafd64-a326-484a-b2f9-d1fed059b15c", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDm:HVqLOGNVDzZtIlHN3nkjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638017196, "uuid": "133f9422-902e-4b3a-a14f-c7ed8af11334", "value": 278030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638017196, "uuid": "1a2e1e98-ffa0-4e22-a757-5bca59365491", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017196, "uuid": "87c49473-0564-4b71-980a-74aaf9a03382", "value": "emotet_exe_e5_d38044df8d84a1451fe2913ee8e0e24bc58ee22f1a3d328565d7884f0271ddc0_2021-11-27__124632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16801140-4f34-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637984567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637984567, "uuid": "916de622-357d-45b2-a401-e93bc7dfdbc4", "comment": "Malware payload (Heodo)", "value": "13e9cbd30813852259f4de07f8eab8cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637984567, "uuid": "5b4cd5b6-fb28-4d96-8e64-754f3840df41", "comment": "Malware payload (Heodo)", "value": "d3b9d981b1c45ade14772c578acbc84edc76590cb020857b926cbe0158397c9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637984567, "uuid": "b096501d-2dc8-46e6-8ad7-078857dd465c", "comment": "Malware payload (Heodo)", "value": "affecbc3f24349618c352cd21c837928c94c781d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637984567, "uuid": "52b47730-c033-487b-a689-0f276b8f3b3e", "comment": "Malware payload (Heodo)", "value": "5f3f4fc281a633732502c90cd5035bbc447c0fe52ab078410f09a981de4e0f0bffc8761bec175c9a9b5e21477607805f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637984567, "uuid": "e6842fbc-121f-495c-a405-faf6d92dd64f", "value": "T109E4AE1277C1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637984567, "uuid": "bde94b0c-67c1-4cee-9db1-a51588edb72a", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637984567, "uuid": "62f29588-dddc-4271-b07d-73a2768af534", "value": "12288:WKEUkuAOLka1miSmuYr1V7nAobS3qTHPR101D:TEQLka1nBV7AoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637984567, "uuid": "7f5fd223-56b8-4eb1-92f6-05493df6c8d1", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637984567, "uuid": "c50fcc14-ae28-46fb-91f6-f1b66beb50e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637984567, "uuid": "61e12703-4041-4683-9a16-42e177273cb5", "value": "13e9cbd30813852259f4de07f8eab8cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a3b724-4f9d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1638029904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029904, "uuid": "93a40332-10bc-46cb-a5a9-94a70f29f17f", "comment": "Malware payload (Gafgyt)", "value": "1abdb783e125de40fb1bdc78e4c59112", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029904, "uuid": "8a81a6e4-04d4-425c-80fa-742ad9ea8a79", "comment": "Malware payload (Gafgyt)", "value": "d4d0517cfe6194503d74271bb781595d310fa1a716b1126dc2f1467679648783", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029904, "uuid": "04f503f3-ff8f-4993-b075-8c613e685881", "comment": "Malware payload (Gafgyt)", "value": "39772df3f3233095fdaac99fe727a3672e329d2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029904, "uuid": "0f38129f-297b-452f-95e5-de23383c2724", "comment": "Malware payload (Gafgyt)", "value": "f1f019805c69bdd1becab585ca9cff4a3dbfc2a032094adf42c5e1e670f9f71652412e76ba2fd8db1c7e017eff19f5d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029904, "uuid": "11f4bb32-99a8-4af2-a4ac-5e31f5df77b5", "value": "T19DC3395BA71C0B83C4D759B12DA73BF28B6DA6B112E711C1A90BEB804373DB51123FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029904, "uuid": "65585487-7dc2-43d7-a4cb-0ce724373714", "value": "3072:It3SiGBugnGza+IC5h1M8MDmmh0qDrugIlJq:It3SiGBFnGu+IC5h1/MDmmh0qDrugIl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638029904, "uuid": "ddb14d2a-df0a-45ca-b0d5-8548914f5f13", "value": 123194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638029904, "uuid": "398a86df-750b-4910-990d-646a60ea7f51", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029904, "uuid": "2370bfa2-edbf-45ac-8372-419720112b9b", "value": "1abdb783e125de40fb1bdc78e4c59112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4452cb63-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971330, "uuid": "10e6cf9b-e401-4f6b-97c5-c21463a73deb", "comment": "Malware payload (Heodo)", "value": "262a076821012fc80e0570cda4f7c003", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971330, "uuid": "a8d774c9-de61-4dbd-8f65-75ce3bb96e2a", "comment": "Malware payload (Heodo)", "value": "d773e4cd0b036765c754894a6fe53a3ba0cf14f9238e98128f624d195f99e2d4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971330, "uuid": "bfa08748-9e67-49d0-9754-4aaa6f7db3d3", "comment": "Malware payload (Heodo)", "value": "c69b30779073c55535968e0d567316b773dc8a6c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971330, "uuid": "3af7303e-fdc1-457a-8dfb-8e214e0549d6", "comment": "Malware payload (Heodo)", "value": "d0eef25fbd0735254e7a46c63e6ea304fcdae8f70dac64efddd702fecc5b1b4af36a840fc36c905d6a674b697cc07888", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971330, "uuid": "defa7055-146a-4850-bba4-9e957a2f04c4", "value": "T128E4AE1277C1C076D4AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971330, "uuid": "7e2d89fe-bf5c-46fb-8cb1-57758049d3ad", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971330, "uuid": "9bfbe64b-28ed-4462-a7b9-4f942fdea060", "value": "12288:WKEUkuAOLka1miSmuYr1V7uAobS3qTHPR101D:TEQLka1nBVCAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971330, "uuid": "919c25c3-b062-43ad-8670-b9d4f462730c", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971330, "uuid": "0ae00ee4-1742-4664-8bba-788be22f621a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971330, "uuid": "5e920a47-d445-45cf-82c5-e85562dd2b4f", "value": "emotet_exe_e5_d773e4cd0b036765c754894a6fe53a3ba0cf14f9238e98128f624d195f99e2d4_2021-11-27__000205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a957382-4f5e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638002774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002774, "uuid": "dd09c3b3-5d1d-422a-8726-4715bf05ee5c", "comment": "Malware payload (RedLineStealer)", "value": "a8bef000976a36dd25363d0b8ba4f508", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002774, "uuid": "0c6f25be-7ba8-48b8-99d3-ba52b6d53b9c", "comment": "Malware payload (RedLineStealer)", "value": "d8c2781c40ac32af37c43c777a5253781950c0ce3b8c05c0d3f50b53e7863d02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002774, "uuid": "59196b11-47cf-4aaa-9810-2a8a520f686b", "comment": "Malware payload (RedLineStealer)", "value": "d34d922ee3f84ce3e6068f29336001b9f049c795", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002774, "uuid": "ebf72eac-6061-4891-b659-97490d5ae9b6", "comment": "Malware payload (RedLineStealer)", "value": "6ed35ea22ddd060098834f119a45d8c5868ec09cd8ad29663a71b808f6ecd7f495c688cbc289485f65027b1a12a72c3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002774, "uuid": "261cfe88-4df5-4bbe-ae88-6badea1dfdd7", "value": "T16E549E14ABA0C438F4B756F889B9D3A8B93F79A16B6890CF52D516EE46347E0DC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002774, "uuid": "22ddb480-c36c-4758-9718-65e5a0c8c05f", "value": "ac14a22dc3791ebf7f4a67e197a18bc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002774, "uuid": "8a36e2d3-564e-4ac9-bf51-126c9e934d57", "value": "6144:a621sZ6LA/mkTYwitK6dYmMbSXuZet0yS8wYgBJBai1X2sRob:aTBA/meYwic6dYmuSXuZet0yS8wNBxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638002774, "uuid": "f20dc284-bafe-4e0a-8521-b03f651b7bf8", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638002774, "uuid": "5d900f86-53cc-4a80-97f5-8b4226a5df11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002774, "uuid": "56439671-f25d-45f7-b927-c08b1b3f1691", "value": "a8bef000976a36dd25363d0b8ba4f508.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1b25d4-4f97-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1638027313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638027313, "uuid": "a0e9dada-9190-4bfc-9f08-7f5bf1008104", "comment": "Malware payload (Gafgyt)", "value": "fd80174db20d854e8623006cb7c3ac04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638027313, "uuid": "0a8e64a8-1671-4b7a-9569-cd1ff16c808f", "comment": "Malware payload (Gafgyt)", "value": "d971f1571656117b68f25fd90140a9981e77d5f0ca1f400c0519adeda5371ea0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638027313, "uuid": "d78b6245-56b3-43fe-8ef9-eaa349feb472", "comment": "Malware payload (Gafgyt)", "value": "b6273f15e0633a57d3a082c6bacedc892343de19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638027313, "uuid": "47b1c9d5-ce06-4080-9328-698b4aa38b13", "comment": "Malware payload (Gafgyt)", "value": "de572b9ebb0f47d17c7963e0b4dcbb8cbf774aff1f1a0622b68c5494b100baf48f9b6c8a8fbac139e24d26ae02ae190a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638027313, "uuid": "e17d4701-fcc0-4b28-b3a4-9c6c0bedcf93", "value": "T10CF3747E7E22AB7EE26883310BF76F74C39521D223919382E16CD6585EB124D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638027313, "uuid": "933dd130-00a6-4479-b545-c84e033a57bf", "value": "3072:r4il1kN/zTzL5htcfBdAhmvtOqx13LFRWq:cI67HL5htishmvtOqx13LFRWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638027313, "uuid": "18f1c862-7b35-41ec-a9e2-94b96d36086f", "value": 162249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638027313, "uuid": "08619291-bb8f-4d7b-845c-1aef2439ceee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638027313, "uuid": "aaf64219-9b73-4f04-a8b2-b9e3eeb93411", "value": "fd80174db20d854e8623006cb7c3ac04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f405fbf-4fb9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638041732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041732, "uuid": "2af58cc9-9a82-48ad-be12-456b1fae0a77", "comment": "Malware payload", "value": "38a215d52f90788bb36d844cbae2bc0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041732, "uuid": "6b22a636-9ae6-4804-bcec-b6588fc199b1", "comment": "Malware payload", "value": "d9ccecf4e3a58bef9f062048ef8bc6968693e3d6a401be4effa973eb9f58e727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041732, "uuid": "69c9194f-4590-4c21-8f2e-e9a369e2d8f2", "comment": "Malware payload", "value": "b26746ee4a54c5f0fb4151fa61de26549dd6551d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638041732, "uuid": "d040457b-f1ea-4f4f-b279-e7cdf1065ffb", "comment": "Malware payload", "value": "7b1df7c1295b9ef896e7f9724b3b813673bc5f3d3160776bf05cd2fdfa44fe168058fa87605be09b5f66f5c774dd81bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041732, "uuid": "9baadee9-6eaf-4afa-86fd-543c1c47fed4", "value": "T13E1633417618B7B5C46C2339D326E06E0604E678DAC5F065FEAA0384E9F9CE7FF21660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041732, "uuid": "1b26a20b-d6a1-4e69-89a2-ae1983004676", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041732, "uuid": "b9e05093-dee6-4c36-b7bf-353d858bbe19", "value": "98304:O32HIsEUn5nfd1XxJQezySowNKxcvJQtG/bcGikE:J3nfd1hKezyX6K2SGDcGid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638041732, "uuid": "e4000048-bf8c-4361-9b4c-3f7d9350247e", "value": 4402688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638041732, "uuid": "e73aaff7-1fdc-470c-bfb9-5e516cc5b0f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638041732, "uuid": "93e5f640-7e02-4930-9abd-0f7e1e0490ae", "value": "kiddions_mod_new.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc930c1a-4f1c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637974538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637974538, "uuid": "746a7cf4-d713-4c5a-8f01-81e8e9321e91", "comment": "Malware payload (Mirai)", "value": "68becd26a584b0a5738e98799edf4db7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637974538, "uuid": "2c24cc2e-9528-401f-8ac5-9163886fa103", "comment": "Malware payload (Mirai)", "value": "da9e62dd9de9a11e45cddc53fb331aa0f0e255e1db761f0a70a8cac16a1d11a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637974538, "uuid": "21333caa-3593-4472-a401-3c6f7d5c0ae3", "comment": "Malware payload (Mirai)", "value": "ce2501afd0ed4f27bf9c2f4f7fd19dd353f45eba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637974538, "uuid": "4d266637-c6b6-4dcd-a4f5-91a1604fe6e6", "comment": "Malware payload (Mirai)", "value": "ff16fd35871f299bd371ddb6c71d79db0dfb3a2bd49db3301df1ddc01944d8d74d8c75cfea1ff7bed5fc1b6d99a04ca1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637974538, "uuid": "bc760748-322e-4251-a917-f98f680202f9", "value": "T1096402D7D721BDABE40385B0655F13987378C68AC38BD281B358882D3D7E34657A62CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637974538, "uuid": "3d5664ec-195a-4895-bbb2-eafe6d4131c1", "value": "3072:2glZ3FtCKXhkmHtZ9TEKzjfj/WMngyIfsJ0F7xPtofQ33Q:2IIKXhZtL7jOTyIG87XyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637974538, "uuid": "0d45eed6-4bf1-44f4-8023-6143aaa95fa3", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637974538, "uuid": "86f3b309-9a63-46b5-9399-909775b7e1fc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637974538, "uuid": "34b9aa58-1bd9-46e6-aced-9bc389e69893", "value": "68becd26a584b0a5738e98799edf4db7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e88574-4f80-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1638017456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017456, "uuid": "fdf43d99-47a5-46d7-bb58-b53d7d5c80a1", "comment": "Malware payload (Heodo)", "value": "ff0f95820214c58eecc7e6db40f3d302", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017456, "uuid": "26b6c2a9-b030-49a0-87a6-10818d18c4be", "comment": "Malware payload (Heodo)", "value": "daad538bda8cefc7bc5af0d0206a6827a5b1f1c745bad32ae5f1a76b928f2eaf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017456, "uuid": "da271efe-a0bd-4c0c-aecc-1d5e12148bde", "comment": "Malware payload (Heodo)", "value": "ad1583c4c486bdb8d3134b1ea530252f10f57ba2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638017456, "uuid": "67e9cd10-b9fb-4bb8-893c-7b490c1aa14b", "comment": "Malware payload (Heodo)", "value": "018c45b84e7849e79c125a8029b7f08a1c3a6d39502a69dfb9ee6b6c456842a7c04ace585b296238a78797836072e4b7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017456, "uuid": "c24205a1-35e3-4699-9b10-0ceec0cff939", "value": "T142848D11F781C436C2AF31706516D6B965AEBA309FF582877BD01B3E5F341D29A38A0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017456, "uuid": "8c2e27c1-f1e0-4599-9b98-44a1f8cf96cc", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017456, "uuid": "8bca933e-2af9-4d67-83b2-994de238b1e8", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDa63P93XCJdjWG:HVqLOGNVDzZtIlHN3nkjZXC/j/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638017456, "uuid": "a53bd805-4a9f-4d91-838a-48c0e880166d", "value": 376406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638017456, "uuid": "e7bb2c3a-bcea-4ca6-aafb-0e7205fb64d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638017456, "uuid": "6d77d2d1-bdd5-4c9c-9104-14a6e153bc37", "value": "emotet_exe_e5_daad538bda8cefc7bc5af0d0206a6827a5b1f1c745bad32ae5f1a76b928f2eaf_2021-11-27__125052.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0c6e4a-4f77-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638013566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638013566, "uuid": "63bbd47a-28bd-41b8-a434-1c990374e15c", "comment": "Malware payload", "value": "8decc6538c96cac368946e371ba99ff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638013566, "uuid": "0e51a348-8bd1-4175-a1a1-2e554c4fc474", "comment": "Malware payload", "value": "dca23b9ad90a78b881238881159d43118072aa625e33ceb45d92ff59479bbb22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638013566, "uuid": "0db2a0f1-19fc-46a8-8c1e-643f9c423623", "comment": "Malware payload", "value": "20ab56ede88043512199ac9ae1e30864784cb779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638013566, "uuid": "1f6c7bbe-f52a-4d48-af5b-62679d594872", "comment": "Malware payload", "value": "cfa3467c33c11dd384e8a728598ffd0f2cdfc62db8667c64febc3e3cb319e6880e857aa285231dd9539895688a75e4c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638013566, "uuid": "5f8b181f-0073-44b4-aa7e-4fe5b6922680", "value": "T17E063307F28FB4F7CA2A247D3323503B5E65FA530A395735B4884FE123955E6382AD92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638013566, "uuid": "c34debd5-bc6c-4f61-93c5-a9bf7978ab8c", "value": "04125eece435f26d76a1af336a1f52f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638013566, "uuid": "12ef3e9c-a0b9-4a18-b84f-e16018deab7b", "value": "98304:+K3QoovtivyNPZxEHudmNvzqmy/U9Gy0PzHoizT9G+SsHyl:Z0QyXmCVy0LH1zT0+DM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638013566, "uuid": "c26bcfb5-2e76-4e6a-b9df-6932ee347001", "value": 3785744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638013566, "uuid": "f9214cfe-f841-4389-93ee-a07dd660d64b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638013566, "uuid": "7eee034c-69b1-47a8-9a4f-fa31fc0e434b", "value": "OvixLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83884b4-4f1c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637974557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637974557, "uuid": "a78c0025-ec7c-4942-87fe-2186114c155e", "comment": "Malware payload (RedLineStealer)", "value": "f1725bdb4846ca23120fa8e41f220aa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637974557, "uuid": "215892f1-b656-47dd-9d27-503f016192fd", "comment": "Malware payload (RedLineStealer)", "value": "dcea01c5344bb0864c91ae3de3e62f84ea1af78769ea84954fddc2260d62d59a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637974557, "uuid": "16a658e0-a781-4a62-942e-5cf54ca2565f", "comment": "Malware payload (RedLineStealer)", "value": "7180ddf25565dba99d0a6f7a1b51e35b33cc8f86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637974557, "uuid": "adf1822d-3862-4635-b7b0-86928aa2d72c", "comment": "Malware payload (RedLineStealer)", "value": "359fc5dfb474b34d192b3d5b8bfeefd4e683b36b01c7d4c260afd0476045da1cd0e648fb5ae76ab0f9b08fe7dbf0563a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637974557, "uuid": "d7638bd8-06ae-4538-847d-5d34c3d834f5", "value": "T1CA152222B358EA0DF58883345E6084EA261DFF785F4DFF6623DABF5C99352A36501027", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637974557, "uuid": "51acf6c9-7048-4bdf-97a2-eb15a28ef2b5", "value": "d78fdaa2c68df2d009ac00565ef8df97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637974557, "uuid": "3e0a849c-9144-45f9-9dae-cb03139edc8c", "value": "24576:mJSm969/yg4+hQpgMqnqqg58yw7O/ys7X8aiaRP:896tvVJYqLyw7OKs8vcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637974557, "uuid": "8253f9ee-cc9c-4023-a6a5-36b33550b255", "value": 939776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637974557, "uuid": "96dab9f3-05d5-42cb-9874-84d1a8af731c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637974557, "uuid": "f6cbebea-d50b-4a3b-9534-a131f6898965", "value": "f1725bdb4846ca23120fa8e41f220aa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edb4c23-4fd4-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638053408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053408, "uuid": "24c880b9-6b2d-4b1f-8db5-33ecd7c422eb", "comment": "Malware payload (Mirai)", "value": "57cd2232fae803a9c2224ce2db2deb36", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053408, "uuid": "2880a744-19ee-4016-a012-f23838374c8c", "comment": "Malware payload (Mirai)", "value": "df3344874aa5eb856de7a7c51daa47d745d35fdc88f93a28bcb8f3944b0ed017", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053408, "uuid": "a2b6d5f5-99e3-43a9-8060-b3a57e89a5dc", "comment": "Malware payload (Mirai)", "value": "799c884042c6d5680d1364d940ce9537f90c9517", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053408, "uuid": "4d3c9162-2db1-4f4f-a66a-a884790d5488", "comment": "Malware payload (Mirai)", "value": "9958ab207a0311db15d825afd711f245508767c019c8ab4e5ede20389418cac16f6fc0fb28d4bcfb250705eea9d3ee6c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053408, "uuid": "977b066f-152d-40e5-bd90-1eeff17c3e4a", "value": "T10FE2E1306601323B94D04D3995E8C3853BEA467ED11F367A3B20073DE9D52CF866EB9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053408, "uuid": "04570a4a-3697-4a45-a951-9ce9d25abee0", "value": "768:BNjAXNMJATFbkSb2lJCO3D9bfAku5MgA7slOuphKGrM9im3UE:BNjApIkQxbfvu5xGslOYhKEMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638053408, "uuid": "19e41a5e-26a3-49c6-acce-2ed6dadeaec8", "value": 31896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638053408, "uuid": "4866cfe2-2798-47db-9238-14280546a545", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053408, "uuid": "bdb4afaf-718a-4b2c-bc93-8b199904e14d", "value": "z0r0.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533f1c58-4f63-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638004855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004855, "uuid": "8b51a5e4-8195-47b5-ba4f-3c9099b929e0", "comment": "Malware payload (RedLineStealer)", "value": "f590bf639695b7846eb155203f0e5eb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004855, "uuid": "ab738999-181e-4723-8f65-3bedf50d102e", "comment": "Malware payload (RedLineStealer)", "value": "df9159f90b4bc9415cdcbe4197262a451077037faf4ad44e778d768e97c1b4cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004855, "uuid": "5ec6a39d-a3c8-4a14-84c2-963bef5e6cd7", "comment": "Malware payload (RedLineStealer)", "value": "a12eaaa7cf92ee1773dba92a91fbf7f653c1d242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004855, "uuid": "ccd91d7c-e85a-4f8e-862d-22de6a28a364", "comment": "Malware payload (RedLineStealer)", "value": "3090f7ade5faf8157de11f566fc7fabf7015b7491e705588cc51a6d4b9416ce7c3aaa7311a4c20db71cbfc8ca288b5ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004855, "uuid": "d136fb22-6528-4e95-a0bb-7cf333e8514a", "value": "T174F39E11B6D2807ED1A715336874DAE50A7B7F7F153181AF276822EE4EB03C089B9367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004855, "uuid": "a2252877-fa04-4da0-91ac-68dca6f85a83", "value": "bb8a0a27df83230d6bca882af393ec61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004855, "uuid": "43b7d555-7a85-4c84-ab01-113608f8eb5d", "value": "3072:Uke7T/+aJGgseJhG5VgAXvNeB+8ZSJRsfad2:g7T/+aJGjefGHhIY8ZS4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638004855, "uuid": "6c9aac36-584a-4c95-a749-06ccc36df668", "value": 160768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638004855, "uuid": "89aa38ed-bd10-46ef-90c0-25ed46a72acd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004855, "uuid": "78943a44-c4ba-4405-a319-d73a6e50c68c", "value": "f590bf639695b7846eb155203f0e5eb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf979c0-4f60-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638003635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003635, "uuid": "025d3d52-2572-48f0-b597-21bbc8890707", "comment": "Malware payload (Mirai)", "value": "817004e04c21956b00517862a07d565e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003635, "uuid": "ff208f3f-e792-435a-9b37-93fa6ac2ab2d", "comment": "Malware payload (Mirai)", "value": "e02594bde578f86f254530f4e6198e73a5eb16c0ba2a294e3d6d58119173e981", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003635, "uuid": "e003395e-9cf9-48b9-9e41-056de22909e2", "comment": "Malware payload (Mirai)", "value": "d3b9e844f46eeaab6e1275199cd50c6cc50969f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003635, "uuid": "e8a8487f-e59c-49d5-b6e2-bb30c373c386", "comment": "Malware payload (Mirai)", "value": "d342a4771fde8b3a9818d377146fac9e2bb4f1fda66d809660f697d1e39b7d3c05daf97b1ae710507c4d06c80309b97c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003635, "uuid": "666b01f0-211e-406a-9d15-a692437b20b0", "value": "T183530B817C81AA29C7D0077BEA9F108E3314A7D8E0DB7357CC545B507ADA85F0DABB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003635, "uuid": "9c66ae6e-3e0b-464c-9f02-5643842d2b20", "value": "1536:lXJ7EiwoSR9UWw6BUKTopmA7RwaGUX0ZDJIhYceZW+cPaaM:lXJ7EOz03IKcwUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003635, "uuid": "eb62320c-7a31-4548-b976-8fc89bc661e0", "value": 64040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003635, "uuid": "e47cf470-8533-401b-951e-213a6b75c1a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003635, "uuid": "abd3b7aa-4283-4ac9-b0a0-a1ee91abdd17", "value": "817004e04c21956b00517862a07d565e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe074a00-4f5e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638002994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002994, "uuid": "c7622efe-7015-49b1-8027-0812399cd29c", "comment": "Malware payload (Mirai)", "value": "2f6a6fa9d81d1c74070fbf64779e12a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002994, "uuid": "fa79d07f-fdd2-4857-9e64-4b8e920292ca", "comment": "Malware payload (Mirai)", "value": "e0605c892afab8e3d97baf3b74af16e066dad815969948984aadb85cbc12793b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002994, "uuid": "021e3be3-b50f-4933-a640-5426530b5c01", "comment": "Malware payload (Mirai)", "value": "986bf6ab2ad570ba362cc65867038a45987b6b79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638002994, "uuid": "0cf58ef5-fe0b-4e51-85d6-e050d0e3e4cb", "comment": "Malware payload (Mirai)", "value": "42cce6dc9ce992f1c4267d6f433499cb8074d6fef1ee9f7e7bc985bd985d7cf229ec92ad311ba51748e712f8b0380704", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002994, "uuid": "52312afd-d213-4d7e-94d8-364ba74c01c5", "value": "T1A6330B8D5C111E1CEAE268FD50729F0DDE551321A0A3170FA3ABFDD33D33268AE55A89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002994, "uuid": "97860630-aaa2-4dc1-8787-add844e1268a", "value": "768:mdGPuwT36OrjiNeKPHGx3oEHG4amWerlVvokbcr7DDTWUMoY0WE7hCyFZ+f1prNC:mdGHUHC3JHG4abtH57hCQg1p59I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638002994, "uuid": "9ec5d80d-5568-4829-b71e-cca4eb08ac10", "value": 54792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638002994, "uuid": "2ad103e5-e228-463d-95be-a25c28d25e0f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638002994, "uuid": "54bfe134-8f21-4fb3-b7ed-9a772f66d819", "value": "2f6a6fa9d81d1c74070fbf64779e12a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444ee0d7-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971330, "uuid": "6dbbb3db-e232-4116-9e8d-8c1ab8d044b6", "comment": "Malware payload (Heodo)", "value": "83aa9630e8c5c5abee4450e91d1a076c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971330, "uuid": "fe91cde6-5a40-45bc-9594-1e22f0d7add9", "comment": "Malware payload (Heodo)", "value": "e0be936474861cdcd94204ff8679dea360b5a579b0cdaa1f7127b1cd25f69e3a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971330, "uuid": "570c7c6b-359e-4db8-9ba6-d3189b565b57", "comment": "Malware payload (Heodo)", "value": "a0e30910982f07c1671130737545978b7da62b63", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971330, "uuid": "fc8682c1-5bc0-4915-a31a-58d2e78447b7", "comment": "Malware payload (Heodo)", "value": "42b09539f4b8c8eb14250d76b84b1c7a91e8c06013ef768d49baac59f620b6174b5361dede081a043dfd45132c034828", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971330, "uuid": "f725d777-3830-4ceb-96e3-efc315909f38", "value": "T1C6E4AE1273D1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971330, "uuid": "b21a789a-6089-458a-abaf-037ec9f760b2", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971330, "uuid": "06f0311d-8fbb-4e09-8b5b-9aa095806f18", "value": "12288:WKEUkuAOLka1miSmuYr1V78AobS3qTHPR101D:TEQLka1nBVIAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971330, "uuid": "e161fb1f-e883-44cf-a663-22fa61813b58", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971330, "uuid": "978d17f7-0571-4905-a790-01b7f617b278", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971330, "uuid": "951d9517-f44f-481a-ba3a-9718166c4d21", "value": "emotet_exe_e5_e0be936474861cdcd94204ff8679dea360b5a579b0cdaa1f7127b1cd25f69e3a_2021-11-27__000205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc14982-4fd4-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638053406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053406, "uuid": "8111d813-14d5-4d0e-a4d4-b6b52e3d5c20", "comment": "Malware payload (Mirai)", "value": "2fee307f4bb6c5ca58044ad6f4b6a326", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053406, "uuid": "eb21d9b3-9ccb-4f51-8cca-e8dbfcfcdb80", "comment": "Malware payload (Mirai)", "value": "e11b079935295909c4960f2b4950bfaeb31365f0ecec2faf6b55378b03111a78", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053406, "uuid": "cf3f413c-4e0a-45fe-b006-88f3651ffee7", "comment": "Malware payload (Mirai)", "value": "2bd5c4fe0c34379ce15ea818d31ba8dbb14a7c3c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053406, "uuid": "38311823-cf1f-4092-87ff-b854fd9dfe9d", "comment": "Malware payload (Mirai)", "value": "b2c5cd024066cf4829c10a1c530861f67fe55344d812676283929dc68b3acee1313af7f974e9d4f5f99f07913f3dee8f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053406, "uuid": "dcec8ebe-a9fd-412c-b989-4b7a805fced6", "value": "T1B9535AC9E5C3E4F9EC150A71307BEF329776E63E2068DA97E3996432EB41602D50639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053406, "uuid": "f625c455-6142-4247-bdcf-3ba92a42acca", "value": "1536:l6xGoSfFboSfV951w9cHBLoB/CbGXFzJzaYkJSN6O:PdbfV951wpqb0Pfkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638053406, "uuid": "27b325c3-3926-49c1-a037-ce13259e6552", "value": 63568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638053406, "uuid": "09efd6a8-5d09-4c53-88a7-f6e525ecee09", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053406, "uuid": "266611e8-caf6-4330-a227-caab6a7c380c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1205a37-4f9d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1638029897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029897, "uuid": "10a2d858-36fa-4ab2-baad-16c293b8a31d", "comment": "Malware payload (Gafgyt)", "value": "1db6e0c047b7357bfafc56890e289f78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029897, "uuid": "7aec26ab-5813-421f-8c22-b1b0d5efcb8d", "comment": "Malware payload (Gafgyt)", "value": "e3a3cba9d9619e05b89fb545a1b2c78e92c24dbe12635e4838c7c996d66cc490", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029897, "uuid": "ee014c3d-8a5c-457b-b330-6d2aa2e080f5", "comment": "Malware payload (Gafgyt)", "value": "6f1c16719c8cf9270cccae7a7c6ceff0a702ab2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029897, "uuid": "0acefca6-2d3b-4fd9-b47d-1d8a63c95d7e", "comment": "Malware payload (Gafgyt)", "value": "47f68752a4cb1dec5ee1083ec25f76b567c9bb1f167b23e58b3fa11cdb8a72a43f4be12780bbdad8733ee697ad67f6b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029897, "uuid": "7edf5a00-797b-4094-b41a-c9977537f109", "value": "T11AC31997F800DFB6F40BA67604D74B21AA70BBA60F93252372173967ADB61D53823F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029897, "uuid": "da4f25b4-bba1-4545-9900-9ca8ed21f1de", "value": "3072:puElzaiXN8vylT34Ey7N3J3hx99C0dmmh0qDrtaIlZq:puEleiXN8vyTy79J3R40dmmh0qDrtaIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638029897, "uuid": "4b670288-6f38-4f20-97e4-a28eeff28272", "value": 121862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638029897, "uuid": "54725823-c8ad-4e97-b0a7-48b494b695d9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029897, "uuid": "20bb851c-504d-4e3d-9f01-9b8051c6f13b", "value": "1db6e0c047b7357bfafc56890e289f78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8c0b2d-4f61-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638003910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003910, "uuid": "a5b61b01-540b-464b-b57b-cdd6b08a8951", "comment": "Malware payload", "value": "89ea0b385a3d4af7a40a8d1347682fbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003910, "uuid": "fc8689a7-906f-4748-abef-192f76326504", "comment": "Malware payload", "value": "e40c34d1e59fc34f8967a10bd4e12b7890f46662048be19eb1cf8f87f37c652b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003910, "uuid": "7162fdba-be74-4a9a-aa3c-2c769ec888c1", "comment": "Malware payload", "value": "b33d2f9ae9d4f779b23c78ba9e8c49762667b90e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003910, "uuid": "d0c923de-caf0-4c30-b6fe-0d641380dcbd", "comment": "Malware payload", "value": "d81176d1dae6eb7c1887a6f3b627a439e35695c017e20cbee408a13211ae9825efc91191cb281658c0cbf24da4a0175e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003910, "uuid": "5e58d488-46fa-4cab-afbd-497ca1cf28fd", "value": "T14B5296339A44C0F6F989BAFA140C53DCE5BCDE2D921CC722877B1C38E3A0999957D166", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003910, "uuid": "53b1bdfb-7198-474d-a9f1-59ffb5902979", "value": "192:SiVqE2IB4QivwZGU7/dYraAOF6ixT3si6VZpMjw2KIBg5YqVJrIi5qTumdxE9anV:SiD2ICOGUs0sk6CwzLXyemIGKH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003910, "uuid": "2b5e58d6-e9e4-4591-8fc6-1f864029ff90", "value": 14153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003910, "uuid": "6b1c8c29-30a8-4ff4-af9c-b7b2176136a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003910, "uuid": "92f7fb93-40d1-4ae2-8bde-1a974fa2acb0", "value": "89ea0b385a3d4af7a40a8d1347682fbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed427154-4f49-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637993947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637993947, "uuid": "95da7954-2d14-4ccc-9a65-8f6a4f3f1be5", "comment": "Malware payload (RedLineStealer)", "value": "a8f143090ad26aecde484973eaf4bfa4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637993947, "uuid": "88503ffb-6682-41db-9e83-06df5f0664ec", "comment": "Malware payload (RedLineStealer)", "value": "e5af17694352cab735c8ab760b0cbdaab8eff10b17e12dde0ab90d9c5a5a9179", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637993947, "uuid": "1f6e527b-2145-417e-ba6b-8c5eb457fcdd", "comment": "Malware payload (RedLineStealer)", "value": "faa78e2240c9ff2a29676dae50bbc92b8cea44ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637993947, "uuid": "ccc4e69e-b3a0-4725-bb9b-095c0285e56d", "comment": "Malware payload (RedLineStealer)", "value": "f84a4c2bdfb9595d254de7e339a74787666bcd55a74224e36512e7a1abdade1358c72a2d3359854e8bcb2e1fb7b89ced", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637993947, "uuid": "10073913-a35f-4ce1-a055-d117c0adc1e0", "value": "T10884AE4835CAF296FC7BDBB50CB47A8147B4F2F7D604E2CEEC94249A9672B404A10977", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637993947, "uuid": "dcb5d53b-7dcc-4860-8b91-e630c6371c4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637993947, "uuid": "7978002a-49ca-4a82-bf66-849c40bc706b", "value": "6144:Nia6cO02Eqys/3oufNZEP0DlwT838BqVwAgzVDvzlNIUzxEu0UV:NiVE/stTEPcw4MBqVgxYUtEud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637993947, "uuid": "df105727-434c-45a6-ad66-1706add87ca0", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637993947, "uuid": "8db4c4e6-d763-4e03-8a2c-3396a8554556", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637993947, "uuid": "68fecacb-df9d-4c48-88f4-200e58f96e39", "value": "a8f143090ad26aecde484973eaf4bfa4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f78a746-4f46-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637992340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637992340, "uuid": "8228ea52-3ab4-4578-91a2-26d03ebd0795", "comment": "Malware payload (SnakeKeylogger)", "value": "10791efbf3a5edd898dea687f99ce49d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637992340, "uuid": "593e9dbb-9bfe-4ab8-86ff-fd323ac521f4", "comment": "Malware payload (SnakeKeylogger)", "value": "e6382f39e59a7a9ee50266d28cd9ff170879d6afe9c4a7d955905c34a860af38", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637992340, "uuid": "6efe4dd8-10a7-4cdf-8954-7f89118efc5b", "comment": "Malware payload (SnakeKeylogger)", "value": "657638ffb260d46a7e83fab621d44b3fa945012e", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637992340, "uuid": "edd8f698-d840-454d-9ffb-58adaa5bcbe0", "comment": "Malware payload (SnakeKeylogger)", "value": "e3c41418de2cabfd08e2bdc47b1c4141e21fae2055c1fa13c86c5efe91f04a647bef056115f6c6442edcfcc1101b6310", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637992340, "uuid": "09f67c92-4b8b-4d3f-921b-d5e1c4c04f21", "value": "T1C99423BD8FD6EE6AD03C8CAA1F153E57DB4980894005627B994CC5C8716B02EAC3C8FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637992340, "uuid": "a32e0b73-68a5-4e0c-80c3-f3311a590075", "value": "6144:S63doONAmlM0QUxVmtn15S/Q4BSKhqXWSbcH4qOTz9ch/HCeA:S0dJNs0QX0lYKhJMcH4nbeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637992340, "uuid": "2dc82d3e-3b6e-4b84-a117-aac6cac4afaa", "value": 423014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637992340, "uuid": "3328b4fe-bdf3-4ff2-98f6-33bb91ed5cdf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637992340, "uuid": "a65f8f82-8e81-43f4-9aae-a19658796c01", "value": "ORDER INQUIRY-PVP-SP-2021-59.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9cc661-4fd4-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638053404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053404, "uuid": "794ce6bc-a45c-4129-9172-8ca6af33f534", "comment": "Malware payload (Mirai)", "value": "02f3c6490cb7c31461902cf56667e2c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053404, "uuid": "aee2eca0-dfd4-4a99-bf00-d749c210a479", "comment": "Malware payload (Mirai)", "value": "e6b87475655fb2cd1c362774d3774ec08b72ae943b432cf4c7dc9bd0babcaba8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053404, "uuid": "53b5c189-220a-4cd7-920d-8d985f26c429", "comment": "Malware payload (Mirai)", "value": "e681b3cffeecd827692ebf9baf9bab49e298d0fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638053404, "uuid": "f3d42844-6280-4f26-9f89-1b01aa0692d9", "comment": "Malware payload (Mirai)", "value": "98b8f660837a9b17d650a5e1f944864fba73923ac056c68c9922ba7845c5e4f09651e2b16be194981a2503f87da5abcc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053404, "uuid": "b7329205-136a-4767-b9dd-72a83b11e977", "value": "T153E34C46EA808F03C4DA1776BBAF424A33239754E3DB73068D18ABB43F87A5D4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053404, "uuid": "44752515-72f7-45d8-b9be-ca3c9820b52a", "value": "3072:danMBOgtd2Kfak1IavLHqqH1UJLoTf301FM/9lf:0nCOy5fak1IavOqH24f30rM/9lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638053404, "uuid": "8a50ecc7-de9d-4958-a74a-7487074f464f", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638053404, "uuid": "8e92652f-62eb-4eb7-90b0-2cb330976b88", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638053404, "uuid": "9905813c-909f-452e-8d28-a909efee6d14", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64cdc55-4f2c-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637981507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981507, "uuid": "fcd906fe-72c5-4c8a-ae86-f2568d6bce08", "comment": "Malware payload (Heodo)", "value": "5ff681c59ea0d99d13ed3e7486a4b2da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981507, "uuid": "e8e9c0a3-79a3-4ce2-8b84-e6cfc1f35839", "comment": "Malware payload (Heodo)", "value": "e719cb0a12712e0bccbba77c16451f1e704895f5583800de5340412272699d9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981507, "uuid": "25e90237-ad14-4fe9-a3e0-f1b92d95d1c6", "comment": "Malware payload (Heodo)", "value": "9837e1214d93cca33a6d34ed1939c0e561c418e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637981507, "uuid": "4499effa-532f-4a5a-9a75-e315195fed28", "comment": "Malware payload (Heodo)", "value": "017abce4a2e99c2217b885abc58e90c53c7af20b329256535be1b53ee48d773e65a31d0dec347d78b7d42b1fd06bdf98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981507, "uuid": "0a914e83-2f71-4a25-b13e-20adec3a5eea", "value": "T192E4AE1277C1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981507, "uuid": "e345258d-ce04-4561-b883-a740240934b6", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981507, "uuid": "7089dba0-1745-4d99-a12d-ad6b3030d9b7", "value": "12288:WKEUkuAOLka1miSmuYr1V7NAobS3qTHPR101D:TEQLka1nBVpAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637981507, "uuid": "1fe63c31-1395-45a2-b69a-61494f3da377", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637981507, "uuid": "6535eb26-d88c-4496-8402-9eaac21d06de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637981507, "uuid": "d7ac63a0-69f7-434a-b400-48ed388ba44f", "value": "5ff681c59ea0d99d13ed3e7486a4b2da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cb7bb9-4f39-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637986774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637986774, "uuid": "c4246505-449d-4136-bd54-5e47cdd935fa", "comment": "Malware payload (Gafgyt)", "value": "bdb2df56f66c758ab2c08a1a92ef9353", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637986774, "uuid": "e49328cb-9c3e-4459-a897-c966533ec05d", "comment": "Malware payload (Gafgyt)", "value": "e79c0f78d48ef67ef7bc8deb217123bd5f7345aef52a6bb6fad01245bc6e112f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637986774, "uuid": "11571545-0a4e-4f5f-af41-cdb8e46ce98a", "comment": "Malware payload (Gafgyt)", "value": "a8ee1cecea76d4310c3f0baf51b346a16c7e3c10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637986774, "uuid": "2ed5b1a6-def9-404c-a3c9-54937b3fd677", "comment": "Malware payload (Gafgyt)", "value": "087edd674012b7f2d96081cde0871edcdae8fbf0d59cd2adbc9d8b9318f348eae4e86cd64eb83588d607b0e554ed6c44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637986774, "uuid": "26d22bea-7953-4da6-94cb-409a9bf2d8c2", "value": "T1DFD238A3CD262E18E2DA85B170284F351733E555EA8B5FBE1066C23CA143EDCF6063B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637986774, "uuid": "5c673056-d4c1-459f-adf5-eced6e903e84", "value": "384:C0Spn6f0EKEa7IYsiaOxyE3COovBh/1CqB4arYCpdxWx1a7Ef1Pnmf7+eP:e5EKEaPxaSovBhsnCpD+1VfJnKaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637986774, "uuid": "bef2ce29-477a-418b-b196-08d5d0b0ea68", "value": 29992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637986774, "uuid": "5f2938ef-c927-4804-bd8e-d1d39258a680", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637986774, "uuid": "3725b811-94fe-443b-bcfc-b50316c5d5b9", "value": "bdb2df56f66c758ab2c08a1a92ef9353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6bddf2-4fb2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638038670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638038670, "uuid": "4464aaed-c920-4816-916e-c966f416b0c6", "comment": "Malware payload (Mirai)", "value": "0d7a300337a60ef257dd28f916098e2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638038670, "uuid": "09407cfd-a0a0-493d-b28a-e94e4a052d77", "comment": "Malware payload (Mirai)", "value": "e7ce9cd5ced12da412eb3e4bb2018adc78f462acd99239a96ea148957f67d98d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638038670, "uuid": "ecfd15e6-9f12-4ce7-bf50-8e27c570893f", "comment": "Malware payload (Mirai)", "value": "31c2ec4a46f4d84cd30072b691f300ab21830a1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638038670, "uuid": "0eb6c7b2-9d5c-4b87-b18e-71dfb08e0985", "comment": "Malware payload (Mirai)", "value": "cd5aef58863a98d1f3f70978c357dd0266d37df15821c441ac568f4d76b3d57ba0ecf70b6caa9166ec29a794daaf77fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638038670, "uuid": "8ddbd683-5bab-4a83-a9e5-926bed4e83ef", "value": "T1E9734B24A9792E22C0D4F67A21F7C714F2E5230E26F4865E3CB20E4EFF2465459573B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638038670, "uuid": "f2ff26d5-d987-48c1-97dc-7e0e6e6bee1f", "value": "768:/CoKDEjTq9/lVGxV6ZCA/728uln/gN6Ws+9YSkf3dzn/mBIXncJO+V9fv6m:/ChYjTS/lUxV6ZZj2xn/g6v+cRcJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638038670, "uuid": "968ea8fb-99e0-44f4-8b40-7cc450e46cd9", "value": 76060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638038670, "uuid": "184a591e-6460-45de-8933-b8ad8d15e7fb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638038670, "uuid": "05f821f5-2399-48ac-836b-d59c089e18b2", "value": "0d7a300337a60ef257dd28f916098e2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b6e1e5-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971329, "uuid": "7e235416-c5d4-4132-85ea-660ea222c27b", "comment": "Malware payload (Heodo)", "value": "7d257da07c8073815740892c299e0385", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971329, "uuid": "229d5c2d-7817-41ab-b956-d3c2b875aeeb", "comment": "Malware payload (Heodo)", "value": "ead5a538f71b328399cfaa5c31bba4dc76773a90c1f02ec8cb4d2f3a8dcb933b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971329, "uuid": "8e57e5cf-bc3f-4c81-b4bf-e87f70f767dd", "comment": "Malware payload (Heodo)", "value": "6680c8065bd88c6ab10ba42237da94177e8cd96a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971329, "uuid": "94bf3300-c22e-4c8a-ac13-81ca79533ff4", "comment": "Malware payload (Heodo)", "value": "f52bfc193678c21b5739d0d95d0b0743d303113bef0386d24fb930a9eaf0faae205d7b1ff8b1e6fa298469fe7ba72fe4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971329, "uuid": "bde8f8ea-4c06-4aa2-9f33-9311002530a4", "value": "T142E4AE1277C1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971329, "uuid": "ad4a6cda-87e9-49a2-adab-d6da6d991c57", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971329, "uuid": "a62e163a-2117-4154-ad93-4be50e439e07", "value": "12288:WKEUkuAOLka1miSmuYr1V7rAobS3qTHPR101D:TEQLka1nBVfAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971329, "uuid": "cea9ff80-0918-4461-b3ad-931dbe702b50", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971329, "uuid": "4468aeb2-cc4e-4a4f-a83e-12fcd1e4dc7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971329, "uuid": "7bfea6a6-b851-4ecd-b73b-8947323524bf", "value": "emotet_exe_e5_ead5a538f71b328399cfaa5c31bba4dc76773a90c1f02ec8cb4d2f3a8dcb933b_2021-11-27__000203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56814dac-4f62-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638004431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004431, "uuid": "9f6e3c5e-ffc7-466c-8713-3e478bfcb93d", "comment": "Malware payload (Mirai)", "value": "4212cd181154bc7ed7fff90642aa57dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004431, "uuid": "d256e1e8-0462-418f-beb8-43a7e01ab0c4", "comment": "Malware payload (Mirai)", "value": "eb23f0530eb461eeb387bd7c508a328c8ec2a4811b18984a48b9e2be7ed1bf96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004431, "uuid": "5d19368a-e0cf-4b54-b86b-631a2916f97a", "comment": "Malware payload (Mirai)", "value": "4a386d4d9df8edead594ce37ad8dd3c9b330d208", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004431, "uuid": "08320dda-18cd-4320-a668-44ddd6a5e352", "comment": "Malware payload (Mirai)", "value": "8ba275dbcf92a5c56fc9b23fe1e5ce1237ddb32cd8f4ba7003ac98f6ceb3fe19489941001acf7bc829cdcd93d8598f52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004431, "uuid": "8591f5ab-5048-43a1-ab29-1e293fb789c2", "value": "T13D6319817C80AA26C7D0077BFA6F108E3314A7D8E1DA73478C151F9576DA81F0DABB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004431, "uuid": "82cb4bb4-3c61-4614-801d-bb181c139284", "value": "1536:A+H0vL+8Yqgyqs9FdcaqLtySUO77Jh4m0d/iaAZJeZWP4+mM:A+Hu+8gUiaAjwSNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638004431, "uuid": "d43f0ad3-ea33-4f18-8583-5a673b70d110", "value": 72232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638004431, "uuid": "13898b2d-51f4-403b-bd6f-757c77ac0dce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004431, "uuid": "dd1b8ca4-dde3-4288-b269-3ea5a69061be", "value": "4212cd181154bc7ed7fff90642aa57dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef9fa9a-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971374, "uuid": "01a8fc9a-1b0f-4018-aa9d-77b8119287f2", "comment": "Malware payload (Heodo)", "value": "c60cbf843e9d4e460b3975667c64b609", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971374, "uuid": "3da39e6d-31d1-4785-9b17-71eb47779e25", "comment": "Malware payload (Heodo)", "value": "eb641590074d5d2f558489dee45d002eeee3e16f6a87094ec5e3113afd6a7a1c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971374, "uuid": "f9c34764-79ce-4fbb-86b2-5110aaf6ef2f", "comment": "Malware payload (Heodo)", "value": "7fc489140b6046ca9c24093db1d6dfe7fd2f0eff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971374, "uuid": "3696249e-0e3c-49dc-983b-f86456b7d31a", "comment": "Malware payload (Heodo)", "value": "df222062593658aff64dba9e4e3f183f5df6e80f12e4cd0fce0d0d75aeca68116814df968abb777d0746b837d4ed0a7d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971374, "uuid": "e2c85afd-607f-4a15-b994-1ba6f02a3a53", "value": "T1B3E4AE1277C1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971374, "uuid": "9878e470-c16c-4891-979d-34ccdf76cd86", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971374, "uuid": "e5e181c4-3af8-4f60-bac7-1024eef1b961", "value": "12288:WKEUkuAOLka1miSmuYr1V7yAobS3qTHPR101D:TEQLka1nBVuAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971374, "uuid": "958e4787-b818-44f1-9fc3-d51a03075bdc", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971374, "uuid": "720f83c4-35fa-496e-9984-11c7c44c7d3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971374, "uuid": "72087a2c-6834-48a4-b3ed-90a2b16e1962", "value": "emotet_exe_e4_eb641590074d5d2f558489dee45d002eeee3e16f6a87094ec5e3113afd6a7a1c_2021-11-27__000249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b8e645-4f99-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638028188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028188, "uuid": "c649e098-3121-409b-bc66-d1d4792a9f6e", "comment": "Malware payload (Mirai)", "value": "626eabf3aa269967064559a6ac95b70f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028188, "uuid": "f6086455-8b73-4234-a820-85c08e2cc26e", "comment": "Malware payload (Mirai)", "value": "ef7d476f46aa26a599007b4355c6b1ad337223f680c5e8093990f2bb2f10e570", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028188, "uuid": "bef002fb-a36b-4a1a-9982-4bbda34eaf99", "comment": "Malware payload (Mirai)", "value": "b6c367e3ad0acb5cf3906729a55613bb8740965e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028188, "uuid": "65f16b49-2217-4d3c-a903-f314e01a7a4d", "comment": "Malware payload (Mirai)", "value": "f4ab04ce27e1b149c79beb4ded8c919c99e9282bb2d23b62fbe6a8befae018afdc557e908c80019d11f6a8bcbcc3d862", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028188, "uuid": "b089e619-918a-425f-b321-e81d51b2c789", "value": "T1C3333B21BA311E1BC0D1947A61F74729B3F5879E64E88A1E3D720E8EBF60A4071537F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028188, "uuid": "19c08275-09af-4b97-abd0-b7c1957f2d25", "value": "768:C7wojasWjFn1MMc5UMGwtvDiO+75ZLE+DESfZ51tJIMY:cwqasWjN1MMcQwV075RictJ3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638028188, "uuid": "173f8d84-cdfd-4bda-9e55-f5ba1d922d76", "value": 54184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638028188, "uuid": "de92fe9a-28c8-44bb-9dd1-40da0a0da9af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028188, "uuid": "03ef224d-d655-4263-aab7-285405c06cff", "value": "626eabf3aa269967064559a6ac95b70f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45937a85-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971332, "uuid": "790125ea-f6e9-44bc-8d16-4b76aea2a8a7", "comment": "Malware payload (Heodo)", "value": "0e7538bb7b43349103ab18110cadb566", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971332, "uuid": "e6876029-188e-44e8-906e-67d4ca77aff5", "comment": "Malware payload (Heodo)", "value": "efa05c4284075dcf563b1add7b0fac6a8dc370f3f27e3a85a8ad2556f786d130", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971332, "uuid": "9478ca62-3cff-4c4f-8989-de73babfcd26", "comment": "Malware payload (Heodo)", "value": "90121243017c7ae016191a8b9b97a2e449b31547", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971332, "uuid": "e213d80f-dde2-4191-8252-ff6e7b817fa4", "comment": "Malware payload (Heodo)", "value": "5146db265db8b57f0a031fccca02c2f3480fd6f5b8c18395eeecdfc5b4a396882a54cd2e261784efefa1c9562b442ff8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971332, "uuid": "ce53cdbb-06d9-4615-b639-12c8f235ab3d", "value": "T1FFE4AE1277C1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971332, "uuid": "11141dac-fe45-4b3d-a963-df8833edaebe", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971332, "uuid": "cc73dab7-8e43-4e60-aa11-8cb784f7b259", "value": "12288:WKEUkuAOLka1miSmuYr1V7iAobS3qTHPR101D:TEQLka1nBVOAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971332, "uuid": "8885710f-6b95-472f-8e8d-089fd95778e3", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971332, "uuid": "154b9f17-e760-4509-ab16-5c023aefb26a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971332, "uuid": "15e2e7b5-0cca-442c-9739-148048ed4acc", "value": "emotet_exe_e5_efa05c4284075dcf563b1add7b0fac6a8dc370f3f27e3a85a8ad2556f786d130_2021-11-27__000206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3abf0c6-4f99-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638028183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028183, "uuid": "1852151c-71ef-4386-b7b2-fcd9bdd98455", "comment": "Malware payload (Mirai)", "value": "ffe3a738e63356f1d34d89de598bd013", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028183, "uuid": "f4ff2e60-f53c-460c-9268-0a5b970a14a6", "comment": "Malware payload (Mirai)", "value": "f06db4dae35e3ec0bf90428c41994d22eabd8eccdb017749f9f6e256177f1ab9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028183, "uuid": "a2a605b3-3f0e-4700-8570-d1424d1237b2", "comment": "Malware payload (Mirai)", "value": "286b7488accf3be2f433670cd7a1dbf84dcd9ad9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638028183, "uuid": "910d272f-be5f-4992-a92a-c979018aa9df", "comment": "Malware payload (Mirai)", "value": "f8f0b066bd2129cf78ca1af7349f67b8fdca8c37ceef92e438b5659121fc76acea1709607c8e966a16df93e8d4695a81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028183, "uuid": "30266ab5-e5a6-4084-8506-02069f725f99", "value": "T14FD32956EB408B13C4D2177ABAEF42453323AB65A3DB73065918BBF43F8279E4E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028183, "uuid": "1a8c71dd-c02a-42ec-9b6b-68269c65d2ad", "value": "3072:5e0Mjd0nFyOLyKai7v/taQwhtEjFYaf/3M/9kDxdYRmjwiWHV:5e0MjG7+Kai7v/0Q9ZYafvM/9uqmjwi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638028183, "uuid": "42b1a7ce-192e-4663-9b2a-1804dc7f1cbc", "value": 134033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638028183, "uuid": "24ef19fd-08cc-4a6a-a509-d04eebe633cd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638028183, "uuid": "b19761e6-9094-42df-9d42-3647399f36ab", "value": "ffe3a738e63356f1d34d89de598bd013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b6aae5-4f63-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638004861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004861, "uuid": "e44dcfe2-238f-4105-83b5-1257da36a13e", "comment": "Malware payload (RedLineStealer)", "value": "51a6d8e64b164769a0689bb468c37825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004861, "uuid": "a88cdd12-a1ac-4da4-8990-7d3cb6fc73cc", "comment": "Malware payload (RedLineStealer)", "value": "f07ce81464cd8f1442dddf56b517a20b55099f84492ed2944e7909f7268d4b8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004861, "uuid": "76612611-5088-4265-9ad9-cd76d241000d", "comment": "Malware payload (RedLineStealer)", "value": "2e0d3f8aaa165eeb52abd0824c081fcc907bf7fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638004861, "uuid": "a79bde04-d2d1-4d03-ad09-a5ea7dd5e79e", "comment": "Malware payload (RedLineStealer)", "value": "3e76e865513c67782547026fcbf7e8de0ff923103305efa39e749468a16b72e8d979152bb1464bb2ee148c9b3f713faf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004861, "uuid": "1452182a-cf16-4c17-93ef-d972b80ac39e", "value": "T16A64AE14ABE0C435F0F756F889B9D3A8B93EB9A16B2890CB52D117EE56356D0EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004861, "uuid": "dc320ab7-d2c9-4c16-90b7-a9507507f03b", "value": "3f0b538abbe574275afcdf5200fd4d28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004861, "uuid": "77840c81-d7af-42a7-bea4-1ceb78ca657e", "value": "6144:TPLSsBygakgkk+YGX/rsaLd6dYh6SXuZet0ySwkAaMHaiitShIdB:rOqygakgRGXTsaLd6dYh6SXuZet0ySwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638004861, "uuid": "a5341964-7a8a-4f75-abe6-5fce4290b919", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638004861, "uuid": "b4eb1664-76db-4dc5-9a75-8329a6a270ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638004861, "uuid": "ec9279a4-fc4c-4594-9ca0-d3d60d86296a", "value": "51a6d8e64b164769a0689bb468c37825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd6707e-4f57-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637999959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999959, "uuid": "824fdd35-f250-4e30-86fd-405c47d52b49", "comment": "Malware payload (Mirai)", "value": "89da93dbb8bc81b4f51304311e40a9e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999959, "uuid": "ef76329c-f609-48db-9275-9cf18ee63233", "comment": "Malware payload (Mirai)", "value": "f24e7fa1e68ce1cf3d44ee97d8365276921d8c25e58c6121883dcb2106916951", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999959, "uuid": "6b42dbf2-2b5d-40df-a7a0-6727a9978c26", "comment": "Malware payload (Mirai)", "value": "6a198d5aee07c522a0f9e0a319dc119a3524ac10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999959, "uuid": "92d3372d-d9c5-4928-8a12-d6b8253a7dca", "comment": "Malware payload (Mirai)", "value": "d9c03ddf9dcf95cae10337fd2832273f311a6c4cc0bcb752db1004bb1c2088d5e6abcfa207cf7d7471e5e7aca6dee242", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999959, "uuid": "8c827be6-ee41-4ced-b7e4-696435b5256e", "value": "T11ED2C0BD0B0107ADD6AE01F92AE507D53DB58B14E483EE5F59C0FB82CE818E539976C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999959, "uuid": "f2428cb6-9cb9-47ca-abb2-2c9154ad4fb7", "value": "768:tyvYLznDEB2iC+sDqC6NtxsLLd9AtQQRVoFTEX4JgGlzDpbuR1Jxp:oYnnDEBI+smAd9AtQQRVy3VJuHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637999959, "uuid": "5f09540e-0297-4163-a324-8450edf0c3d0", "value": 30848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637999959, "uuid": "7f9c4d8f-7e2d-49a8-86c1-082a639e6218", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999959, "uuid": "bb4cb808-cfc7-4e07-82f7-359c43e42eda", "value": "89da93dbb8bc81b4f51304311e40a9e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a164e4-4f9d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1638029931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029931, "uuid": "be433b88-410e-440d-aa35-6a1d8698cc94", "comment": "Malware payload (Gafgyt)", "value": "7518bf084e8bcccd0daa8f2f88ed8683", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029931, "uuid": "4b965586-f77a-4e95-ab87-1b6254d03ac3", "comment": "Malware payload (Gafgyt)", "value": "f38c668dcb294c4b02c0a5cf7dc548ea61804880df41d991fe8bdd37a8cd5b95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029931, "uuid": "2b239893-4897-4dfd-896d-6b4c6a5602ff", "comment": "Malware payload (Gafgyt)", "value": "5dee979ab8ca1090b7672f84b2744cdce78fba72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638029931, "uuid": "f482c531-dc3c-41ed-841d-8126ac3aed1d", "comment": "Malware payload (Gafgyt)", "value": "e04f1659fb4c2a41568afcc70ce466174d954dc11c0aa3aea941e4e1538039e4e76833c9ec84cc4f1148c8eb290c3158", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029931, "uuid": "2acf193b-e113-4e80-950c-6155b2dddd5f", "value": "T1B4C31904FC444767C3E367BAE78E439D37365AA457CB33116A389DB42BC1BA82D395A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029931, "uuid": "e90bcff6-640f-457b-8950-2267f86174be", "value": "3072:CAktyemt13IM+gYFk75hFV/pL+dvimZuDQ4DPsHQtGq:6Jg5F+dC75hFV/6imZuDQ4DPsHQtGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638029931, "uuid": "fa2424f6-c5e5-4420-8ccd-0777033adda2", "value": 128048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638029931, "uuid": "721c98ab-badb-4897-b289-27ee0dda33d4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638029931, "uuid": "345e0da0-797f-4ef4-a77e-d68e13347c8b", "value": "7518bf084e8bcccd0daa8f2f88ed8683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3cef32-4fda-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1638055905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055905, "uuid": "aa6a70c1-b785-4e92-b793-c60f1795d897", "comment": "Malware payload (Mirai)", "value": "8c7c11d075c02eb0459faeab0c25c6c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055905, "uuid": "8c34b679-0c20-4872-8ba1-ffbcd0943c4b", "comment": "Malware payload (Mirai)", "value": "f42cb8c7a88154421991a3810b5ad4ad17f6e57246208cb43ef792773c327704", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055905, "uuid": "e89ec5a2-e1ef-422e-aeea-bd6a4b68c05a", "comment": "Malware payload (Mirai)", "value": "2ef5ae4adc31e1b1017c27c3c613aff88ec98ae7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638055905, "uuid": "38f63411-3427-48bd-854d-cff3b9b3a534", "comment": "Malware payload (Mirai)", "value": "1e5b8dc51881ac680831f0fa65001cfc8adbaa8fad9f6773134d7297a93bfdf29b99b4ca78eff73aa90bc4e6453e1917", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055905, "uuid": "6685c380-9e4e-47cd-b9f5-e9ef23fcdbde", "value": "T12F831846BC819F01D6C916B6FE2E118E3313176CE2DEB2139D149B207BCB92B0E7B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055905, "uuid": "5ab138e9-e24a-420d-b6b9-f21b12523012", "value": "1536:6xnSSnI+LkNyKePrcyJtskG49aJrGbjMringRlq8nRX35NYZi:gnvGstsganRlq8nRX3vD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638055905, "uuid": "6a3b612c-61e9-4e5e-bb75-64b45584056a", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638055905, "uuid": "a87c0570-05dd-4164-ae69-762fa13b43a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638055905, "uuid": "c8f01339-64a3-400e-b585-fea94c5d9e5f", "value": "8c7c11d075c02eb0459faeab0c25c6c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f153fe70-4f5b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1638001685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001685, "uuid": "bb2e62fa-a785-42cc-b229-47f49ee378da", "comment": "Malware payload (Formbook)", "value": "98fd57c39f2f1ca4c7f582e7d1620870", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001685, "uuid": "c9ac5cae-400b-4cb4-8ad3-62486266e906", "comment": "Malware payload (Formbook)", "value": "f55e37d8505e40b5352a95bd5c391592ca542b842bb937de260bc5826372db34", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001685, "uuid": "1cc9ccbd-b557-4d5e-9749-e82b112f787d", "comment": "Malware payload (Formbook)", "value": "c1148c50103c20c2e4970dde122a02876e011be6", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638001685, "uuid": "836c5091-14c8-4572-8423-6bd913ab8a2d", "comment": "Malware payload (Formbook)", "value": "5e374cab065b87a913450fa495bab669283fe91c17bbcff6d8ed5b7cdef737061e2d252700fe5516bf4977f0feac7b7a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001685, "uuid": "c83845a0-1c6b-4db3-9ecd-7e53201e40a1", "value": "T1A894010436BC5B53D73C8BF855A2B50157F6612EA1B0F38A1EC170ED1EB6F050AA1EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001685, "uuid": "e8e1db72-88a1-4a4e-a119-70ac8c4be26e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001685, "uuid": "4cdf3a08-d795-40f8-b8ee-69509576aaab", "value": "12288:meNRQoLx2f2eF2xk2VAco280tNi9k7mwns17SQixBFm:meHhA2ektvo28yN0Ox671i1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638001685, "uuid": "f936f55e-87c5-4fa7-8b24-5ac922607cb3", "value": 425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638001685, "uuid": "43850856-85c0-4f6b-bb4c-d6b0edeaf972", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638001685, "uuid": "2aa0674c-edf4-4230-9db9-ee801aa46d97", "value": "DHL_DELIVERY_CONFIRMATION_CBJ211126068506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45708884-4f15-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637971331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971331, "uuid": "1608e9b8-9b1f-4bb0-9fd3-0f8abb126427", "comment": "Malware payload (Heodo)", "value": "00f3d86a6406e8ecad7e6ebd52643aa8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971331, "uuid": "1ca54f2b-948a-4a9a-b9b0-40bc47f97341", "comment": "Malware payload (Heodo)", "value": "f5ac5c0979f1804a0c90cd66dac5c86fc5dc27baa84fe1f7daefa4df303c899a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971331, "uuid": "4272054f-c970-444c-b100-3ad94121f99b", "comment": "Malware payload (Heodo)", "value": "eb244d1d34e6a8b4a00cde5632ef882d726d46ae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637971331, "uuid": "fc80f86f-72e8-47ab-b9ca-ac209c95efa8", "comment": "Malware payload (Heodo)", "value": "cb91d8f00e2c6842a2d4ebce3812e3f86c1246d3e73462146341cdba724c61d1d579c840e656e343acd4a1318c19acbf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971331, "uuid": "72da26c2-e009-47da-a980-820150f6c494", "value": "T145E4AE1273D1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971331, "uuid": "c26fd975-c4cc-4092-810e-d6f78947cd00", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971331, "uuid": "caf6b43b-e306-4761-a653-438339729313", "value": "12288:WKEUkuAOLka1miSmuYr1V7vAobS3qTHPR101D:TEQLka1nBVrAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637971331, "uuid": "b9606e0b-478e-4a33-9d6e-24d7137fa079", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637971331, "uuid": "7e500518-4068-413a-a514-4238dc4f6a45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637971331, "uuid": "39a64440-016e-48d7-9d5d-cf48c1ab23e8", "value": "emotet_exe_e5_f5ac5c0979f1804a0c90cd66dac5c86fc5dc27baa84fe1f7daefa4df303c899a_2021-11-27__000207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aee4ac6-4f57-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637999580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999580, "uuid": "75303207-ecf6-45b4-98e8-8a37602dae2d", "comment": "Malware payload (Mirai)", "value": "3813848b707f3dda408b9ed0789b2647", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999580, "uuid": "4ce14b69-f601-4992-b99c-0af7baf5b425", "comment": "Malware payload (Mirai)", "value": "f64b72f28e65cb51194e7f3cb3afe637c1e0daefdb5d58ceb40422055535fb4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999580, "uuid": "06c434f1-fee3-4dbe-a92e-e12f8862bfcd", "comment": "Malware payload (Mirai)", "value": "ffdb9a6467e56a4d5809bd5e52de54f64a73ac8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637999580, "uuid": "f5e634e4-5e00-477d-91d0-7e073651255f", "comment": "Malware payload (Mirai)", "value": "53ab2b0bbcd88ece51d69d0e5b513adff0eba6f4e2582f9b1c249488fbe9fd895a03127a189cca3aa0f162198908fb7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999580, "uuid": "70a49102-005d-4385-b008-d6a8556a7ec6", "value": "T1E2D2E154A7A1E8B0DFB4573EEE7C8102221713BFE4E8B5EB15988A58B64C607E335285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999580, "uuid": "280660bd-2f01-4ab6-98c6-a481ebaa0153", "value": "768:9FoxdX+IoMKVUfzaP1urxIGyYUzpzAhDxZDVs3UozS:9F2+IoXVeNIlzpzA5YzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637999580, "uuid": "9e632d2b-8aec-4ae5-bab8-042eafb5e070", "value": 29960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637999580, "uuid": "cfbb0afc-927b-4129-afab-d33db3a9c5a6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637999580, "uuid": "0839ca06-5d3f-439c-93cc-30ba6b23de72", "value": "3813848b707f3dda408b9ed0789b2647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ceaa122-4fb6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638040466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040466, "uuid": "b8bf113e-2c3a-41e0-b55f-dfd6ff227999", "comment": "Malware payload", "value": "a5bf9656a4510ae89bcc1f8723e0a71b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040466, "uuid": "2a26835b-5c53-40fc-b671-8bafb2be0d27", "comment": "Malware payload", "value": "f870226ebc3763dd4ed19fc2eee15776a7b7026d88419099443c919fb191afa9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040466, "uuid": "9cd3d37d-867d-4b25-b78a-85882ac87115", "comment": "Malware payload", "value": "946000ca74642edabd099783f1860458d1724ba8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638040466, "uuid": "ae6294fb-b7c8-4535-bf5c-be40c278ac35", "comment": "Malware payload", "value": "d8c54fe9d6e614e0c63856e498c3b78c0cea74eeb07130f2a4abfb4c950341b6f70184413d0d3b28524f9b51ea952f84", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040466, "uuid": "2d8eadcc-5cb5-4099-8a0a-1bfe309066ee", "value": "T13595333B87AF77F7E1BF40B542B377C89E2B8048C856611B2FA14DA50B7C8A065B1749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040466, "uuid": "3c1f0c7d-eb76-4170-a72f-1fec0ba10b68", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040466, "uuid": "addcbfaa-a9ee-4f3b-aecf-76261409381c", "value": "49152:qud0BYcJQbjGlSOCwLCq9hAkkOvLTbcIgfJ4s8YWrbl1k:qu6BYrbjkVCwOq9h0cLfftrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638040466, "uuid": "79b5cad9-0765-48e0-8463-c9d078fd0bde", "value": 2049024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638040466, "uuid": "10584711-eca1-4ae8-aac7-0570bcf30013", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638040466, "uuid": "534c8896-5f74-4c33-9d87-fda1ade1b96e", "value": "Repair.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f814d99-4f60-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1638003695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003695, "uuid": "15eee040-876c-4718-ab9f-e0864d7433c9", "comment": "Malware payload", "value": "43b133117578df3c3b1351cccf23ea95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003695, "uuid": "f7eb9df9-7a21-4d4e-95f0-5a832d562d13", "comment": "Malware payload", "value": "fc4d92e3c27087e6cf0a649c7a124266af379cc3b7eb3adfd824735b38123094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003695, "uuid": "f96199b7-1d54-42e8-ab5e-aa481c550b29", "comment": "Malware payload", "value": "ebda59ab273b5485ecf0203e70e952c6ae3277f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638003695, "uuid": "d7807ff2-45cb-486f-87a9-3a732cda4950", "comment": "Malware payload", "value": "2336fdf2725120802e57bd510a4293c8081c42c1a4018d791bcf2120e2778458f63da523f04c62e26adcf46168779f38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003695, "uuid": "ead0638c-14a7-4f03-b685-a9ac3f50ee18", "value": "T1D3211E339F5A8DFAE56D93B14083030C65FB40648F13F1650C8644F92E292E41C07AC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003695, "uuid": "a67dae0f-2a59-4aa8-9dbc-3967ecc405ef", "value": "12:etGSGQ3cslqmkdl/yPnkv0SkEFkCdRv+yLQHcPyjmSLlZ4QeQ11Pucb7IkXhGm:etGSLsmkfIkv0Sk7CtQxt4iPzIkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638003695, "uuid": "e0179394-28f6-4e7c-bd2f-48f4c6ac4b5c", "value": 1187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638003695, "uuid": "042c8bc8-6bea-4ec1-bdb4-927c380d6081", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638003695, "uuid": "c76b608f-7137-4723-a540-8cea9be513ae", "value": "43b133117578df3c3b1351cccf23ea95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }